{ "Event": { "published": true, "date": "2022-12-16", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2022-12-16", "timestamp": 1671235381, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "9cfd85bb-eba5-49b0-ab18-996dd381e5b8", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bd95301-7d18-11ed-9db1-42010a9c0080", "comment": "Malware payload (GuLoader)", "timestamp": 1671178016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671178016, "uuid": "78de76fa-4ccd-4869-87e1-8f659f783943", "comment": "Malware payload (GuLoader)", "value": "c13d6628fbf5433e847407af849e1e77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671178016, "uuid": "6e70016b-7318-4dec-965e-f8981e4a9987", "comment": "Malware payload (GuLoader)", "value": "02562a3a5be85b9ed5b6022e1e50ab3e8ded7bfe9007512fa03e8a21779078d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671178016, "uuid": "8387a2be-a83d-41a4-9b22-77ac3c25d517", "comment": "Malware payload (GuLoader)", "value": "a9f1623a24ac35e3d739df064db917ca42750d16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671178016, "uuid": "caa32494-1fa3-4d0d-93d5-b0ca64de82b3", "comment": "Malware payload (GuLoader)", "value": "eeff573de16aa804fba74a3cd2a7c09d1e23beeee3d368cabd0aabc15cbe10314a656b0df68ef0ad7028511f4893e87b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671178016, "uuid": "b503514e-bea9-479b-888a-86937a1e65bc", "value": "T1BBB412D67A92E0E7F54A49B10D27FC766A36FC192C60471B7201BBAFED32241842774B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671178016, "uuid": "83c6f74e-7846-4503-80b5-905528a4da61", "value": "e221f4f7d36469d53810a4b5f9fc8966", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671178016, "uuid": "7ca9af30-66c5-4545-8b2d-d17e95a00d58", "value": "12288:ztoAXsmMsGFWGgTiwKhcQeuIbv/FeWUPa:q1mMsGF5oiVEh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671178016, "uuid": "63c84fbe-6352-4f92-878b-cca764d17e7c", "value": 497864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671178016, "uuid": "517631a1-4256-476a-af37-ad7c13f30a62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671178016, "uuid": "788de8ce-f015-4520-891f-ed98ede82319", "value": "c13d6628fbf5433e847407af849e1e77.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b3624eb-7d6c-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671214066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671214066, "uuid": "aaa3387d-fa1f-4d72-83dc-089193dfec69", "comment": "Malware payload", "value": "31e5f2a6588723aadefaf5595482d955", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671214066, "uuid": "25a8b334-726c-430d-8332-32ab4a8b6129", "comment": "Malware payload", "value": "0278ab4f0298aa6e8066c14cf2b0063a09ac96e8bac365ddf192092dc17b42af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671214066, "uuid": "b0248bb6-50f9-4dfc-91e6-a2e675deeb29", "comment": "Malware payload", "value": "9f9963310c8cdba6cb7a085d950e9d3274d67d5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671214066, "uuid": "4ae56a07-4258-4ae0-9b5d-9abb3ad1b8ae", "comment": "Malware payload", "value": "7f2b76b38bda5dcfe58fb6b58ef1c19bfd80fc5a88490da1c3f379d743d0f6b7f116d409601aee0ccdc402f500d80d69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671214066, "uuid": "7c340f8a-8a0a-46a8-ad84-922ad0c0d16a", "value": "T1BB763A03F85190A9C1EED230C66692A3BA717C494B3027D73B50FBB92F76BD46A79314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671214066, "uuid": "f6fdfef1-1e64-4b8a-b813-2f7e8bec9939", "value": "57c9b357ae0cb2f414b0a5873e2f216d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671214066, "uuid": "2f6628e4-9c36-44dc-bf83-92a24b1b76a7", "value": "49152:RfKECgAG4VFdurb/TxvO90d7HjmAFd4A64nsfJl6QnJ8FxaUbSCItEptH8uLuX2K:RIn+1uGgaMfUTEUAz2Xa/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671214066, "uuid": "22577ebc-2c4a-4e0f-8f49-b0e410a66a65", "value": 7798272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671214066, "uuid": "c54d4c74-3a43-4e2e-8062-6a4beb872f7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671214066, "uuid": "15b46c0e-dace-43ea-9584-9744ed2217be", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f57b43f3-7d4f-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671201789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201789, "uuid": "48b74927-9dee-48e8-8f00-65547c3ecc30", "comment": "Malware payload", "value": "b09ed34a4963eccd2550bd05a7fe01a6", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201789, "uuid": "aaea77f2-d56e-4027-85b6-69cd1872d645", "comment": "Malware payload", "value": "03477948560ca99b014639bfa2fd16efe835ab80a7ce3b090f18a65003f7b76c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201789, "uuid": "d90ff7cb-e0a4-4072-8c23-212e6fb9fdc3", "comment": "Malware payload", "value": "3deac0832fda0e65e6a341118dc6ca355fc2b915", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201789, "uuid": "06d1c85b-2917-4812-8e53-8c1e0516e789", "comment": "Malware payload", "value": "4cfd22e2f3bc92bef23961cae5c0a7f42fc5989d630ea6a33931ef08f38c93e857b15a880dfe76d4b55ffee0fbffd2e2", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671201789, "uuid": "5e69a346-8d49-48b7-b44b-b68a53e02599", "value": "T149428F7BC500F201C39CC9FD594917F4A60C61A3AAA2995EF116B6988FD11C7475F2CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671201789, "uuid": "90ff2b9d-27c4-4781-8d51-bd4e26c5d1e3", "value": "192:ScIMmtPTxzjkqwmsqz6c8n15bv/05O5REFC1MrdlpsXLCHMTlLftG+Qrl:SPXbxMqwHG6c6IO8AOOLCKI+Qrl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671201789, "uuid": "f58f9df7-73ff-432b-8786-05327848cdb0", "value": 12003, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671201789, "uuid": "f5ab0c2a-6845-45e7-9df6-f9db1c2c3155", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671201789, "uuid": "adbc3781-2427-4bda-8ce0-e954f9b9449d", "value": "Dear Email Owner.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e61da12-7d4a-11ed-9db1-42010a9c0080", "comment": "Malware payload (GCleaner)", "timestamp": 1671199307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671199307, "uuid": "1c84fc87-a1d2-45bd-8fdf-47ce15797252", "comment": "Malware payload (GCleaner)", "value": "ae7b7076797fb20b6e1979e420a7d17d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671199307, "uuid": "a4f8bb9b-0855-45ea-b007-55a962222cc9", "comment": "Malware payload (GCleaner)", "value": "044439edc3582ceea1d591e734acdd3e75bb88c932e777e43c658e5c3a85137c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671199307, "uuid": "eb8598ad-699b-41f7-81b6-82a57d0f5539", "comment": "Malware payload (GCleaner)", "value": "6dd33b65129d5255e58fe98b3a96ca77cab57f05", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671199307, "uuid": "0bba5c91-b2f4-4ba0-b169-af1f0ac4f426", "comment": "Malware payload (GCleaner)", "value": "667062239401987ead42030a5a1a3c2b7ad7807d8bbffec6c69ae1cebf4f94b6a66e2fcdad3ff79ef95985008cfdf712", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671199307, "uuid": "397c8ba4-7876-4537-a5a5-77214fc58ddc", "value": "T1B4B5237EA99400B6C0F71BF938365C3185E39D6B2934E94E33593F9BB7FAAD14602205", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671199307, "uuid": "a6b6a892-8108-42b5-8d8f-8bb81d33e2c6", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671199307, "uuid": "16196c3c-f1fc-45cd-8121-1c81ae7ea0f1", "value": "49152:kp2edeQedynqrOpYN0FqxvPdeU/QrMVDAb/iAln/INIV7leOCgSY/im3:kp4zT0Sj3deCoGUbaAln/TDcY/im3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671199307, "uuid": "268053d5-8163-48d0-9af8-adbc8fed32fe", "value": 2409736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671199307, "uuid": "984ea1a3-4f2a-4c32-8471-74d804cabef5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671199307, "uuid": "24776fc7-8f61-4d0e-9c36-e80fa0fcdba9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95e812bf-7d9d-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671235129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671235129, "uuid": "28166130-014d-43fa-9568-2b32329642e5", "comment": "Malware payload", "value": "cd632aac93b787f9e8017338ef22ce2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671235129, "uuid": "faa1e55b-a9b4-4a07-b2a8-be85079d1482", "comment": "Malware payload", "value": "05ee26bd00949a8cf86fd9e89a8d4654877273efef070c5a52df7afbe22350b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671235129, "uuid": "16dacc1d-def1-4ff8-8337-ec85afb0acaa", "comment": "Malware payload", "value": "151471bbf89076ce2c2713c78eca3bb1f536d1c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671235129, "uuid": "f11dc0bc-49b5-41f7-8c41-9140c8bec92e", "comment": "Malware payload", "value": "25c18b5493fbfad0d5e2bfb4f889a4f18a2b3de45658fe38038f58557379ebbbf33a89c385ce0b4de77c8ad4b547c2d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671235129, "uuid": "722cec0a-dbea-4b54-b44b-4f343f64bbfa", "value": "T16224BDF17691E06ED052C730891496E5673ABD214E629AFB3B043A2F1E702D156FE33D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671235129, "uuid": "52c5a32b-3093-4e2c-b6e1-860731ecccfa", "value": "e6bd3d9b5d23304bda5e80b81c28964e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671235129, "uuid": "037d9431-d4b3-482c-9bc9-eed3182eb1a7", "value": "3072:GjvVXELos79LcaTR9U7ztODULkd2CVLszqh+40zwUzQRKF+:WSLos797U7xOoL/CVgz740M2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671235129, "uuid": "35837b56-5c86-44a3-85e5-b1ce14779e94", "value": 218624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671235129, "uuid": "5febc315-a04e-4e0d-a17b-0efe0ca972cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671235129, "uuid": "d48d2019-b80e-44a7-ae2b-e24e1489ba69", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e530bf05-7cfe-11ed-9db1-42010a9c0080", "comment": "Malware payload (RedLineStealer)", "timestamp": 1671166972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671166972, "uuid": "c923dc24-a6eb-42e7-a705-0b4295a25b43", "comment": "Malware payload (RedLineStealer)", "value": "abf766f4f0da2c3feb7479c5de99b446", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671166972, "uuid": "2802146e-e807-48d0-b515-a41e83b65956", "comment": "Malware payload (RedLineStealer)", "value": "0652b9e3ce54ada033aa9d76d6eeeb351a826cd8b421721cf8046df7fed44a1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671166972, "uuid": "06c746e6-b818-4157-91f0-1b54e8b591c4", "comment": "Malware payload (RedLineStealer)", "value": "4c778ec48c232391db4c032c431d597a628c23ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671166972, "uuid": "d3b520a9-0f20-401d-9cc8-10a7aab5dc02", "comment": "Malware payload (RedLineStealer)", "value": "a608eb7f7ec22c1fc915593a70a2a76a9ea0f9130adaa7cf2c98b00b1b5a3f7d0d319401aed507188491bf11df10501f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671166972, "uuid": "d861cf5f-16d5-4c62-8fca-25b0c8669c64", "value": "T10A94E0117A72D4E1F931C5754C26EBF46A69B861FAB2D633330AE70F9D703938A26305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671166972, "uuid": "462c5f38-3e83-49d1-9cf4-b1e0232a8f00", "value": "2067eb05796787c0f2b3dc09403197ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671166972, "uuid": "b6ea8ad0-deb7-4c99-b12b-b1d3439ff644", "value": "12288:pxJeQg0hzOn5/LbGxldNazelIxnzpQ6ijqF:pSQblO5zbGxhaalczK6Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671166972, "uuid": "7c5025ab-8d57-464a-b4b9-77b4fe76eeaa", "value": 444416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671166972, "uuid": "1c60125f-01ca-4459-97c9-979104410575", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671166972, "uuid": "a153b228-e206-4b2a-8105-4cf7a0647ee9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc67395a-7ce6-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671156703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671156703, "uuid": "4c7b8131-9e8a-407a-b2a1-19fe76f9a5cd", "comment": "Malware payload (Smoke Loader)", "value": "81c5c54e97b5428e007801a02b29eda8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671156703, "uuid": "08183fbe-10cf-4a88-a2cc-937b00d04503", "comment": "Malware payload (Smoke Loader)", "value": "0794c125c7f1ddd327fcf9d89345a840601547676642742ee969090d1ea4f71a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671156703, "uuid": "44d6119c-d0e4-4188-938b-528b4197bd9c", "comment": "Malware payload (Smoke Loader)", "value": "b9bda37f9ea6c2253e0f8cb9ec9507180fbfc7f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671156703, "uuid": "f5ee775a-0283-4f3f-be79-33976b564aa7", "comment": "Malware payload (Smoke Loader)", "value": "04cb5e2fdb21173caf80a7258526bf3dcbbd58af777088a99d2d4b4541fa0675fe1bb21cc8729e9ce63a360085d40324", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671156703, "uuid": "55a7e2ec-8550-40c1-8c47-6143a4f6e03f", "value": "T1E474CF017EB3DCE1F832D5754826EBF466A9F820A9A1D6332706F71FAD302939576305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671156703, "uuid": "94c6f258-7f7f-4ee3-ad90-e1c083c1af8c", "value": "2067eb05796787c0f2b3dc09403197ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671156703, "uuid": "3b37c669-c4b5-4399-b337-962c0ef5ec81", "value": "6144:u1Y5VLiE00DOIe26NnyW4CajPmG0iPvzpQ6ijLxQFiaI:BVP08O5XnyW4CEmGxnzpQ6ijqF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671156703, "uuid": "488e5e23-a6a0-415e-8c00-81886c239ea7", "value": 342016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671156703, "uuid": "707d27e0-0164-4534-8f49-71de01a5e276", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671156703, "uuid": "a63d9b49-2b08-458f-8711-cd081ffdc106", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36bc474b-7cdd-11ed-9db1-42010a9c0080", "comment": "Malware payload (RedLineStealer)", "timestamp": 1671152506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671152506, "uuid": "a7660d9d-f346-4ad3-aa35-17277d7ec7d7", "comment": "Malware payload (RedLineStealer)", "value": "54da4d01246d919fbf9d389233b311f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671152506, "uuid": "7dd96654-0a7b-42ca-b0cd-a0053aee83cc", "comment": "Malware payload (RedLineStealer)", "value": "09934f2ff52d7b72ac302b5ca0f11b4caa2d85aeb6c4c92f5c588883b01d1cf9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671152506, "uuid": "b3af7797-c369-4ac1-b77c-1da0b5f229f6", "comment": "Malware payload (RedLineStealer)", "value": "712e385155343dc961911ce49830eedf227b1184", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671152506, "uuid": "8d17b62f-80a2-420c-95ce-9c69bcdfaad0", "comment": "Malware payload (RedLineStealer)", "value": "e49aa365049cf1bf2ba339d5a9a6649f41c35d6773436a0573d1c6b2a359060aa5911c271fea6641dec95763177e6f7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671152506, "uuid": "91e8adb4-2ae0-4a60-8f67-3338d17ad3e8", "value": "T18A94E0017A7394E1F932C571D926EBF46AEAB821F9A2D6333309DB1FDD302938526315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671152506, "uuid": "b0413c7d-9eab-4145-9657-bc630872a3d8", "value": "2067eb05796787c0f2b3dc09403197ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671152506, "uuid": "0a8ac80b-3164-4552-9c46-6135d305bc10", "value": "12288:CqzMDGwda2nZ/YUpPeEVMUxnzpQ6ijqF:Cq/wd3Z/Dp2LgzK6Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671152506, "uuid": "be49c897-2a4e-4d76-b24a-fd0ca74afc8f", "value": 443392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671152506, "uuid": "3f218467-ac2d-4abf-8c62-f7269203a705", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671152506, "uuid": "4a537a69-9d1b-4a2b-8dfd-12f7549fc6b9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d52d129-7d44-11ed-9db1-42010a9c0080", "comment": "Malware payload (Amadey)", "timestamp": 1671196890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671196890, "uuid": "3cffea27-b4d7-4ad8-b98e-9fd1e1d8072e", "comment": "Malware payload (Amadey)", "value": "41bbc8b97453e0412c1bb0dc0d02730d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671196890, "uuid": "3f2020a6-b09a-4643-86bd-a33407390098", "comment": "Malware payload (Amadey)", "value": "09a779cf89b0271a88112d4bbb2c5605816c1934ea0ced097643d13ac95888a6", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671196890, "uuid": "d46e06f3-edea-4ba2-825b-a00c721b1fba", "comment": "Malware payload (Amadey)", "value": "e16bff301a4b768ff00b029d851e1091a8e7cc5b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671196890, "uuid": "c1954446-7bd8-461a-8796-07fc683e1af4", "comment": "Malware payload (Amadey)", "value": "13b9981ea6d65d7fb32999221bfbe58097687b13dea9846e7dcc37c626ea77a65b666827b1c812d59ab075af30a40d2d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671196890, "uuid": "cffb26c9-f0c9-4eff-a245-e53c79fb2bf8", "value": "T1FD54E11277B0C071D15F59314869C3E15A2EFC7299B2A90337767B9F5E30A49A93B30E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671196890, "uuid": "3f54d90f-0f94-4ba5-a210-a21aa5e43fb9", "value": "2cc3e4b8a374ca30888470c0a531eceb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671196890, "uuid": "610793ae-e2e6-4bd7-bdb7-d7c32f1202de", "value": "6144:6ILH9nRvBkZDRCG52J/dwmt3tRJD8qMrc:6IxnR5AW3HR8n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671196890, "uuid": "16f7e019-34df-4db4-adf0-4c936fd199d4", "value": 280064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671196890, "uuid": "c07202a9-cc39-4243-be77-89e6857c1538", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671196890, "uuid": "df7c754b-3f10-4527-9b19-e95666e390e0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8b0f0fb-7d1a-11ed-9db1-42010a9c0080", "comment": "Malware payload (Formbook)", "timestamp": 1671178977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671178977, "uuid": "5233fdc6-9bc0-4af8-a7a7-2ac79688b0cf", "comment": "Malware payload (Formbook)", "value": "04f80e8dfae2f2c975679c6a14a74a2f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671178977, "uuid": "3d9b2f53-54d6-4c83-bb54-3daa105a6587", "comment": "Malware payload (Formbook)", "value": "0a6e793b8f18bd020014ea72a63829fb146a9ef290bbd083d02b6966df3cb12e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671178977, "uuid": "42509d6e-6e6f-4f2a-8c1e-2601ff8fbb6b", "comment": "Malware payload (Formbook)", "value": "7c031a13d7c0caa18dbda655613b1a5cf8ca9fb8", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671178977, "uuid": "0244af09-b209-4b4e-a0cd-93125daeb17b", "comment": "Malware payload (Formbook)", "value": "c747ef92d6af43b93e78d20590bae11d8fc123a32fedc71627125280c79cbcf7f76b4fbd461da6f970d528b4209a2127", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671178977, "uuid": "5a37f200-0eb6-44eb-a58c-e15875b80721", "value": "T126D423FA5D8C3751EA325562A0255C87827FB4434F4714C3BB1784A9B811DB26FAFB2C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671178977, "uuid": "ba212a3f-d012-4064-a39c-1d30eb803476", "value": "12288:vtBtFLCe5vu0hJo+kgKqJZ8C7tD3LHD2x0NVX/OH0zuot/gI3uIUVu+1ga:1BtFme5Gh+kgKe8GrPZLOH0Ta+u3k+z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671178977, "uuid": "62197e8a-76e8-48c0-8c29-261e991becfe", "value": 602991, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671178977, "uuid": "5a21b737-40d8-4f91-8932-97905524c640", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671178977, "uuid": "29b449f1-c515-40d9-b0c5-1352ca5ab2d5", "value": "Agreement Renewal.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c57e36a3-7d83-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671224042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671224042, "uuid": "838f7484-5150-4be7-80b7-0f2f10087a2c", "comment": "Malware payload", "value": "3b3f602b56b76abae5c2bfba95bcf566", "object_relation": "md5", "Tag": [ { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671224042, "uuid": "ed283b1f-526a-4dfc-be5f-16f5abd172d1", "comment": "Malware payload", "value": "0a852d068987f57f507a4acc64da95de60f1324b555031a3a04ab8763496a4da", "object_relation": "sha256", "Tag": [ { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671224042, "uuid": "3acb8723-83b9-4eb1-91cd-bafba824b1fd", "comment": "Malware payload", "value": "82d3d63463bdfe169fa5e46cf38f974a59ce5035", "object_relation": "sha1", "Tag": [ { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671224042, "uuid": "67e0bbac-99ee-4d1f-95b4-0028b3e18dd6", "comment": "Malware payload", "value": "547d187ae92cfac531f79688f5236d21b61a0614179c1312f7286b2ab5d719e503f2469c987afc7f87c916acb1ea31c4", "object_relation": "sha3-384", "Tag": [ { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671224042, "uuid": "388a39db-700e-42ed-b734-22386d30ef44", "value": "T1E0E07D7D80C56FF0525D187A4F6D06584FD424671C512443BB990F8107E5AD7E20F0E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671224042, "uuid": "57762a3a-0469-408c-bae5-8e15390d471c", "value": "6:SGIfGloxhzWTFh8xIjd7LbKhOmdnmsXeBXjYAaBhJLU8RjGaH8tUqxehcnBb:QgmWTgOjd7LbKhOmdnm7naBvLXxH8tUq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671224042, "uuid": "b9189e99-a9f1-4f51-8948-8b7552bbada6", "value": 323, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671224042, "uuid": "37a3f753-65ce-45f0-b1e4-7c831c5150a7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671224042, "uuid": "4c268b31-f9a9-4bc6-a4e5-f74557b49c09", "value": "documentos_.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "958287dd-7d3b-11ed-9db1-42010a9c0080", "comment": "Malware payload (GCleaner)", "timestamp": 1671193038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671193038, "uuid": "325e7c7c-e294-43fa-8abd-adf42d1733a2", "comment": "Malware payload (GCleaner)", "value": "a691badfa1a38c8a7c9b85add6c82832", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671193038, "uuid": "360aaae4-9498-4ab6-9acd-a9c45ee239be", "comment": "Malware payload (GCleaner)", "value": "0c883af9f25ff67e36bc01a24e8d9da2458e53cb9c8a6d96134a3440d35ea6ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671193038, "uuid": "e391cce5-f971-4aa3-a680-113bebde5b1b", "comment": "Malware payload (GCleaner)", "value": "3f469d2be8061943e8d52654dec8ff86e8062287", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671193038, "uuid": "fbe3ee34-6487-4a8f-b052-502f0c62b738", "comment": "Malware payload (GCleaner)", "value": "1d6e7f2b771b7da2262e02794fd3601440763be959378c5ff0210ee79b0af39b0f3e81361f8c40f3c89d7ceed58914f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671193038, "uuid": "7b0568d9-3661-433e-8181-6ee319fbe8b3", "value": "T1E1B523BAA6990670C8B34AFD38169C3295E77D2B292AD04D37C97F6B73FBDC00416116", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671193038, "uuid": "fe10fcb9-befc-4d87-990e-4c133711a791", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671193038, "uuid": "82f95c16-c994-460a-8b42-5ed27439abc5", "value": "49152:EpoSLQXS653M1GRsF1ODNKwlfOm4UPehU+bW4p4XjINLeOCgSY/imd:EpoSLQDNu1O5Kwlv0bW4p4sNLcY/imd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671193038, "uuid": "49d311f5-8673-4bac-ae15-87031c4cdc62", "value": 2404274, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671193038, "uuid": "5e9c7367-4077-46b3-9969-8cbefb725cdf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671193038, "uuid": "3ff454a0-a685-493d-87a1-4773a6a71f65", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "977b0a4e-7ce9-11ed-9db1-42010a9c0080", "comment": "Malware payload (RedLineStealer)", "timestamp": 1671157822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671157822, "uuid": "e6b04dd0-b601-4037-975d-ba59172f4eab", "comment": "Malware payload (RedLineStealer)", "value": "1d7c75fd0ccd76291969312a281a5d37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671157822, "uuid": "48325bfe-11f1-4efa-87eb-52727935b395", "comment": "Malware payload (RedLineStealer)", "value": "0d1bb2f98c54b3ca6242905a9386a929407e0e378577a52c68aa31e560f389f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671157822, "uuid": "66e6e637-d0bf-4139-bec1-1afb811b8d9f", "comment": "Malware payload (RedLineStealer)", "value": "baed310b1cd195efc076ed6aac5729413f89cdf9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671157822, "uuid": "f3ad8bfd-e834-418b-ab8c-3560b498b0e9", "comment": "Malware payload (RedLineStealer)", "value": "01f1e0b33dbac890d6423a2684346fee5e2162c39e264dca39b3fd95662ec394641678a3c31b44ccb256554c7fc12a8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671157822, "uuid": "958a79ba-5469-4e10-8eb8-ff2c1c99cf0e", "value": "T1AF94E1053A7394E0F932C5355826EBF4A6A8B860F9A2D2333709D71F9D31E93877A315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671157822, "uuid": "593658ab-3dd8-4685-894d-cdc0b302bc00", "value": "2067eb05796787c0f2b3dc09403197ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671157822, "uuid": "13896850-d3e0-4794-9f85-ff75f56636e7", "value": "12288:I+85MTXYIOdq9EqadRzuTi4ixnzpQ6ijqF:I9MTXYIWqadYTi4KzK6Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671157822, "uuid": "ff35c28d-34b3-4e6d-89ba-89d894a846ef", "value": 443392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671157822, "uuid": "529a9020-d5c1-4fbe-8e7b-35969a0440b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671157822, "uuid": "0987b647-f4e6-4dfb-9d17-5277baab1559", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6df81b4-7d6c-11ed-9db1-42010a9c0080", "comment": "Malware payload (Tofsee)", "timestamp": 1671214193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671214193, "uuid": "48141bb4-ae6e-4ee4-9542-ce6ac462e26d", "comment": "Malware payload (Tofsee)", "value": "394ba0dfd6e9a92cd1ab9650de932636", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671214193, "uuid": "d01f48cf-3b9e-448e-98d7-d9add7e766af", "comment": "Malware payload (Tofsee)", "value": "0ee2e6bd4438688f88351c16c5b782d9dc4824576e0886d59ffc79cfa12b05bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671214193, "uuid": "97ba6629-7808-4cba-a1e6-df742f77cd4c", "comment": "Malware payload (Tofsee)", "value": "790f17907b416c4128fddce6a6b1571eb0a48979", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671214193, "uuid": "3ed47a30-5677-4b18-98c2-5f7dd206e472", "comment": "Malware payload (Tofsee)", "value": "f4c4df81dc4ece7d449723f7225c01e40068a3f0ee1e23964bf16ca8756830b0bc402c5df975eb70c23d95b08fc9e86a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671214193, "uuid": "57b2c10d-030c-4773-93be-001647a268e8", "value": "T1BE24BEF07690F96EC151E7308D18A7D59AAAAC105E22A9F33B08362F5D306C165FE37D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671214193, "uuid": "1d8f986d-8f7b-4b1a-ad31-059fa987c236", "value": "3670997c8c2669588bad5b8c178dedd4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671214193, "uuid": "86a02361-fbf3-45fa-b697-a1d9551cfc00", "value": "3072:2ST8KLhaWcP0RTlZtuBtrwZQTZrp3JeETdnLszdrdZqEH40zwUzQRKF+:ZlL0WhlbuBVlVrp3Jeidngzx740M2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671214193, "uuid": "cf9b9b3b-612b-45f0-925f-700697a7f3f8", "value": 220160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671214193, "uuid": "766b443b-3526-4ec6-8d5e-23e9e14867cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671214193, "uuid": "0cdb5df9-edf5-4fda-8ddf-88add725a5db", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88c5ce95-7d41-11ed-9db1-42010a9c0080", "comment": "Malware payload (AgentTesla)", "timestamp": 1671195593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671195593, "uuid": "a35ee2fc-a0b5-4d70-ba07-0c04b8280599", "comment": "Malware payload (AgentTesla)", "value": "7dd014de79ef056a4e9a9d01de52581f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671195593, "uuid": "dd911591-2cd0-4c0f-a807-d1993065206b", "comment": "Malware payload (AgentTesla)", "value": "0f8bdb179425c93430b81e36a2df60903c06de31ad4b7bebf1a85db865bb2495", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671195593, "uuid": "727d8319-c9e6-4e7b-b627-d8cb7e0afd9a", "comment": "Malware payload (AgentTesla)", "value": "322f8fa10aea07b63c1e5f64da33697a77df7129", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671195593, "uuid": "21090c6a-c4b0-4537-83f5-d082862b9fcf", "comment": "Malware payload (AgentTesla)", "value": "a2f0df48e98b86b06812750c7ecb6ea66ae213d211f631f1539c4de61acf38d3e1d95f23ce568d2d942c94f616dc7d2d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671195593, "uuid": "2d388820-cf09-4b71-8841-d494c9ebf196", "value": "T112C4E167A183DDA6C245593D4674FBAC823CCF620E1B629671753223EE76C4B2F08CD6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671195593, "uuid": "fc9a2d81-f9b1-48e8-9516-a2e6bd2c3285", "value": "97318da386948415d08cef4a9006d669", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671195593, "uuid": "9c37fce4-13a6-46e1-b1e9-95fae6bb5a74", "value": "12288:9fJolmJxRHHE6mRsc9gC8NLhPtD6IA1BPD+uYrajFLHLuN4Tz1ubl4xw:9fJ4OWBiXsu+xub2O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671195593, "uuid": "645223cd-65eb-46e4-a40c-cdb092738a80", "value": 546366, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671195593, "uuid": "1c5a1035-27e7-4b9c-a295-11e8ac631fef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671195593, "uuid": "d3700436-cc08-410c-835f-ebfbf36d9b72", "value": "hesaphareketi-01.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99a498f8-7d26-11ed-9db1-42010a9c0080", "comment": "Malware payload (Gozi)", "timestamp": 1671184025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671184025, "uuid": "0dc4fdee-eebd-4006-befd-5c77c592a316", "comment": "Malware payload (Gozi)", "value": "8d8c68499fd1d03897fc08052cd81260", "object_relation": "md5", "Tag": [ { "name": "62-173-138-28", "colour": "#2C8641", "exportable": true, "hide_tag": false }, { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671184025, "uuid": "0b99122a-33db-4275-b8e7-40bb4361f3b9", "comment": "Malware payload (Gozi)", "value": "0f997ba8de3188cba8ba064480ee5171c3e1dc322f3aac97ecd4aa4617991c7b", "object_relation": "sha256", "Tag": [ { "name": "62-173-138-28", "colour": "#2C8641", "exportable": true, "hide_tag": false }, { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671184025, "uuid": "377fbf40-2f15-49b5-8e9c-5d3f67bf3264", "comment": "Malware payload (Gozi)", "value": "ec95b916692fa3976ff47cb3609c3c9c217469a7", "object_relation": "sha1", "Tag": [ { "name": "62-173-138-28", "colour": "#2C8641", "exportable": true, "hide_tag": false }, { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671184025, "uuid": "c571c398-79d3-47cd-b974-4d4214553e78", "comment": "Malware payload (Gozi)", "value": "3c911137f8103b4a24fa90c4695ef52b480c81a68bea66e5615adedeae2906783932f32b02c3c3daf9dae8b6784ec0f9", "object_relation": "sha3-384", "Tag": [ { "name": "62-173-138-28", "colour": "#2C8641", "exportable": true, "hide_tag": false }, { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671184025, "uuid": "0ed6f1a9-f829-4c6f-8039-32801912eada", "value": "T14E34CF5172B1C472C59F053188A5C7F06A6EFD315A72AA4737757AEF2E30A90623A30F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671184025, "uuid": "15e20e7c-4185-49ee-b37a-a84f0a7dcbb8", "value": "b35462da489bc13bae884e55b5227599", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671184025, "uuid": "8a7888cd-5c37-43d1-a930-2efd62540bea", "value": "6144:4KkpLsGkZrmrvVcXVYM74OYte+a8qMrc:4KkpYGgr6ulYrbE+a8n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671184025, "uuid": "0f798634-bf6e-4d28-a26a-8eb258263391", "value": 232960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671184025, "uuid": "2ebbd332-0e66-4095-86d0-ad9c4f662aa4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671184025, "uuid": "b2cbd84d-0f3a-4b70-97fa-b68a98b496e1", "value": "entrat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ace5f6f-7d91-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671229903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671229903, "uuid": "c7971a06-ae42-4d51-b0c5-52dacc3eedd7", "comment": "Malware payload", "value": "d7d4b10025be5017c769354523be497d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671229903, "uuid": "08de6a5e-17fe-498f-8eda-a7b3cf677945", "comment": "Malware payload", "value": "0fdc016b1ae1f11d2d840a446360ffcdd27cd8827a4a69f0c4269325a6234fd2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671229903, "uuid": "d426c164-c805-4920-b003-416ce3fd5609", "comment": "Malware payload", "value": "a1ae455db70ff2024d8b72bdb006d14d479fdc60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671229903, "uuid": "7e76c07b-8aa7-4930-a89d-16656f41d053", "comment": "Malware payload", "value": "d0d0446d14a6c8c93370ea3761b2c7a2a647c9a770917c4c7873b7f985c557622ad6301db1e33be5049be66a25eb8b10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671229903, "uuid": "ef42439d-dc06-4d0c-9ea1-028af8077e48", "value": "T15A74F0F176D0D46EC212C7308C1096E5AA3AA9916F3299F37F442A1F1D312C1A5FE67E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671229903, "uuid": "dcb930f2-2c22-4fe3-bd77-df3ec826dd15", "value": "aa9c378109186462717e17e657d0c833", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671229903, "uuid": "fd1f31be-a118-4c8c-bc7f-53e5ee8346cb", "value": "6144:SzcqkLKDSjYr2h0REL5J0wNWdb7HVApMbggz/EIIdT40M2b:SQfcIGr2jYdbDVA2JDE7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671229903, "uuid": "d458572d-fb82-48d1-9533-f6b7478c545e", "value": 342528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671229903, "uuid": "17309b63-904c-4c42-9819-193160a493b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671229903, "uuid": "5d9c43f8-9132-493c-b830-6a251bfee5a7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e61d024-7d44-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671196730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671196730, "uuid": "b59f1645-a551-49e9-8d8d-c98a14b83a67", "comment": "Malware payload", "value": "912005f12dd46262bfbac355d30c873c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeGaliXCity", "colour": "#607CCC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SpaceCity", "colour": "#5EBE6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671196730, "uuid": "540378cd-37af-45da-bc4c-78199dfa0c51", "comment": "Malware payload", "value": "1041962780029fab7ba54ab21c49185c8f105f774f3e75286dd6f83f27a6a587", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeGaliXCity", "colour": "#607CCC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SpaceCity", "colour": "#5EBE6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671196730, "uuid": "4efb313f-a77f-4ad8-b894-1e7208d6abd0", "comment": "Malware payload", "value": "3e4a5082ee71202453c4c465fd32a1737763ddb5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeGaliXCity", "colour": "#607CCC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SpaceCity", "colour": "#5EBE6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671196730, "uuid": "7dbb0eb0-fc43-4795-a937-8f6531c68377", "comment": "Malware payload", "value": "b1f1bf5d63df06c03155667a5f324bb544e3d6b9ab0272da5fd399166994b4e43dd8df79d16b0e42a11d7576959b0bb2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeGaliXCity", "colour": "#607CCC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SpaceCity", "colour": "#5EBE6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671196730, "uuid": "4ca8516f-67e0-423b-bdaf-d14bd9361a64", "value": "T18A368D107E41C176FBC202F69ABD7BFA466D9E20472C94DBC2D83D594D702C32B366A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671196730, "uuid": "bb0f7999-c9eb-4097-bd0c-8564d1dcf093", "value": "28f2bef84068d573cea644fd9fa48e40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671196730, "uuid": "95e7bf7e-a667-4ed4-bb23-dfd4860dce01", "value": "98304:Bgf5K0MkHwjBzOdgPDmKneJCqgpk585NqFJKTKK4KKDyK5FZ1EEEEmEEE1EEEEEh:uf80viq4aKneJ0u6Ug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671196730, "uuid": "de2df4cf-f603-40df-b795-6df9a1b1f34b", "value": 5217184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671196730, "uuid": "05d540fd-9637-40ac-b8f6-4343fbcc960e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671196730, "uuid": "56f86ddc-fa1c-402a-a411-14c74a67737b", "value": "dingtalk_downloader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a67521a-7d9a-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671233607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671233607, "uuid": "05e6a352-728a-43a2-ba2b-9063958f008b", "comment": "Malware payload", "value": "e819f15be0156efa32fe2034dd2ce932", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671233607, "uuid": "2fda69f6-18e9-4549-87cd-177cf5d1b8c5", "comment": "Malware payload", "value": "117bd2c9e3129351eed6cb440c52bbf570b3ed971053f66d5a6ebd012b281731", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671233607, "uuid": "84b63f7f-0631-4572-b7a3-75bd9ed8eea3", "comment": "Malware payload", "value": "0f93ed862e85cb091bb3ec8d2d84757b25778ce8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671233607, "uuid": "3e608536-40f7-4560-8e40-e6c4b828c944", "comment": "Malware payload", "value": "5f453ce32f175adf3245736dba684279c9294ea2c81d0dc7efe3a224ad32b45a9ab0e26d95666b8497dac0bac81374bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671233607, "uuid": "467d06ef-4c11-417f-a59b-f419b5e8209f", "value": "T175654C386303E563F00A23F1275081874C1EB49666E487F6EF50539AD6B56E0BFD6B3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671233607, "uuid": "9bee0b11-779f-40ec-9211-aaf9d9b46d7c", "value": "9f2c76418357be5cdc291649da90bd66", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671233607, "uuid": "dca86121-f363-4d6b-9723-38f023127eed", "value": "24576:HzSvNjFF2avfU4L6c62kiP9QUVhhbNAjTI5AheSwWjiDA+FWKrxAt:H+vNt/Lt62l9QUVhhbNAjTI5CTwweA+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671233607, "uuid": "66503de3-0bac-4931-b352-edcb45d0461b", "value": 1503376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671233607, "uuid": "0451c865-08bc-40e0-a735-26fb8770b162", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671233607, "uuid": "f09bd2cd-2b07-4872-91e9-d6123a82f274", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e54081a-7d86-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671225077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671225077, "uuid": "a9150ba0-1a46-4595-b63a-ce4614551983", "comment": "Malware payload", "value": "a5d5e28ae6bace6085c00942780f56fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671225077, "uuid": "51e1ca6b-fa83-442c-a2a6-70d456f4c468", "comment": "Malware payload", "value": "12481df14c2ace4f75fbb01ef72cd66e0f6cd41d81703a2eba4b5314b04494e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671225077, "uuid": "6d8859f7-3242-4c4b-b938-ccc200050189", "comment": "Malware payload", "value": "17b6554ef2d0e761d6fef345d51fe8ad8d671b6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671225077, "uuid": "6b6caa61-a5e3-4f17-bfd4-cffe51c5ecd5", "comment": "Malware payload", "value": "f0c43a31ccef35a08a99846e46564ce3fc0ef2533ad647551fefa74b0a043b8bbfecac10ab09c3841d79a62fe2a25923", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671225077, "uuid": "daec09cd-5d42-4d12-9215-d14a79dcb449", "value": "T1DD24BEF176A0E42ED141DB308C25DBE5A66BBC114F6195F32B18262F19712D05AFE33E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671225077, "uuid": "7433315d-f784-4e1c-8f44-5ab53db94f5a", "value": "aa9c378109186462717e17e657d0c833", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671225077, "uuid": "62009d8c-0fba-4647-9321-e8448dee14ca", "value": "3072:u6D0yPBLk+WaSbRcqUnACQ8ykRNyMRrcpmPuK2W/CLszb3PF998N40zwUzQRKF+:FPBLk+WcqU5Q8pNysrWK2ICgzu40M2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671225077, "uuid": "306af932-e7bd-4964-9db9-370c0f833ace", "value": 219136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671225077, "uuid": "b95417a9-ab72-4919-be75-30d9eaa643fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671225077, "uuid": "3365a6af-9569-4834-8217-e9d4af594392", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2081e77-7d88-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671226264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671226264, "uuid": "6f46868c-68ae-4576-ba46-497e466859e6", "comment": "Malware payload", "value": "75973013b4b0b61ae31ca2c0e414947d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671226264, "uuid": "fa6f72d9-16bd-4de3-958f-814dbe0fd3b7", "comment": "Malware payload", "value": "12f13d129579c68ec3cc05bef69880b6a891296fa9fce69b979b1c04998f125c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671226264, "uuid": "697a1d76-8a60-45f1-a93a-88e568a370c2", "comment": "Malware payload", "value": "b4dfbae3ec429b966cf689e7b3448f0d431318fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671226264, "uuid": "e406d4c3-6eb9-4ed0-a558-52c69c48d6b9", "comment": "Malware payload", "value": "0b8a33945e2ab6ad5ea957b54d3be308b52728054898489928ffa2662fe4b3f83c02b9635c5d4f62eca8a50fc883b10b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671226264, "uuid": "5ef8932f-4e74-458f-9779-dc3eac2e68ab", "value": "T1D1048E2371D484B6E4D7017418A6DF32AAB6BC32073FC54BABD0198A6F316D5CB26B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671226264, "uuid": "07d91719-0830-4baf-a78e-5b728df900ba", "value": "6977cf19bc9928d7e32a82b407afd58e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671226264, "uuid": "fe557ecd-6aac-4a69-a4ce-e2be146e31f4", "value": "3072:EqLavKcBLgVXBqQkX3HFSMBw59vcK2tSx8jTjRP4ep5:EqLaL2ZBvkX3HfBQx8jD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671226264, "uuid": "3bcdb9b9-d29b-4270-bc03-efb9384aad48", "value": 178688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671226264, "uuid": "58b8ffde-2eab-462f-b048-d5aa01923112", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671226264, "uuid": "a5ab6449-1e3c-4a0c-acce-17f1f3c13a82", "value": "SecuriteInfo.com.Application.Heur.kq0@kikR8KaO.30621.17095", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe0d2585-7d46-11ed-9db1-42010a9c0080", "comment": "Malware payload (Zegost)", "timestamp": 1671197938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671197938, "uuid": "cb8eaefd-bcaa-4dd0-8556-2de0acbf9271", "comment": "Malware payload (Zegost)", "value": "61475d623cd9c596b73b61cf637a467a", "object_relation": "md5", "Tag": [ { "name": "23-106-215-217", "colour": "#1B858A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeGaliXCity", "colour": "#607CCC", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SpaceCity", "colour": "#5EBE6F", "exportable": true, "hide_tag": false }, { "name": "Zegost", "colour": "#84DF17", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671197938, "uuid": "06bbd850-282f-4e36-8e11-3d379f82d759", "comment": "Malware payload (Zegost)", "value": "133224bb212564ed0b687341512fa57fe2a55e54defededb5517ac8d8b239677", "object_relation": "sha256", "Tag": [ { "name": "23-106-215-217", "colour": "#1B858A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeGaliXCity", "colour": "#607CCC", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SpaceCity", "colour": "#5EBE6F", "exportable": true, "hide_tag": false }, { "name": "Zegost", "colour": "#84DF17", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671197938, "uuid": "a1d68a2f-ccc6-4d0a-946d-982c2f47c4c9", "comment": "Malware payload (Zegost)", "value": "ddc5ee382fa4d8147ffb37877a9fdbe8a19f8eef", "object_relation": "sha1", "Tag": [ { "name": "23-106-215-217", "colour": "#1B858A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeGaliXCity", "colour": "#607CCC", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SpaceCity", "colour": "#5EBE6F", "exportable": true, "hide_tag": false }, { "name": "Zegost", "colour": "#84DF17", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671197938, "uuid": "db60b631-8035-4a25-a0a6-f618a8660b34", "comment": "Malware payload (Zegost)", "value": "dfae01577689024440d3eb18e0da17ab1b7472c4f6e51be692a39d441bf4f749df24eddff875020ea321c39af7485878", "object_relation": "sha3-384", "Tag": [ { "name": "23-106-215-217", "colour": "#1B858A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeGaliXCity", "colour": "#607CCC", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SpaceCity", "colour": "#5EBE6F", "exportable": true, "hide_tag": false }, { "name": "Zegost", "colour": "#84DF17", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671197938, "uuid": "d07d0292-69a9-4bc9-ab1c-660e4d6aecd9", "value": "T1CB54BF81B2DFC1F5D84601B05CAB7B7FFA789970051E9AA3A384CE1528634D6793A3C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671197938, "uuid": "8d367e91-c065-479f-8c6a-56bb0e73d10a", "value": "1423675632cb4d478eba3debd725c59f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671197938, "uuid": "0b5a37a8-bc8c-490e-97fa-4af3a6b7831b", "value": "6144:1xEDp/PY3+WgP0Ll+W/Rdki1OkbXxs0ddp8PIQO:1xI/PY/gebf7jOF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671197938, "uuid": "80d566ef-e072-4f07-8693-797e89c85c80", "value": 293888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671197938, "uuid": "e43d297e-5802-4b96-853b-5d1bd574dcfe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671197938, "uuid": "10ed0307-6238-4328-ac93-1b592482fb78", "value": "wincsetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1f3a321-7d4e-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671201219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201219, "uuid": "4704da07-2375-4e6e-8be7-860e8a9bc2f3", "comment": "Malware payload", "value": "f457d932d1730d99fb64e308371a310a", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201219, "uuid": "2afb1e92-c764-4d4f-8b1a-a15b4098b3c4", "comment": "Malware payload", "value": "13d8b1fcefe8c19134e5f3c55fe2ba5721262bc1e3018eef0966c8f13d85392d", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201219, "uuid": "b4acbd1c-149b-4226-8a6b-474b47b0007b", "comment": "Malware payload", "value": "c43638aaad09090c347ed00a02c867a084aa631c", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201219, "uuid": "6a286174-5d78-4c13-acae-e849c093180e", "comment": "Malware payload", "value": "43b36483221c9788047c7898db350e9604c82642c809ae5c14c988c0bfa3bb331584295fce0f874eab6fbc783e98f846", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671201219, "uuid": "23956b05-a8f8-449d-914a-fbbb360d03cc", "value": "T17672CF1E7010E858C73218FE81AA81E9A31C30509A4975A7F4A5FA4F75273EF278F1ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671201219, "uuid": "fbca1f94-8c2b-4c81-a906-8230fc1067cb", "value": "384:XpH2Yu1eTsW7qRlttUlM9zQY85harjPkvVFM1T9+:R2Yu1kV2dxB4h2PgWT0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671201219, "uuid": "49da4f20-9d57-4dac-8709-50b26b9cc9ce", "value": 17094, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671201219, "uuid": "0a2580d5-8d52-4255-add9-28a462ed6619", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671201219, "uuid": "13c2f9e0-9165-41e6-a798-df8ed44d1168", "value": "SecuriteInfo.com.Trojan.GenericKD.64292249.32212.30155", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f07cb4cc-7d6d-11ed-9db1-42010a9c0080", "comment": "Malware payload (Formbook)", "timestamp": 1671214665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671214665, "uuid": "054cb22d-faf2-40ff-9c0b-1145747883cb", "comment": "Malware payload (Formbook)", "value": "c3c5457df57ba66bad79aa2bd8cb731a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671214665, "uuid": "fa97f5f9-d73d-4071-8321-5126660f5625", "comment": "Malware payload (Formbook)", "value": "147b4695ce4a9f5b5dc4bab3463c37b5b784232f52cbb9bb9df329192365a740", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671214665, "uuid": "e4167b78-1578-478f-b568-ea20a09780e0", "comment": "Malware payload (Formbook)", "value": "34075bb17175ccbf33605dad285bb6192c3003ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671214665, "uuid": "3d2fb4a8-a07f-4106-a717-08ac7e6fbda0", "comment": "Malware payload (Formbook)", "value": "cda033febb583896317088118f3c7a25e488412f741dcb940d860d605972210cc632c9a4d3f14d1731af1b4fc4413d13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671214665, "uuid": "7911f40c-0cfb-4300-9cdc-5041c4badaef", "value": "T155351252B7C2C972E5721A315D38A7297D3E78202F31CA1EA7E44DADEF340915235BB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671214665, "uuid": "7f874841-5fc7-42b2-af33-b103d6921c43", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671214665, "uuid": "c8dde048-ec80-4945-87da-da1cda4abc4f", "value": "24576:CAOcZXbHlzJDHTtzE4E7m4x4iADn9EBQrXAz3fJzQfsktDrY:I2zbTtzl4jADn9tAz3fBQfVo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671214665, "uuid": "e59782e2-a96a-4f47-a328-64dc6dcf57b9", "value": 1163562, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671214665, "uuid": "bcc21aa2-5338-4a31-99c2-f42500f52373", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671214665, "uuid": "2bef78fd-592a-4feb-8a5f-c69627f2fb76", "value": "HERE'S THE QUOTE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41e8ed17-7d18-11ed-9db1-42010a9c0080", "comment": "Malware payload (Gozi)", "timestamp": 1671177865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177865, "uuid": "83762140-e1f8-426a-b78c-7b25e7064ce1", "comment": "Malware payload (Gozi)", "value": "d68762375978b822dd2e26449ef75f58", "object_relation": "md5", "Tag": [ { "name": "62-173-138-28", "colour": "#2C8641", "exportable": true, "hide_tag": false }, { "name": "7638", "colour": "#D5A8BC", "exportable": true, "hide_tag": false }, { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177865, "uuid": "fd408418-0f45-4576-87e2-d9efea025c2c", "comment": "Malware payload (Gozi)", "value": "15628c6d977dd63f2339623e362ddff40a4ee0dbd59415d0ddb5c4b3cfab02b9", "object_relation": "sha256", "Tag": [ { "name": "62-173-138-28", "colour": "#2C8641", "exportable": true, "hide_tag": false }, { "name": "7638", "colour": "#D5A8BC", "exportable": true, "hide_tag": false }, { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177865, "uuid": "e6a1f1c5-b83b-4dbb-8916-a753e7fe5616", "comment": "Malware payload (Gozi)", "value": "5141fb72159c6b9b53b0e5263066b9e5c5ad7de5", "object_relation": "sha1", "Tag": [ { "name": "62-173-138-28", "colour": "#2C8641", "exportable": true, "hide_tag": false }, { "name": "7638", "colour": "#D5A8BC", "exportable": true, "hide_tag": false }, { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177865, "uuid": "b1ce715c-f737-4454-8830-723be10efb6b", "comment": "Malware payload (Gozi)", "value": "b57d409e100bb14c9b498ca4038874262f500fa59d17c004000d2f9dc358db8d9f3013549aae8bc4cbbd05e0750a3167", "object_relation": "sha3-384", "Tag": [ { "name": "62-173-138-28", "colour": "#2C8641", "exportable": true, "hide_tag": false }, { "name": "7638", "colour": "#D5A8BC", "exportable": true, "hide_tag": false }, { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177865, "uuid": "62ddf45b-74f7-4ee1-a0b2-1b360021beaf", "value": "T16134CF11B1B1C0B1C49F19348869D7E05A3FEC3259B1AA4777757BAF7E30A90A63A30D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177865, "uuid": "3b9c67db-e6a8-45bf-9a1f-10d8285fd487", "value": "b35462da489bc13bae884e55b5227599", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177865, "uuid": "09163b2f-0301-43d8-b0d1-e63e09def7aa", "value": "6144:xwkyL842/AKwReixjtsfXZqIWPt3Gx8qMrc:xwkyQ4U6R9ts/ZqdZk8n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671177865, "uuid": "8da81fb9-eef0-4777-8d1b-27f52439c1a4", "value": 232448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671177865, "uuid": "2578796e-e176-497f-a22a-d928b85328c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177865, "uuid": "40a4e815-1988-4799-85db-80a4f817c044", "value": "entrat 5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d69742c6-7d30-11ed-9db1-42010a9c0080", "comment": "Malware payload (GCleaner)", "timestamp": 1671188423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671188423, "uuid": "1b772c73-b9da-469d-a462-1c6bd2f81a0a", "comment": "Malware payload (GCleaner)", "value": "acb8e9c9be0c6d3907db8ecd94528b89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671188423, "uuid": "993d1ede-177d-40c4-9e68-c77c45a96abd", "comment": "Malware payload (GCleaner)", "value": "17468e6d354db0b3f11ed53da7ce7170b894f61ebdd62f7b049b8d0f0d2594e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671188423, "uuid": "ea874d6f-3710-469e-9b2b-0998eab4a87f", "comment": "Malware payload (GCleaner)", "value": "86ef4268b374abbc4ec60baf10d20174fc75af89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671188423, "uuid": "aa47d86e-6455-476d-b74b-159ab51e5b93", "comment": "Malware payload (GCleaner)", "value": "a03d355b24d21d0ca416bee819df07078f98e94e0803a8ce87715f48942bd08e3efb3d026102a721ffa7990d8d0b7a7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671188423, "uuid": "61c9ff8e-8af3-4d1a-b40b-135481e0a5f7", "value": "T146C523BEA9080176C1BB89FC7C251D31AAE77D272931E24E3B843F57B6F64D24816607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671188423, "uuid": "0fb11461-6127-4d07-85fc-6d1de2008d17", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671188423, "uuid": "db7b09c0-f8b7-40b5-a7c6-93bc933b28ac", "value": "49152:IpRs1bjqIHjrSUx3nuXp4dVHYrbLS6rhIN3raeOCgSY/im6:IpR89x3nuIVHYrbL/rhI0cY/im6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671188423, "uuid": "90c73ac2-8b3a-4e7c-aef3-db32e22b0fa5", "value": 2556808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671188423, "uuid": "beb292ce-da7f-4e13-826b-0511a922cf37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671188423, "uuid": "f9157eb1-cd5b-4430-80c2-5fbc86164606", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "650d4573-7cf2-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671161603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671161603, "uuid": "8244f601-a224-42ca-81c7-dbe3cdcfbc17", "comment": "Malware payload (Smoke Loader)", "value": "78ff182b2a3a8748bec4ff48a1b1d848", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671161603, "uuid": "29810b2a-8c43-4dd0-a85c-522b8918fbd7", "comment": "Malware payload (Smoke Loader)", "value": "174ab727a94e134366592d2833ced72c5ad8f68262ec7fc991184e5f02b3861d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671161603, "uuid": "0f568e18-0a9b-4fae-9f4b-d481603ea5b8", "comment": "Malware payload (Smoke Loader)", "value": "e3865395bfec2c8c530eea2a0dd28651dcfc6792", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671161603, "uuid": "eef6e18f-7e06-4dd3-a8ac-733dd47efc1a", "comment": "Malware payload (Smoke Loader)", "value": "b724afc9c2edf84a3a800fb750dc7cd8cd73d2f1af3e86324740d964038da5cf6d3d59ee47aef932a55c895fd2a63e10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671161603, "uuid": "c578a09c-afce-47a4-97aa-e02ba4346b8e", "value": "T1CA74CF903A73E4FDE831C5755826FBF42669B820AAE1D533270AD71FAD3025386EE315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671161603, "uuid": "38359091-6860-442a-a922-b5660f773767", "value": "2067eb05796787c0f2b3dc09403197ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671161603, "uuid": "6d641f1a-a289-4e97-ace1-11f26c60e351", "value": "6144:KvYP8tLAhK0npCsmXT7lKO9xAqD0NsVY0iPvzpQ6ijLxQFiaI:2twKIQFUN8YxnzpQ6ijqF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671161603, "uuid": "e26fea9f-3a0e-48f1-810e-37b75191571b", "value": 341504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671161603, "uuid": "c4fb9c36-0e0c-4426-9db1-7c284ed533b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671161603, "uuid": "56df3af1-9b09-4489-b502-c852270607db", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "add4d1a8-7d18-11ed-9db1-42010a9c0080", "comment": "Malware payload (AgentTesla)", "timestamp": 1671178046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671178046, "uuid": "4d538ea9-ab22-46aa-9766-1cc4ca6ce9d5", "comment": "Malware payload (AgentTesla)", "value": "018b4c59b1f7f39dab51596f4727274a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671178046, "uuid": "f4d776bd-9499-4727-9687-5c8105445e45", "comment": "Malware payload (AgentTesla)", "value": "179ff3900387208c199ceaaae69c533620d40c06b4a5cc4c08007e18ed00e2cb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671178046, "uuid": "57c92263-fb4f-4862-9f69-93b648501021", "comment": "Malware payload (AgentTesla)", "value": "0c06d34ab4303426e65e641a38317e4eb2da1f20", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671178046, "uuid": "cfe6e9ef-9bca-41db-b687-f2b363bb2608", "comment": "Malware payload (AgentTesla)", "value": "7a2f4b1ae5b79258ac19eb879df4bfcddad8da290d18b1e9bdb1b2f3e57ab14312bec1258e1ba333bcf99dbb4bd51e55", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671178046, "uuid": "3d4aca0f-d3ca-49bd-be93-133570be721f", "value": "T1FDF4331F3CBFE2A5E94180E25E921ED07FCA98895D111FD895BD8B638EC2091D0196FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671178046, "uuid": "ca928925-4e5b-4762-be4f-4ca00d0d8a4a", "value": "12288:CF804U7a3iJm21Kvr81SEMFIifYKp3N7k9KR6WEMxy2THXV5NhsqBy5Y0M:CH4U7vJJ1MDH3Px/TFpsYy5LM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671178046, "uuid": "cc88693d-f8e7-49ae-820d-2e9dbc0e5a11", "value": 785766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671178046, "uuid": "d5cb52c7-5008-44fa-ad39-3fedad060a9e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671178046, "uuid": "155fbea1-717d-4781-9aae-16349828e99f", "value": "SCANNED COPY.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a53781aa-7d14-11ed-9db1-42010a9c0080", "comment": "Malware payload (Mirai)", "timestamp": 1671176314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671176314, "uuid": "10030035-aad2-42f3-9244-ab861b15fa4e", "comment": "Malware payload (Mirai)", "value": "c09506d1934528ce14d8f389d411ac9b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671176314, "uuid": "eb0e1099-90f4-4f3f-ac75-33e9192f9fd7", "comment": "Malware payload (Mirai)", "value": "17f7d7e74db3ed907ece75e503be0a81d1064c20eb84947d7ab9e4a737295269", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671176314, "uuid": "bd089e71-ea6b-4949-a5e1-828f31bc1e90", "comment": "Malware payload (Mirai)", "value": "1e6e472bc730b35a000573af6c6b9ea79ad1cc61", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671176314, "uuid": "75350219-fded-4095-ba8e-3d7b8252d528", "comment": "Malware payload (Mirai)", "value": "2046ac1eac9b9fdd0e2f851fac711cd86e7924e5cf34066851873ce89028a208ad47b5df0cbc2e247dcf13b47c5058ce", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671176314, "uuid": "cf593180-851a-4e78-aa09-f92accbde2a8", "value": "T173331A51B8C26627C2D013BAF6AE968E373073E8D2CF3227DD611B113A8552F1DA7E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671176314, "uuid": "dacc37be-8b82-4509-addf-cae510c59bb3", "value": "768:Mtn+Pi2RhlZoIip1jIs44nHsX7+qP06Fz20AVOstY3SF4Xgt2FgNJwJZY10Ux:MX2R3ZNiwaAFz20eOaY3SFGJa100", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671176314, "uuid": "8cad2d8f-4556-4452-8ca9-a660f15603ae", "value": 51716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671176314, "uuid": "4aa1732f-126e-408f-b8d2-69d0a8398e68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671176314, "uuid": "d8ab51f0-4dad-452e-9dec-e02b2ff70446", "value": "c09506d1934528ce14d8f389d411ac9b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5625029b-7cee-11ed-9db1-42010a9c0080", "comment": "Malware payload (njrat)", "timestamp": 1671159860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671159860, "uuid": "c9f8db4f-13ab-4cab-9f5f-dbe5da444525", "comment": "Malware payload (njrat)", "value": "700f97d8d03c5f1990a890d2faa7ff2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671159860, "uuid": "ead75594-1cd8-4af5-b0bd-1a8fb915130f", "comment": "Malware payload (njrat)", "value": "182198163b1d17b3d5524bbe792b4546e404c00a5995e5f471371646a632bfe4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671159860, "uuid": "06bdb664-2be3-4a46-952a-7a69243aec58", "comment": "Malware payload (njrat)", "value": "85db6c14e25a3b114642a2f987fff46ed03fc39c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671159860, "uuid": "bf515625-9634-46b5-b133-fdec912b36ee", "comment": "Malware payload (njrat)", "value": "230c35b09079314d6c5893f4d4259caaceb21338049fff57d41130cd495c4ebb4020601ddf0b625697f137209978ce9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671159860, "uuid": "8c1fea51-5cf5-4acf-8b6b-adb4dc09aa88", "value": "T1E8E2084A77E54215C6BC1AFC8CB313210672E3878572EB6F9CDC88CA5B676D04251EEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671159860, "uuid": "a7f79adc-6609-41fa-956e-7dd7cd7a0d1a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671159860, "uuid": "59475325-c1f3-496b-9c58-48a7ada9221a", "value": "384:70bUe5XB4e0XWOhIQq1pvmufCsIs0WTQtTUFQqz9BObbq:4T9BuFOQqvvmu6dnbq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671159860, "uuid": "4aad3bfe-dff2-4791-a4d4-2bdb78916e17", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671159860, "uuid": "c186cea1-3100-488e-a509-f4cbe419236a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671159860, "uuid": "3a82de2c-b99f-4a2b-a1b5-4aebb0f3c7fc", "value": "xxxwsP9yoAsG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfe05c41-7d85-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671224892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671224892, "uuid": "6cee837f-7365-4a2e-aa9e-9341fc4620a8", "comment": "Malware payload", "value": "6e8036173acfac66de0833cf127a6b6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671224892, "uuid": "dc8d1472-3b4c-494a-804d-1fd6b8016f2a", "comment": "Malware payload", "value": "1851a40d7e7dd5477531abc09ee602521b4b5439521ebd57240820629024c85f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671224892, "uuid": "fb26841b-782c-4f28-b4ad-f449fc14bf20", "comment": "Malware payload", "value": "cd5194abce1de207051104170038c1df8ad2b137", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671224892, "uuid": "d1252647-27f6-4204-9aee-295a68609275", "comment": "Malware payload", "value": "43201c4943c1c4e1ec550549b1dbce37a3301510175cf27674cdb5358119f31ddeb9087f6277a244befcb8f735d26ee9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671224892, "uuid": "9b7c5ba7-7a00-43ba-97de-aa7872719009", "value": "T1ED24BEF03391D4EEE151D7318C1996E4A626BC214E22A9F33B18362F5A706C15AFE37D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671224892, "uuid": "239d877c-b1d7-4d8a-b672-13cc8171ce99", "value": "aa9c378109186462717e17e657d0c833", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671224892, "uuid": "83bbd88f-2828-4bd6-ae9b-02f5cad37de3", "value": "3072:f/Qr3pL/xrSbRVZJQML+gm1EDVdP3zAmLC1izvx4tUwELszoXgb940zwUzQRKF+:H8pL/xgST1EDTlxhgzoXgp40M2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671224892, "uuid": "47f091cd-6a86-442e-8fc5-307d1a183cb1", "value": 219648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671224892, "uuid": "fd93eaea-78a7-4bb8-aa01-ab95c4bbdc46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671224892, "uuid": "ee14aed9-16d5-48a5-af54-93a8b0eb7055", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6caac25-7cf8-11ed-9db1-42010a9c0080", "comment": "Malware payload (CoinMiner)", "timestamp": 1671164371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671164371, "uuid": "4032e0a3-f442-48d0-9f75-50b6cc398241", "comment": "Malware payload (CoinMiner)", "value": "009116ec80215a16c66ecc96c1bb2927", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671164371, "uuid": "aed644ff-2382-4b76-b69c-037bb9be8922", "comment": "Malware payload (CoinMiner)", "value": "19c2999836ae6dc31a5eb287d5ab3d604b92dc4a8b0620e2ad1265e233b8b77a", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671164371, "uuid": "d649ffbd-558b-4e2f-8805-2ebe02e41dc4", "comment": "Malware payload (CoinMiner)", "value": "b557d078d8c56caa8743a4995dc9a43f02e04575", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671164371, "uuid": "756e9798-6f03-488a-83cb-81a4c061f24b", "comment": "Malware payload (CoinMiner)", "value": "553bc59071af9495a0a34ffad0510fd4dc90e5efc4d969583147bcd5410853785ced3ef1cd5eb124455db3a2cdbeecef", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671164371, "uuid": "0a9461e5-ca8a-4dc8-a178-8930a80e1147", "value": "T128B5282291313756D8ECC736A0FD0956BA70ED959C3D129E3C0F3EC9DB7D0864D6AA82", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671164371, "uuid": "19f1ff09-0579-4886-a856-5742b6861842", "value": "55fc1259a74abb403aa98579f954a98c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671164371, "uuid": "bb1c9c05-6d63-4513-8fb8-31439c45bc66", "value": "24576:EiorFGnVpVB9AK/NVFi7DO+Y7gbgZ+NARBOaNIJcxxm7slY7/MiHHZko/q:EiorFGnVpVYK/nmO+ZNAIU+j0iH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671164371, "uuid": "fca05b08-819a-4945-acaa-00c34d061299", "value": 2392336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671164371, "uuid": "16592277-57d7-45ec-abcb-190a6ce72cb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671164371, "uuid": "a09fb755-935c-47af-9921-341435e58889", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d273989a-7d53-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671203448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671203448, "uuid": "931b9b4c-554f-456c-a1bf-1e433f3eda90", "comment": "Malware payload", "value": "9d11da3af98884c10796bdee76e571fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671203448, "uuid": "50c0a59e-0c68-407a-8107-68f36080a066", "comment": "Malware payload", "value": "1aa022b6c9e02cdb0f0d2dfd590df38abd0b1874a2561de55683cd803cfeb4de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671203448, "uuid": "53026132-59a2-4ecf-ab6f-eb124efd0386", "comment": "Malware payload", "value": "22be876c53b5b00c79cc0527d87890f6b81fdf8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671203448, "uuid": "1325e328-add0-4459-aaca-852d2ab162db", "comment": "Malware payload", "value": "2eb9d7e654d6d6778635c552db983e3a32625af9a369034d08131ec9839e65f6903a54aa79a99f615285b46dc956a0da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671203448, "uuid": "edfedbbd-c840-4099-90ce-43f0712d3feb", "value": "T12EB39F02F297D4A8CC3C8835D057D5582A72BFA5BED78F5679C8332E89750936E2F212", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671203448, "uuid": "ee3e9291-3370-4f3a-91f1-65c73dc89266", "value": "768:RX1JlieSiZL2GLR5hmSiMKVTRjdz6SkgNebRjvoyLeUoNV7FLn4FZdG9wGgWbV08:RFJlieSoXA7rd1ENjwyKFWGJ7fcoj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671203448, "uuid": "356c1bf9-f388-4c24-beaf-be5b6907f31f", "value": 114176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671203448, "uuid": "0034255b-108d-418a-9229-8583762ca3be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671203448, "uuid": "0a363d88-b55c-46cd-a111-ba5a92645f33", "value": "ElcomSoft iOS Forensic Toolkit 7.0.313 Crack Torrent Download Downloader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a87acb1-7d44-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671196885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671196885, "uuid": "fd3736ff-02fb-44aa-8cb0-26cfe222fc88", "comment": "Malware payload (Smoke Loader)", "value": "18b4a089bfd2634e6f6f4d2b06f5b25f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671196885, "uuid": "4ac9688d-6812-46d0-a7bf-b61cf3e54021", "comment": "Malware payload (Smoke Loader)", "value": "1ad649e600babccc1fc9624c4dfba929b61c0d7b2e1f8f1d1c369d8315295744", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671196885, "uuid": "1d0f6f39-f3ea-4d92-aab0-2f43381485d5", "comment": "Malware payload (Smoke Loader)", "value": "43980e2013e03fbc6317a56c4e5cbf8c69ed06fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671196885, "uuid": "73ba52e7-c48f-4610-9b45-f8120e2cd418", "comment": "Malware payload (Smoke Loader)", "value": "53a5f728eddc254930424c902202937b360ab569b0406766e1bba4602571291d3d685874f3a4a51ae5276dcc92554ab5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671196885, "uuid": "ecaf5098-b65d-4779-997b-f9c29c7825e6", "value": "T13024D010B271C432C27F50748E6AC7E55A2EFC325931EA477B763B9F2E30691653A34A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671196885, "uuid": "a53b6d74-9f55-4407-992d-e5c3ba02c0b1", "value": "2cc3e4b8a374ca30888470c0a531eceb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671196885, "uuid": "73490834-adfc-46bb-b4dd-06b5cbdffdba", "value": "3072:iburzLlR8HWZSRDnEh18MPfjkWrVMz2xTWWjLQ2mppGT802qCuF3seHtWqMPDcf4:KgLH8HKhKMPfjxMMTot1q8qMrc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671196885, "uuid": "b27075fe-c59b-4105-9fe7-727398628c61", "value": 219648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671196885, "uuid": "85320c9f-9458-4857-8499-70087377e8f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671196885, "uuid": "ac210099-e0e0-4e36-8e18-c27089effdcf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77308e51-7cdd-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671152614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671152614, "uuid": "d52bd9d2-7bdb-48c0-aa78-56915e189736", "comment": "Malware payload", "value": "471b502a6d9308c7746cc24ef2e0dded", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671152614, "uuid": "b24b78b8-9a88-4200-8690-8f75b4fecfbd", "comment": "Malware payload", "value": "1b271ed1af3af2ce5c72e7c59b61165e5229e44837e8765b2f963e4e130c850a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671152614, "uuid": "50eb60b6-582a-4248-b118-4ffc0fe2602b", "comment": "Malware payload", "value": "8244892b1b0000325b018bb82e2c19a2355e787b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671152614, "uuid": "04544ee9-8dad-46bb-9a5c-5e3e943b4677", "comment": "Malware payload", "value": "b2b9dbde38849aa50165a09253c12b4a348427b61a08076abfd239282ed1c0ea74fb8a619c5615e51ad2fdd9cd846387", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671152614, "uuid": "b91acec2-3546-4394-9aba-6f4a46a82ef0", "value": "T1BA64FE6D509AE8BDFE6A8780667CFFEB94F271F345C509A097385004C7B6F592E8810E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671152614, "uuid": "e5835530-07e8-4a38-97cb-2126c743b609", "value": "3072:vxEr44444444444444a/QIZ7MTosIaKrumcowmGcAt3ApC:vxE+/QIZwTostK8owmGcAt3ApC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671152614, "uuid": "353dce63-da3e-4bbf-ab49-1f22185f786c", "value": 314678, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671152614, "uuid": "39b63949-7db6-4369-8c75-690a3173caa1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671152614, "uuid": "33c974e8-bc3a-4270-9d23-8cb652854b81", "value": "x.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b2ad7d5-7d80-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671222656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671222656, "uuid": "7c4b5b1b-851a-406a-98c9-0213daa1b371", "comment": "Malware payload", "value": "fa06c4ba7fe5f4c84f66af389c7d5cc6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671222656, "uuid": "0ceb7078-e278-4654-b0df-35b8c36d7256", "comment": "Malware payload", "value": "1b347c44e6135571b0b841c465ee3fd7b9ba5e5497f2e62bbe3c0ca7f5b198d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671222656, "uuid": "4b88259a-b37d-48b9-80a9-9db5d63b9b8c", "comment": "Malware payload", "value": "20acb8e799e697e0527f72b62fce473407905fd3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671222656, "uuid": "d6a172e9-84e8-43b2-bf10-729e1f3d49fb", "comment": "Malware payload", "value": "dfb8c24e8e34f1f12b401c4deb0befd7e320d6637fde42ee2a3df6f78ad27bf15d7f831db1cda0b5cfc655d8785511c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671222656, "uuid": "dcf0e6e6-3004-4143-8689-3ad90f8d99fe", "value": "T10E74E0F177A0D4AEC040D371891AD6E1672AB8205F21A6F33B042A2F2DB16C159FE77D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671222656, "uuid": "fd22647b-90ae-4122-b05c-128daf513908", "value": "aa9c378109186462717e17e657d0c833", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671222656, "uuid": "14529bc3-3996-4d37-ab49-08d2c2d9dae4", "value": "6144:6SPLiebP8nitshyPEQrC6lVbWmA36Uzb+24gzNT840M2b:6sOMByhCEqSv6YBV5T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671222656, "uuid": "6b86c1e8-0244-433a-9a95-8122b8f98974", "value": 341504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671222656, "uuid": "a923ad45-e78e-4c6a-87f3-e9a964b87c81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671222656, "uuid": "2e1baeaa-8856-4c3f-a8de-177ba5f01782", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "040a37ac-7d1c-11ed-9db1-42010a9c0080", "comment": "Malware payload (Quakbot)", "timestamp": 1671179479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671179479, "uuid": "1917e022-4f88-4af3-8213-cdb582924897", "comment": "Malware payload (Quakbot)", "value": "22f52ec296b0d4ec03d436a28a85f3b1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671179479, "uuid": "ada0e7fb-1d3d-4031-ae2d-6e79b6bf30dc", "comment": "Malware payload (Quakbot)", "value": "1dc171b504c1d8a1272bdb1b98939bb430d87baef9b6b62af7b85730e14a83b1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671179479, "uuid": "28c2a9ee-c59d-489c-9984-6b81b49fb259", "comment": "Malware payload (Quakbot)", "value": "4610c9bc6b8ba3b5401d07697b5d1b9226e98e69", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671179479, "uuid": "f7c1e9cd-8415-4cc8-9777-6ee2353dc726", "comment": "Malware payload (Quakbot)", "value": "48fa8a3f1b6b39abd68d029899abf4fba926da8592adbc1f025a48b7d83dae23d3b082fddc151750dc1cb5c3659b86d5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671179479, "uuid": "5f807d93-80cd-42e6-a1f6-f493a701873e", "value": "T16AF4BE0CB143E030F86E30357868C5FB5A2D6D200B4199EFA7743AAA5E735D2B9BD917", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671179479, "uuid": "e85809db-e22d-44a8-99ab-59687828b64b", "value": "6d24fdc20ad4f407cb9afdc29a1dde7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671179479, "uuid": "f6de0491-d42e-4712-a6f2-d4b075817f72", "value": "6144:B8vIbSUajYBFu5skfyZNI9i7mGHrx1SeOQdHIxF5n2PbGXR+5YJ:sIbAdtKA91GHrxhsnuX5YJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671179479, "uuid": "aa592823-e38e-4797-a7d9-96523c883bd9", "value": 747520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671179479, "uuid": "bf717c79-9c96-4b5b-aae5-aae58ea388e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671179479, "uuid": "7a941b9b-51be-4fc7-8fea-a37d7e898076", "value": "SecuriteInfo.com.Win32.BotX-gen.15977.9665", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b2bb889-7d43-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671196269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671196269, "uuid": "4433a166-11e3-4668-b942-329d922e9198", "comment": "Malware payload (Smoke Loader)", "value": "72b8a679c043fa702a33701011557e69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671196269, "uuid": "1b162dc0-0c60-4b23-a9a1-55dc53632287", "comment": "Malware payload (Smoke Loader)", "value": "1dcb4e930497545ff4a3cc923b42928ebc45919c0790c482814bf803baddc09e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671196269, "uuid": "cb3b5a3e-66e4-44e1-bac7-8c8bdf085234", "comment": "Malware payload (Smoke Loader)", "value": "965ed5acc71c9fdac313aa338f3cf55719bdbefc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671196269, "uuid": "1969cce3-00a8-4807-9a64-9054dfe47eaf", "comment": "Malware payload (Smoke Loader)", "value": "f1beb5db6836e5802545836cf08d165092d74f47caa715184c5cf1079b6cf716fbd139f870ccabaf565adf2979f04df3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671196269, "uuid": "42a8377d-496f-405c-8c36-03fa2b36afcc", "value": "T17B24D011B2B1C8B2D11F11308C5AE7E16A2EFD325E719643777677EF2E30681963A20E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671196269, "uuid": "214cabb6-5d08-4bfa-9360-c2c5464d6115", "value": "e21f10fb81de748812499eebaf8a1cc1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671196269, "uuid": "4b008f96-ffa1-4552-97e5-c0678bf5dbe8", "value": "3072:BE7fsadLLb9SPvRZziiFOr1g54Hgr5Q8qXK+f84FOfmLQ2mppGT8F87aSZ2HtWqA:u7fVLPwfzi9e6Hg1Q8D4FGtJP8qMrc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671196269, "uuid": "be25ec33-e5b1-429d-b2f6-eef26bf4cf7a", "value": 218112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671196269, "uuid": "4d9dd56c-fe3a-42f3-ad98-e086e52cc129", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671196269, "uuid": "9060c5c5-a66b-4438-8871-10322f962cda", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a52a135-7d13-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671175624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671175624, "uuid": "2e049784-7ef3-4fdc-a662-6a00931ac728", "comment": "Malware payload", "value": "7df8739c536ef306af0f58aa679bab65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671175624, "uuid": "5d10e721-3b69-47ad-8ad4-f3b7a0261670", "comment": "Malware payload", "value": "1ea211a897535ba55cfcab0c9af6d51bc59fb38ac2ed9497767c9c88f4ddeb94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671175624, "uuid": "ee5ebd58-c313-4d56-ad43-1ed5f814f304", "comment": "Malware payload", "value": "85e1c340e93517491c309a409a08dd85b2f27f7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671175624, "uuid": "4fed0405-777d-488b-abf8-7b710aaf29d0", "comment": "Malware payload", "value": "2d0ffb794e6648f2690493166a31e0aceb79ab3c8e5c54492669838523fe3f8aa325d4a6919664737cf1f4b66fd18acb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671175624, "uuid": "f699b3c6-e958-4ec3-8299-00951863ab8d", "value": "T156138D217550C072C85268349829C6F1BE7F883222F6998B6F695739DF307D1B3BA34E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671175624, "uuid": "456414fe-9819-4a5c-bd55-958766d53e8b", "value": "768:Zzqvzyhfx6Dux3vwxK87v87SvFjzVcA6OSL08g09VIXdx6zIfUnRLA:Z2zyhkai07g9cXhLj9VSdx6zIfUnRLA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671175624, "uuid": "a4e65acb-3d0c-478f-98c1-48c6dfe73512", "value": 42352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671175624, "uuid": "a9f23974-97c8-4cad-b76b-f592028a00be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671175624, "uuid": "204f45de-12f3-4652-b1e8-21e5f0950095", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38847b1d-7d74-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671217363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671217363, "uuid": "6b19f680-21c5-4d51-8f67-3949b2254caf", "comment": "Malware payload", "value": "8a64beecdd29c0c3d767b687036d2b92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671217363, "uuid": "3686d5f3-e723-408e-ac0a-7da0ef33b2b6", "comment": "Malware payload", "value": "1fe91b2dd84dbe7b58cde9dbfc9a8f7dbb19fa7954deed7876c58c149573f191", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671217363, "uuid": "eb0d525e-be77-4b63-b098-6e1d8d4dd869", "comment": "Malware payload", "value": "05e951697f03dcca95c80bed95434a6eab380a5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671217363, "uuid": "9fba2d8a-2e0b-4693-8733-9167df5a77a6", "comment": "Malware payload", "value": "438422b9e72ec52cc26579a9484b5248184b0ef9773993d3bb7ee88b497038b74d5da62a082bf7bba47f749e31881e9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671217363, "uuid": "a60ea4ec-dc34-4540-b38d-8ae4953c0047", "value": "T1CC24BEF06291E46ED151C7318C19A6EC9A7ABC214F2299F72B143A1F5E302C056FE37E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671217363, "uuid": "a8e8c2d4-6d07-4913-bbda-ab68e4c36412", "value": "3670997c8c2669588bad5b8c178dedd4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671217363, "uuid": "2853ac29-463e-4145-8528-adb129db53ea", "value": "3072:JO4ygWLzWHxv0RCRPotoEtX4dNdKouE1Fp5IqLszGcUxa40zwUzQRKF+:kNpLCHHNotoW4d7zIqgz6a40M2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671217363, "uuid": "97e9ece1-011e-4b4b-bdf3-b78a9b053ab6", "value": 220160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671217363, "uuid": "003a1193-3bf6-4278-924d-2e7bc3d14221", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671217363, "uuid": "7032ad2d-c3bc-4b1c-99d5-9745a48b94e6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf929ffc-7d77-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671218905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671218905, "uuid": "e28316b7-6a62-469d-ae38-a119ddccae63", "comment": "Malware payload", "value": "2d46c06b112ee97f7c84b197ba250271", "object_relation": "md5", "Tag": [ { "name": "82-115-223-141", "colour": "#6824B4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeEvilHunters", "colour": "#9F827E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671218905, "uuid": "5543d440-c850-4e50-9902-a99e56b31323", "comment": "Malware payload", "value": "202958b751ac1521ae13e0baec5e3ebd9908758c19d79f05c1fd6f3407007618", "object_relation": "sha256", "Tag": [ { "name": "82-115-223-141", "colour": "#6824B4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeEvilHunters", "colour": "#9F827E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671218905, "uuid": "30691201-98c7-4392-9667-b926b84098ab", "comment": "Malware payload", "value": "1cf6ddbd1c667a5ecbe65884454d331e1fa185a7", "object_relation": "sha1", "Tag": [ { "name": "82-115-223-141", "colour": "#6824B4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeEvilHunters", "colour": "#9F827E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671218905, "uuid": "66476ed6-bad7-4032-a89c-c06a58d7f6b4", "comment": "Malware payload", "value": "ba7314e403a051d4ecc4866b5048b05641ae81805dc818b761f71029bc5711a00713adf9dc9ae19856671baaedf8d51a", "object_relation": "sha3-384", "Tag": [ { "name": "82-115-223-141", "colour": "#6824B4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeEvilHunters", "colour": "#9F827E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671218905, "uuid": "b9243895-7142-4c4f-8cb5-65da73765307", "value": "T1A2D44877348515F2F93D1BF12BC6AAB6599FAE7B1CC0489522DC32F99472220819C63F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671218905, "uuid": "12587e78-7eb0-44eb-a5b5-e1d0d146965a", "value": "1c75af7a8e611b8ac247303d69ba14bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671218905, "uuid": "6cbc4ac9-e783-4027-ab5c-5afb8d3f7527", "value": "6144:mZcdgMrXXhCxvkCfHg0O3Y9PuBqPSnhfxVhCmD/YIFYFYTmVuIAJq:+cBniq3YWBqPEZVFD/QFYSFAJq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671218905, "uuid": "de1d6f2b-b684-4dcf-ac0c-4700fa3ef95f", "value": 605184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671218905, "uuid": "afadb20d-3cea-41f7-8675-fade1a5ed02a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671218905, "uuid": "7171b78d-6536-4823-b401-e334be15cd91", "value": "Evil Launcher - Beta.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab0ed4a7-7cf1-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671161291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671161291, "uuid": "8aaac14a-f0f6-4ea9-91ea-3c241ef11a8d", "comment": "Malware payload", "value": "efcd16119f098a5281a983c2a1728e9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671161291, "uuid": "87f4cf17-6489-4ecd-ac23-7fae6fba3cf7", "comment": "Malware payload", "value": "20f39640ba22114fac875f95f9a0cd93a53804d83c99486d9bc5846bbd63fc9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671161291, "uuid": "b330ca7b-0040-4740-9f59-445ef5a2dad4", "comment": "Malware payload", "value": "e5314cd44b2285d61703af702811e40d9fe06af3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671161291, "uuid": "3c287047-f8f4-458e-adff-aa9559f5c0fc", "comment": "Malware payload", "value": "4352aa60e3b3b0a1219569bc9bfd650883ea9a6edee36f1212cd6cdc9c26c75f8435f8d6025b88ef495bc7125c036e24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671161291, "uuid": "1427aca6-c3e8-4e0c-b105-2783876adbfe", "value": "T186E1D711538D8733DA668B7A5CF393811738E3918B53CBDE38C4926F8D52F998D61B20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671161291, "uuid": "ceba0175-0609-463c-847c-99d999c54f1f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671161291, "uuid": "b51d4f05-fc15-46e9-a3d4-80b90d2fb1d5", "value": "96:VxCGmPcfkQ/SM9zgXARLtQKJ8trOfQskcr0C6dLdr7zNt:VmkJ/BgXARLqKtfQ1cr0r7p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671161291, "uuid": "919d7052-e314-4d71-8522-1f7e244e88ee", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671161291, "uuid": "339593c8-78d6-42dc-932f-cee740a82454", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671161291, "uuid": "c4dba2e3-a9c8-433b-815a-1194211b55f5", "value": "SecuriteInfo.com.Heur.MSIL.Bladabindi.1.32520.19355", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b33a987-7cea-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671158204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671158204, "uuid": "9dc3fb0d-a016-4f7a-ae2f-b92b34334503", "comment": "Malware payload", "value": "1b0551c9ae613b922e576b1e5579678c", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671158204, "uuid": "422ec084-f45d-49fc-be82-463abf445626", "comment": "Malware payload", "value": "211abb138fdb4df615ae9d97a39fd06c29d7140da2ea5192ab92b6ec94e0cd61", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671158204, "uuid": "e114e668-19a1-48d4-b94a-94a1af77efef", "comment": "Malware payload", "value": "9238a4986ac66a7b5ba1f9743c602f41c203d8b2", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671158204, "uuid": "5ac5e2d7-d576-4a7d-964d-271dc23cb964", "comment": "Malware payload", "value": "e19ba9a3ae27540a1490cec1f50ba51fac8741f6adf7af4e1aa860d53b4db1bc3a313d10de40536fe5c0c5679adbf930", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671158204, "uuid": "e69ff570-a1f4-469e-98e5-40c9c82831a3", "value": "T11EB633609E787EAE4628832C607F5F5C27B01FD4C01CF1EB5BD474C75AAA781492B9B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671158204, "uuid": "378fd0ce-fc71-44cc-850c-9261ba03e3d7", "value": "49152:8UZoNdFyVleMmcjbM8S+T9exgshH8W48Os02iblQl2CLNTvNKM76qNAbB/Kx2ftu:Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671158204, "uuid": "d443c8ba-e68e-47e6-8dc4-f8bb3935ecda", "value": 11049962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671158204, "uuid": "df5a2668-15b1-4039-8366-634ffb5a9f16", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671158204, "uuid": "c92255f4-f0c3-43e6-8776-923a80fe97ab", "value": "YT View Bot.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b9c5c92-7d18-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671177881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177881, "uuid": "a4cc93cb-7753-4713-b9c8-54d73416e789", "comment": "Malware payload (Smoke Loader)", "value": "2c2f150dfeee9798aa90419d5d4ef2a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177881, "uuid": "0028351c-6048-4f6c-9438-354fd6c96341", "comment": "Malware payload (Smoke Loader)", "value": "2144d134eeb933b6b94216d6f0636d6f1d7c17cce57c62c7b055e2e2f0d2548c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177881, "uuid": "43d7a002-706e-4046-ad73-f80ad3bad96f", "comment": "Malware payload (Smoke Loader)", "value": "c371ebe474751244fb121dfcfe6fe08ec723a18b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177881, "uuid": "a9d6ee73-2d75-480b-a443-2244fe0f4708", "comment": "Malware payload (Smoke Loader)", "value": "060befece1b5c2585ced720fccef2b75200866a19091d6128d496bb282f8674c6099c15abb49172c0876ab530b65adbd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177881, "uuid": "72bb579e-28c3-479c-91ca-d0fa1e488151", "value": "T1C934CF11B2B0D433C5AF09308866C7F05A7EED315A789647B73536AF6E306B0A67A34D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177881, "uuid": "bef83e5c-81ef-4bfc-a91a-35716ddb87df", "value": "b35462da489bc13bae884e55b5227599", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177881, "uuid": "508f64db-148b-4da6-9a1f-2a8094dc6823", "value": "3072:5+/kijphLc+bJIIcRRZtg+XdnGJ66QAXjV3LQ2mppGT8P9/CHtWqMPDcfuh:4/kgLc+b6/r1e/XjStd/o8qMrc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671177881, "uuid": "03577db0-1fcf-4ce4-b924-de8fdb1d9c73", "value": 232960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671177881, "uuid": "96feda2e-b559-4673-acc0-b24a3dc83973", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177881, "uuid": "7e8a38ec-083b-4b2d-aaba-8c7b55f00ec9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6a9a9cb-7d7b-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671220635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671220635, "uuid": "3f427120-9116-41c9-947a-3de0d921facd", "comment": "Malware payload", "value": "8c873c70bd5e566cceaeac56dba265fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671220635, "uuid": "e604f3bb-083a-42ed-b23e-929e5954703c", "comment": "Malware payload", "value": "227893c1a7e7190c87570a0f06d4b9eb19521aa9e905f65cb16652d559ce74dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671220635, "uuid": "cbfef14a-191f-47cf-83a3-967bc9c2b0a3", "comment": "Malware payload", "value": "5df7acfce590caf14ac4daeb35b62e2440d75bcd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671220635, "uuid": "9e2482f9-0cef-4e05-b613-8a3faa9cbf5a", "comment": "Malware payload", "value": "f52db04c032d7fc9c2730b82be79d6ea92508fb1ead4426848b59311055e4c3527c8acfda4d0be8743b5465a8e206f3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671220635, "uuid": "661d3d5a-1f7c-42a3-9abf-1b24ca81b7a7", "value": "T1C674E0F177A0E47EC190C7308D29EAD89669AC215F2165F32B042A2F6DB22C155FE37D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671220635, "uuid": "3d5637f5-fe65-4784-bb6f-95ad605b53dd", "value": "3670997c8c2669588bad5b8c178dedd4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671220635, "uuid": "fd0a3a5a-59c9-47bf-9596-fa52749bd084", "value": "6144:EMLrv/cbrRsyMLVNtvUjAPE7SSuMXZmNkugzYr40M2b:EMnEbdKVNtvUk82SuMXZmNS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671220635, "uuid": "d8b0bac3-26de-47bf-a1eb-251297544282", "value": 341504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671220635, "uuid": "fed43e79-3136-4742-ad64-d80af4df17c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671220635, "uuid": "9d30c719-560f-4b6f-b968-dcc50640c25d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adf46767-7d14-11ed-9db1-42010a9c0080", "comment": "Malware payload (Mirai)", "timestamp": 1671176328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671176328, "uuid": "1d5cdcda-c996-4862-afd5-56559ab7001a", "comment": "Malware payload (Mirai)", "value": "1e8f25b5842e9b096a4c4493fcc022d3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671176328, "uuid": "677f848d-4fe3-4165-9eef-42bb7b419ff5", "comment": "Malware payload (Mirai)", "value": "229140a87811c6d16e6b42bcbf51bca7c102bb419f7eb1e6e946f3faeefbb278", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671176328, "uuid": "72ddc1f8-e563-4a77-a0a9-906f73cf8c82", "comment": "Malware payload (Mirai)", "value": "462721a566f5854c40f0c3ab9c80266efb556e35", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671176328, "uuid": "b846bc2c-daf5-4573-b538-8e49af11ab02", "comment": "Malware payload (Mirai)", "value": "57de62c0220f63f98e9b84848509e4433c9fe12e7bb8a93f4025b21116a233257c6c5b7260c90a45acdf5b0d267b2e55", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671176328, "uuid": "b7ddf60b-d797-41f6-967c-1b66f6e39a47", "value": "T1B4631B95F8818A21C5D5137DF92D168D372227F8E3DE72139E205F603B8A96B0E3BD46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671176328, "uuid": "fb8fb81b-f406-49d8-a9ae-c6afa9456db4", "value": "1536:hgnAkIP7B9stYVenVQmqct8URqOSQHMgimu2aa7LLJa10ft:ZP19st6en6mqcEku2aa7LL4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671176328, "uuid": "75a59ab9-7034-4d96-b125-379882fab427", "value": 72264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671176328, "uuid": "a56a0977-118b-4f3c-b212-6a008224bfb6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671176328, "uuid": "d77704b0-c118-410e-a185-5984482dfcc0", "value": "1e8f25b5842e9b096a4c4493fcc022d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0da81017-7d20-11ed-9db1-42010a9c0080", "comment": "Malware payload (AgentTesla)", "timestamp": 1671181213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671181213, "uuid": "b68bd111-63a5-48fe-ac0a-21d57f80aaec", "comment": "Malware payload (AgentTesla)", "value": "e1af61831449dd15c6b1786e0ee00183", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671181213, "uuid": "c1907dd4-25ac-481c-af75-9c2d0a00e5c7", "comment": "Malware payload (AgentTesla)", "value": "240ee2296fc5eb3111e25424d9d6e05f9caf340d753c9f7f387c411bb839fc3f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671181213, "uuid": "f3fd6913-72bf-4518-b49f-1f93f73a6d0b", "comment": "Malware payload (AgentTesla)", "value": "6e3a6a31b99f389408c1036d93cc9ba756e0e4d6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671181213, "uuid": "a2e125b6-0a84-49f0-82d6-61aebab386b6", "comment": "Malware payload (AgentTesla)", "value": "3c18a869455f420ece5ab4ce58e1ab9bb312ff9c65b2d5b328ba998c862493a37468a1df2c2294e3cb63798dec51379b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671181213, "uuid": "6a4a2cd6-66df-4cbe-9a6b-b0a01e5e3601", "value": "T11905055B38AA410DB6616D659FBCF171C25EEAF1197A1CF75DF3090A1012AF08B2DB23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671181213, "uuid": "e5aa97a7-946b-4db3-81f2-94dce0c29449", "value": "6144:6+5XuSzO5UdOMpEUHMfw1BVx9HYmQAsC1B01xXy8W2:HXuSzO5U9EUHMfw1BVxxRQG1B0148W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671181213, "uuid": "3a982816-97a2-4fb0-84ca-6bd85b8f67d3", "value": 858656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671181213, "uuid": "cc41c2f9-1c68-4478-b864-52fb6b7edfbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671181213, "uuid": "5f69563d-d911-4215-a981-4b1b9c911f41", "value": "SHIPPING_DOCUMENT_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8411be82-7d3e-11ed-9db1-42010a9c0080", "comment": "Malware payload (WannaCry)", "timestamp": 1671194297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671194297, "uuid": "764b526f-f1a1-4d8d-b573-a46b64107349", "comment": "Malware payload (WannaCry)", "value": "db349b97c37d22f5ea1d1841e3c89eb4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671194297, "uuid": "eba4b71a-f9d1-40c9-a923-ba0d6e004396", "comment": "Malware payload (WannaCry)", "value": "24d004a104d4d54034dbcffc2a4b19a11f39008a575aa614ea04703480b1022c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671194297, "uuid": "9681c144-72c2-42ae-aa51-932121415097", "comment": "Malware payload (WannaCry)", "value": "e889544aff85ffaf8b0d0da705105dee7c97fe26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671194297, "uuid": "0df42420-5c7c-4235-960a-ae9512db9844", "comment": "Malware payload (WannaCry)", "value": "7c6c39f43597afe297bbf69dc76216fa8e982713831490d1826adcd90c8e0adff3b87c681ae74fe38a56467700eeec65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671194297, "uuid": "cf86eac9-4798-4b44-a1ae-94268eaf3195", "value": "T1B70633A8962DA1BCF0050DB044928557EBFB3C57B7BA5A2FCF4045660D43B6F9BC0E61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671194297, "uuid": "703bdcbe-4559-4609-9688-5bbf878fe24c", "value": "9ecee117164e0b870a53dd187cdd7174", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671194297, "uuid": "742f433d-5762-4d18-a94b-c62e3aff726d", "value": "98304:wDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2g3R:wDqPe1Cxcxk3ZAEUadzR8yc4gB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671194297, "uuid": "919c8cc4-cd99-46a5-9211-a32ba58a9357", "value": 3723264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671194297, "uuid": "7b01da69-f0e6-4718-b4d6-c2104c5f0861", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671194297, "uuid": "e5870676-d288-431e-ab02-52a3c7574585", "value": "invoice_greenanimals.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e7e9fed-7d0f-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671173967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671173967, "uuid": "25c82de1-577d-4250-b2fd-6d0a393cdc13", "comment": "Malware payload (Smoke Loader)", "value": "18c077f97d015699daf0ec2e459b3410", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671173967, "uuid": "d2662951-72c0-4aa2-9d9a-4957a5984023", "comment": "Malware payload (Smoke Loader)", "value": "25043deed57736749b4c7cffbc200e72c549d8392863466ce03a0a8a74816c2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671173967, "uuid": "5d23c120-bc34-4e94-ba18-ce6b4c8dfce7", "comment": "Malware payload (Smoke Loader)", "value": "7982f58db1d402309d41c24c38b9b7665719405e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671173967, "uuid": "b72c0fed-9b69-4448-bd00-199019e0e8c2", "comment": "Malware payload (Smoke Loader)", "value": "d69ed72208138a4fae8d93aac3a79adacb50d07ea3d1e34d3bb5bfea1f415742da8cd63df86e23fcb1061fabfa1b6a37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671173967, "uuid": "d0b6b524-321c-4392-8208-b335fa8c7a31", "value": "T17B34D01172B0D072C55F19308856CBF05A7EED3199B19A0737763BAF6E30B906A7A34E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671173967, "uuid": "bb334f12-2c67-4752-b67f-7ea61c89b564", "value": "b35462da489bc13bae884e55b5227599", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671173967, "uuid": "60f1e75b-008b-42db-aaf2-aac0740893f0", "value": "3072:I+hkaHnRLIURtq2cRgg0CHcNe1BedQ3GDcIeLppLR/YLQ2mppGT8EnQPTlHtWqMD:5hkqLIURE88cNeJ2DcXPhLtWml8qMrc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671173967, "uuid": "be4fbb17-6311-42d3-85f1-38a7faa754fe", "value": 233472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671173967, "uuid": "ca2e5777-f129-4b75-b444-7c189424bf9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671173967, "uuid": "e3a052cd-2e20-4227-b067-2e536bf40878", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2893a874-7d35-11ed-9db1-42010a9c0080", "comment": "Malware payload (RemcosRAT)", "timestamp": 1671190278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671190278, "uuid": "67a2cb51-c937-40f6-8526-7ad4342e5f8b", "comment": "Malware payload (RemcosRAT)", "value": "6c2366ca263da1b37acac16a1c98770c", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671190278, "uuid": "ddd66d53-9291-4391-96a8-7f9ad0c6bc1f", "comment": "Malware payload (RemcosRAT)", "value": "263e2a0a2aaf1b542281dda129fc59715a06acab1a86b949026841e4ed078839", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671190278, "uuid": "ae3431fa-6b80-41cd-a53d-bb1a45722ad3", "comment": "Malware payload (RemcosRAT)", "value": "a1ee4ed0959bb24c0f3ec9af2ad1dba8a4495574", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671190278, "uuid": "147c1709-1926-40d5-989f-527f8dbb46ab", "comment": "Malware payload (RemcosRAT)", "value": "9e421b47532d57bd31d910aeeade1a85c6ef1afd13b0e943f7aadce2fa7e4eaf64ef0c4b3c6fb0f07807fca1f8942315", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671190278, "uuid": "6bea488e-f794-4cc9-a46f-6af24db42341", "value": "T1FF4523916A45C0BAE2550AF488B9D373D5BBB29208CB7437736C1F786BB53CE2F42611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671190278, "uuid": "e63fb7b4-960f-469e-ad8e-2f40b2477644", "value": "12288:GlDm7D8rRGCfrqnAaOsvnzsmMulbXsRoLSQ:GlCfWlGnAan5lbXMHQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671190278, "uuid": "c7f19117-cabf-41b1-9070-e9a9c741cbe8", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671190278, "uuid": "f9ef3c1e-f7c0-4151-8e6d-67ee60c227a7", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671190278, "uuid": "ffac4563-e1bc-4bc9-810c-6fe88439a58a", "value": "RFQ.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f4c4f65-7d3c-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671193484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671193484, "uuid": "ae245c5e-6707-4c78-b4e5-c49f46dd8bfb", "comment": "Malware payload (Smoke Loader)", "value": "5e869433fa7ac346a2cb30e41ac381a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671193484, "uuid": "e56cb816-892e-4bc7-8af7-d6d8d728b776", "comment": "Malware payload (Smoke Loader)", "value": "2643a87839675504f209b52a5550c2d2ec4148f81a26221c20a2389fa2efe879", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671193484, "uuid": "352fe50b-d2a9-4b5f-b930-a43a2eb62e9f", "comment": "Malware payload (Smoke Loader)", "value": "3594c20c55f9a9cd8e936028eb951b7334f18b42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671193484, "uuid": "38f1acc6-baf2-40ab-a9cd-47e4d420e008", "comment": "Malware payload (Smoke Loader)", "value": "a4797fc1afeca77fced6b151b12cc2e134e568c65a3e66d1505ddd2ada462f20d66f231ed7e58fb3c8b7d5e7b6d142dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671193484, "uuid": "2b3c459c-6866-49d1-a326-6852279bcda2", "value": "T13A24CF11B270C572C21F44309962C3E09A3EFD3159B2A55773727B9F6E31EF1A62A24E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671193484, "uuid": "e6d3b546-a3da-4232-b801-f0325b422751", "value": "875e7ce4bbed8fa04d22755473fc97c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671193484, "uuid": "3a2efb2b-1c5c-4f05-a6d8-f9bd2da958a0", "value": "3072:OOjfL2ULUONrs+/5jBZO8nGunAs2wK5ZnIbLQ2mppGT8HNWE2HxbHtWqMPDcfuf:Vjf1LUONrsoTUMAs2BDtP32RT8qMrc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671193484, "uuid": "00f3e5c3-db53-438e-814c-95ac4a37e9e7", "value": 225792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671193484, "uuid": "a7a212f0-b6a4-407f-9e17-f5eff2b1daa4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671193484, "uuid": "0386634c-d3ba-4304-aa91-172b8bbd0483", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56dff258-7d5c-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671207106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671207106, "uuid": "a0567fb3-7270-4980-b825-a5ff2e735f05", "comment": "Malware payload", "value": "c952100030b021b7747e9ac019091751", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671207106, "uuid": "c5dd7fd9-71d7-42a8-93d2-c7ebe5c3db62", "comment": "Malware payload", "value": "26dae66b18522e7ef2068a1ba6452b455f2910acbc43e7ca05f53085d7a9cc42", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671207106, "uuid": "57b9852c-2da1-4205-8ef0-337b76a0aa0f", "comment": "Malware payload", "value": "0caa73ac7a38b85b583471d894d2047b685854be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671207106, "uuid": "cc486162-2f0c-4fe6-8294-d2f131f4f781", "comment": "Malware payload", "value": "ffcd4b238c74fdce2933faaab5ffbb12ac6c9cfb81d44beb7eb48d52668db71d2e03169f0167f5c3395c89a3a4e34811", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671207106, "uuid": "95f4ba8a-fcf5-48d7-9262-aa46fe375758", "value": "T183C58D58DA0390BEE82314F1067BF6FF9520563544B08C5BEA8CDDB4AE72DA2631971F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671207106, "uuid": "80205fac-df9f-4be1-922a-492c3299cddd", "value": "9b07102925b4f59f35c71f053bd1ede5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671207106, "uuid": "cafa3836-2f12-41e3-a8b3-c107ca2cc234", "value": "49152:jKaGorwh5N01b0QXMG1P4A9HuUHgdXaYdEqNdcZg1cakN3AABkTJwYLHJq0b3G0:qorm5NA1r4A97gz7Ig1cakN3AjTJwYLV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671207106, "uuid": "32e8df29-8fa7-4c4f-a493-401b8c0fce6d", "value": 2666712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671207106, "uuid": "23fb0af3-5481-4891-934c-bc35341eb4fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671207106, "uuid": "8e9cea1f-577d-4dfa-8475-27ff35e96fa4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c259379-7d96-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671232053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671232053, "uuid": "03be68ce-efea-4ecf-84c5-5ad11ec42d60", "comment": "Malware payload", "value": "bd6ee4b5f5ea1e4d9f935976e7d5f47b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671232053, "uuid": "f3131648-c183-4fb2-a768-3e24b6fc4687", "comment": "Malware payload", "value": "283455ddb0a8d49953b746848056b0cc3ca329fdadb93b0ac77aafdeb7e98ffb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671232053, "uuid": "d53d0511-6a21-4929-bc8b-1029ed7dd5f3", "comment": "Malware payload", "value": "efe93d12c59a910ebc1e372a703e077a8b0f2a4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671232053, "uuid": "6d6707f4-233e-4dae-a932-50719ec16115", "comment": "Malware payload", "value": "9c1f3a95ef7719f1016eb25fd0577168192260aeb93b0392752a37ec648479d4a00037e411f6836cd7afb912262a5571", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671232053, "uuid": "ea5e25c7-c076-42ae-88c4-79d1aac97aff", "value": "T1ED74E0F026B1E42EC201D7318D29D7E45AA6AD111A72A5F32B143A2F5A317C05AFD37E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671232053, "uuid": "ba540bb6-ed42-4dbe-badf-50fff7fef0eb", "value": "aa9c378109186462717e17e657d0c833", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671232053, "uuid": "fae51333-be7b-4132-9eb1-2ba553e7a5d0", "value": "6144:VUuSLw1iVlGSVnvl7pjP1yxQ3PUXrGC7iy8oFgzCl40M2b:i5QyGSVNVjNfNo+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671232053, "uuid": "3bf0ddc4-ced9-40a2-ab0b-22a530a8133d", "value": 342016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671232053, "uuid": "2024ad16-c319-487b-bb0a-e32231efb041", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671232053, "uuid": "416ba161-82ab-4571-9d1c-4d6ef9a2dacb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efc6452b-7d88-11ed-9db1-42010a9c0080", "comment": "Malware payload (AgentTesla)", "timestamp": 1671226261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671226261, "uuid": "2b63d651-dfa8-4e84-b007-19cc21d55311", "comment": "Malware payload (AgentTesla)", "value": "dfd02fdebedca67a81467c34fed0b2f9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671226261, "uuid": "f643342d-9754-4ce9-ac0b-c2e2df71e5e2", "comment": "Malware payload (AgentTesla)", "value": "2834a66a8f61efa0975b19f6888006af599b3b8b27ae5d389efd2c4279e5dfbf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671226261, "uuid": "4faa0ad9-8a7d-40a8-9235-0acd00bcad43", "comment": "Malware payload (AgentTesla)", "value": "40f934049da7ae476a8916c4ba3d87bb8a536a1a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671226261, "uuid": "93856d81-e5a8-4cab-967b-07373cd33bae", "comment": "Malware payload (AgentTesla)", "value": "6ac6abfdb2f542e006d2c10897673650f5ee8aa5f92b14a0b9ae7bd4901abde0f6aae231149af7a0c3c38c5c47e05a8d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671226261, "uuid": "b978ec44-e53d-4f42-8b4c-54f4d941354f", "value": "T100D4BE24EAFD0477CBBFA7F9AFA5022C0E70E4936006E749441459BA9D02B548F2677F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671226261, "uuid": "8b5ae9ee-7f24-4ebe-b75d-442e47b61c40", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671226261, "uuid": "9fabc9a7-ef32-4400-889a-f849c83c4fd1", "value": "6144:VzxghbmKy8mHiA6RJ9b9LX9IqYJNDN66UXug8fD01ISUKNlUzs/MddoRdjGMqttb:Vy1o8zb9J+NJou1ULUKNQ3dkCMUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671226261, "uuid": "5320366d-e86b-43af-b1ed-c92642b17034", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671226261, "uuid": "cb0c5215-4bbd-4f3f-b17e-0679ef0cef5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671226261, "uuid": "2dd0ccf0-862c-4a3b-b47c-6390ff42d986", "value": "SecuriteInfo.com.Heur.FKP.21.26971.27946", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7edecb5e-7d17-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671177538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177538, "uuid": "38483ba4-a973-4bba-a6c9-17396f2bf1d2", "comment": "Malware payload", "value": "f695567839ce519d8c82e29b656460ca", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177538, "uuid": "7dfbed4a-dc8c-4a80-8c6a-fd5f41ebe0ab", "comment": "Malware payload", "value": "2842a75c040f352a45c66beca50a4c61f9bb1b823d3bee11721d32fa3f96ac27", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177538, "uuid": "5be65ba4-26bb-4ee0-adeb-819d75b8aff9", "comment": "Malware payload", "value": "904ae4cc67b048d2f74bd8431280dcfaf5b09bc7", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177538, "uuid": "70fef3a5-4f76-4050-9b53-ed02ac67a416", "comment": "Malware payload", "value": "ac442a2cfc91e3342d7ef909020e6b6ec2badd1d96e5707ad9c989aed9291c3e17dbc79b05f4ddd20bd39329045b471f", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177538, "uuid": "23624358-5462-49d5-ba1c-638461caad24", "value": "T186F38D6162ED5114F2F33F51BDFA65114B3BBEE6AC75CA4D42880AAD07A2D00DCB1B36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177538, "uuid": "b95c36e8-ca39-490a-b81f-ccc9374aa9bd", "value": "1536:GXFYW3aQivIwzXfu4vy2OLO8ozlADw8auustFmbicH0:GXFJliLfuE8ozlADw8auustFmbicH0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671177538, "uuid": "13c6f511-e69e-4c9a-97a9-1fa943867539", "value": 164592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671177538, "uuid": "5e10928a-6102-43b4-99da-c544efcb429d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177538, "uuid": "c62061c3-1fec-480f-88b9-90c83be24ae0", "value": "Aviso de pago.pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5670706-7d4e-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671201225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201225, "uuid": "e90c536d-d8e9-44db-af65-e2f2da0650f3", "comment": "Malware payload", "value": "99f1c6e9075fabeff05a887d12f626e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201225, "uuid": "64c16ff7-470b-4bf5-b2ea-2163dae75b63", "comment": "Malware payload", "value": "2846ca6292a8d985cc30fd1a8b6cd626da21f2dd6e4b3138229a1ada9f2f79b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201225, "uuid": "27594892-00d5-44d7-b5eb-7e5048ab896e", "comment": "Malware payload", "value": "e6872d1eb3128a56921a277b3ceb6de9867ac1e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201225, "uuid": "d99c1795-79ea-4d3f-b973-89ba203b24b6", "comment": "Malware payload", "value": "7e70cae8fb93c33a646acd05283112d82c5538e239fba3d4fbbf2c98924def73d17aff17d5bdac9114fe87cf5733a5ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671201225, "uuid": "4001442e-6f99-49f8-9966-f34a66c6d418", "value": "T175D36C2471D0C272D915107647A6CF71493A7C382E129ECB6FC90AF50F79DE6DB2A38A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671201225, "uuid": "56b27202-c4a8-47fe-ad01-53145d29ff0c", "value": "e85508dfe798dc480467052fa273374d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671201225, "uuid": "3e5a939d-81a2-4fa2-ad22-4b9e641ec71d", "value": "1536:aKxc4RtWJO//IFKnRkfJg29k0SBf/1XLqs8KMBC2iaCD2xenYT8Ji1dytJivnSqE:hl/QHSBflLh8fU2zq5JinzcmU5GC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671201225, "uuid": "3243daa5-bbe7-427b-a0ed-437eef542de8", "value": 131072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671201225, "uuid": "bb296d5b-f159-4806-b05b-b15b14284b1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671201225, "uuid": "b5a5d8c0-232d-4751-8aad-fb06ca3a3e16", "value": "SecuriteInfo.com.Win32.Evo-gen.15985.24783", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5e9afef-7d88-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671226137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671226137, "uuid": "62bdcf2b-14dc-4197-b3b2-d15fa087033c", "comment": "Malware payload", "value": "f5c01dbbd8328e92cbd58206ec5e547e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671226137, "uuid": "5c494098-0667-46c5-9939-104ba8df9dbf", "comment": "Malware payload", "value": "2861defe4658e3bcd5456f5c3902aeced106a211fcbd1fbb7ac60b6bd1a78e50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671226137, "uuid": "f948bc79-3a26-4b64-b490-bf482ec7e773", "comment": "Malware payload", "value": "c46f4a8a510ae0d8cff80548e33c663ef5d1cd76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671226137, "uuid": "5940fc72-428d-4309-87f3-3c257863a59f", "comment": "Malware payload", "value": "9620835dbc2bebf2dca3abb79ab7adb8d212aca9527e81bb5812ff19cb9600beb4d2acd0a106f72e902aecf0459d2b43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671226137, "uuid": "6f9a9337-7c30-4c76-8696-47f2d13635aa", "value": "T1E624BEF132A0E47FD152D7308819DAD5A66ABC104F22A5F33B05262F19356C166FE37E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671226137, "uuid": "6b210c51-3dc0-4198-aa58-72c5b712d298", "value": "aa9c378109186462717e17e657d0c833", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671226137, "uuid": "afc2964d-8b50-4137-a83b-b887f92d00ce", "value": "3072:tkzlh3JLKqcSbRozTS3F09SSLszLrpL3uBdG840zwUzQRKF+:CLJLKqv3a9SSgzLrhuBdG840M2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671226137, "uuid": "f63de4e8-2473-4b84-b61b-2ac54ecf006f", "value": 219648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671226137, "uuid": "d15352d4-37ee-40a6-8cf7-a3147dcb6379", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671226137, "uuid": "a40cc5b7-d697-4264-b0a2-f0ba25c539bf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec398900-7d17-11ed-9db1-42010a9c0080", "comment": "Malware payload (AgentTesla)", "timestamp": 1671177721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177721, "uuid": "99f9ce34-2b4b-4e82-a7ac-aaa6dfe22362", "comment": "Malware payload (AgentTesla)", "value": "457d13b4e109c2cd642af5b3ec8888fd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177721, "uuid": "f98b0214-c94b-4136-ac74-8f5b11c23950", "comment": "Malware payload (AgentTesla)", "value": "286d0110c4e9ecde79aa103a49f25042e60615ca586b277a4cf61388506e8dee", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177721, "uuid": "29dae4ba-0da2-4259-9c7a-cd77628edf72", "comment": "Malware payload (AgentTesla)", "value": "822b9f03e66d50491166c02f43def81cd36c881d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177721, "uuid": "62b5b670-12ec-43b4-8392-334c23f927c9", "comment": "Malware payload (AgentTesla)", "value": "7150ea29afae42d8aa7340e0487ae2bbe7149ac72310640bc64a07bae58c5822c0ee1d5f0cc6443ab81cb03d1fdfb600", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177721, "uuid": "b76afbf2-e8a0-484e-97d7-e732c8cb1f82", "value": "T163158C0A71D48F59EA62DBF00A00B4B0269737DE29DCEA3C8EDA0FCE5411B18D9556DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177721, "uuid": "98932587-6855-4f6b-8d75-63e4bb1cbe44", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177721, "uuid": "9c7b2517-300f-452b-9a12-e68dbd51b80b", "value": "12288:P/dRXHB+IiSsbLiKLrIP/sHtPmiVDUJAT8d4ItUh9NLaE5VUwteBUqBU:H6beGGsPD0AT8uItI9ZaGtOfBU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671177721, "uuid": "1c7b88c2-96eb-4c59-9eed-2d430285352b", "value": 890368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671177721, "uuid": "2456c4c3-3935-4c9b-a276-ea6cac7c9f7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177721, "uuid": "79ac1b70-afbf-4e57-94cf-270df46bff4b", "value": "457d13b4e109c2cd642af5b3ec8888fd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef60cfcc-7d34-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671190182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671190182, "uuid": "cedaea94-e937-4133-bfc1-50ed4d691cee", "comment": "Malware payload", "value": "c70f8e376c10606311f38da86b92328e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671190182, "uuid": "695a398c-705c-43ab-bb4d-c299a1e65609", "comment": "Malware payload", "value": "29fa00279682b65466306aee52f532c25c00395e6359cc2a6f35d6a46edad0fd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671190182, "uuid": "7dad81fd-1270-4aac-9309-08bb8a8c536a", "comment": "Malware payload", "value": "7db8c1c00dd24369e0bb486787c822cd30fd0902", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671190182, "uuid": "a4f7aa96-f1ff-4ee4-8bc7-a1c0186e9e3c", "comment": "Malware payload", "value": "fbf7b59deffa4d13b297448bff0a6dd5ce5841c26260a3637d0cc4cf6d5dc51941cb529df6511bc9b743f12edd349b64", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671190182, "uuid": "a95488f1-c8c8-479c-8efc-6fe562131918", "value": "T1C2363323EC7CC89E656D9F841541FB4EC8C85ACB9C25BBA1717A43CC3B259DC2A8650F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671190182, "uuid": "0d4f733d-5eb6-4946-9848-e823e6bc60b3", "value": "98304:i7ecJ3ylhHTcql9JJay0aNEnI1364NRbfZRg9tR4d2giz0DPY:i7dqV7cd6vE9v4d2gizSPY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671190182, "uuid": "16ac442f-36dd-4c7e-8338-9c63f054d926", "value": 5213631, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671190182, "uuid": "c72b5eb1-9fd0-4aeb-9b86-53f9fd002ffd", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671190182, "uuid": "8f02000b-d2d5-4195-9b77-ffefbbabe2f1", "value": "temp.sys", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9e1ca09-7d49-11ed-9db1-42010a9c0080", "comment": "Malware payload (RedLineStealer)", "timestamp": 1671199219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671199219, "uuid": "01f9141e-8b02-4d5a-bb91-9932b9952981", "comment": "Malware payload (RedLineStealer)", "value": "78c838173efdae0cb824376451bed923", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671199219, "uuid": "91c75d71-252a-4269-9bc6-0efa5f2bcb8f", "comment": "Malware payload (RedLineStealer)", "value": "2a91eb57328f132e13b1c85f2cecb8342613702d1f2922e815d148d36a6417f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671199219, "uuid": "f54d7eb1-3e87-497a-8805-91da662d678c", "comment": "Malware payload (RedLineStealer)", "value": "dfedcb55e13f103ee0ca9326058d2cf16bdb693f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671199219, "uuid": "4d038151-185f-4f05-9b78-059fb5172e6a", "comment": "Malware payload (RedLineStealer)", "value": "4a526e900ef3314f6fd567d32017b6babeddf6d006285b9c44029bde27e30ca50bd20ec5dfebd6383691bdf9b59809b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671199219, "uuid": "e195f66b-ec8e-498d-9aaf-68f755c2a6da", "value": "T14074F1F03690E86EC121D7308C25E7E5A47AB8219A3156F32B943A6F2D346C156FE37D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671199219, "uuid": "b3970300-9b98-4132-9165-f9eb5908eefa", "value": "2cc3e4b8a374ca30888470c0a531eceb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671199219, "uuid": "4a858da6-e92e-472c-a03b-3d5de8f60701", "value": "6144:qELQT7BHSQot3c83G5RjSZN4SCfX0bwC+KqgzGu40M2b:qE67BH4s825Rj2pCfX0bwzKna", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671199219, "uuid": "ee9270a3-2f0d-48de-9027-bf94e410ec2f", "value": 342016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671199219, "uuid": "a06d5a43-4b4e-4a74-b9c1-56359d2281f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671199219, "uuid": "fd8a92f4-1d8b-4846-a748-62716c8e831e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e976902-7d80-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671222688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671222688, "uuid": "8c31cdaa-8469-4d97-932f-86f1212704fa", "comment": "Malware payload", "value": "17d761f2b50341868445593fc75d3761", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671222688, "uuid": "d331bbb3-7156-4b75-84f4-cac193f0b5d3", "comment": "Malware payload", "value": "2b4181ae199a7543365516d4a97e3ae473fc1e4ecc148503d4ed9c9d55411854", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671222688, "uuid": "d8adf867-1ded-4f15-8017-c883731bf4a2", "comment": "Malware payload", "value": "683c9ac3a00f3b0ea1bae0ce8b65eb3642e377f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671222688, "uuid": "c40b166b-7961-4a93-bd31-f639c8dd257f", "comment": "Malware payload", "value": "71f87a83147f83b2220dc29efb3490b1120458907f6a79a89bc38207f81e275d308ac31839cecf6223ebfbcf80399c82", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671222688, "uuid": "57b83e77-1ca4-4b1d-9f6e-8f8f19c755db", "value": "T14BB5233E905840BAD1FB9AF978239C6189E36C27A634D05C3B9DBD5F77FB9C09901206", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671222688, "uuid": "d7eb0d11-1026-4cc3-96d8-e5e1dc33458d", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671222688, "uuid": "4c22dc50-7ccc-4641-8143-b1f3a2e87131", "value": "49152:Epae7QpLhY8bQQA0/PkktO+Eb3VjDKDVYlWod2mbGeOCgSY/imF:Epae7Qp289AePZErV65YtotcY/imF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671222688, "uuid": "a1a3642f-3d4e-4fb2-8de9-b0ddfe33fd24", "value": 2445230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671222688, "uuid": "cdd3b8c4-a60b-4d2a-97af-7dce17055412", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671222688, "uuid": "12a39e16-3692-40a2-b3b1-7583192739eb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92c3fc85-7d24-11ed-9db1-42010a9c0080", "comment": "Malware payload (RedLineStealer)", "timestamp": 1671183155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671183155, "uuid": "b52fef19-5d42-4321-b0ca-cc44c8d57bda", "comment": "Malware payload (RedLineStealer)", "value": "0f71ef9d0a8059fe2541cfd1c7c3f85a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671183155, "uuid": "a6b82758-053d-464b-86ff-bc53d70668dd", "comment": "Malware payload (RedLineStealer)", "value": "2b523a84ef1e28c5912cd9eea30e1a731ec5eb07296d4af2906cdba7c5d4a47e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671183155, "uuid": "56dbedc5-bfb8-4907-8871-76f22935e006", "comment": "Malware payload (RedLineStealer)", "value": "2d2e262844d5f3ceb76d158f746117628fe207ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671183155, "uuid": "d3f9920a-dac8-48d0-90cf-58244e2429ad", "comment": "Malware payload (RedLineStealer)", "value": "27ebcfb0cabdbc3066fbc3187153dd93c9a795ae0d1f662399765ea533dc68dad8f2ba1b5e608435c699596e68eec6b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671183155, "uuid": "58861a15-e9ac-461c-9b19-3b662b148e3c", "value": "T1D074F12172B1C031C88F15348966C7A5AE3EED314E705A0737762AEFEE70B507A2A74D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671183155, "uuid": "04e5e4a0-f94c-4f25-8c53-f2b75abcb9d0", "value": "b35462da489bc13bae884e55b5227599", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671183155, "uuid": "12db95c5-aa84-4f21-a78a-39e15380429a", "value": "6144:72kOiLd475WFTHO3OL3Gq75dQXmw+h6rxLJ6T1/19tnfa98qMrc:72kPJ4twjfDLw+h6FLoT1/19c98n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671183155, "uuid": "38f81bff-93c5-448f-b8cf-6824273b862a", "value": 355328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671183155, "uuid": "ecd21db8-334d-4537-bd53-41ffcf81dc70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671183155, "uuid": "f32cd189-955a-4bba-a188-1adb341d0322", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e42c7e5-7cda-11ed-9db1-42010a9c0080", "comment": "Malware payload (AgentTesla)", "timestamp": 1671151257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671151257, "uuid": "4a77d64a-27f3-4024-9c75-de0e92e68591", "comment": "Malware payload (AgentTesla)", "value": "c0b0583ddcbe2652432832a401371cb9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671151257, "uuid": "9caa1b4c-10aa-488b-9253-427361acf863", "comment": "Malware payload (AgentTesla)", "value": "2e4042a6c1b326b71ed7f15a2b030e430c1d2c70ec065505caa8dda0b4e5a12e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671151257, "uuid": "32a5194f-35fc-41d1-abdc-db303b596384", "comment": "Malware payload (AgentTesla)", "value": "cf8e8c41449a101d40d0de1de3f7978ebee70165", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671151257, "uuid": "e9b32c84-181d-4b68-a26b-dfac842587e6", "comment": "Malware payload (AgentTesla)", "value": "4a3beafb622a48aa93efca6cbe4308c8bfed68c37c5adbeed2a4762a9f3fae3a5aabcc2d1ea1a569fb1a4474ffbe910a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671151257, "uuid": "d14d918c-92a2-41bd-9da5-c5ad9ed8d68e", "value": "T111158C0A72D88D6AEA51DBF00B00B4B126E737DD28DDEABC4EE61FD94492718D9041DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671151257, "uuid": "9b694de3-c706-403c-829e-982439330d09", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671151257, "uuid": "3dcc4208-b114-4cc2-b581-00451ae5140e", "value": "12288:lLv+IkE6J93yBQ2u89bFgpyUIzMnS9ZFzRAmlvUy3le:w9J9sT2SbFZNb1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671151257, "uuid": "31249bf8-2887-460f-9af2-62d192e74fb5", "value": 895488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671151257, "uuid": "3586173a-34bf-4611-b0fe-17356d7a1573", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671151257, "uuid": "a788e90d-255a-4225-8abc-6e9b05d5a92e", "value": "SecuriteInfo.com.W32.FakeDoc.V.gen.Eldorado.9732.28565", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57a688c3-7d6d-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671214409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671214409, "uuid": "893bb826-f341-466e-9e5e-49dae9382c40", "comment": "Malware payload (Smoke Loader)", "value": "c04af2390c8dcb67a180e86f9afd71d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671214409, "uuid": "aed73844-3de7-4e47-8432-3076c9520615", "comment": "Malware payload (Smoke Loader)", "value": "308a646fd221fe37c541480f7b3295abe55cc6f1acf32c95feeb36d5aea78544", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671214409, "uuid": "3696e547-9345-4a7e-84b4-c00fe18c8a0d", "comment": "Malware payload (Smoke Loader)", "value": "044a9f91cf075f854039bd4feb0b75cfc00ab0bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671214409, "uuid": "86b4f645-dde8-4427-a96d-3bb3fff867a9", "comment": "Malware payload (Smoke Loader)", "value": "42c5b413f150b590251e1750e064e4e377ea4d70a5d4eeeda19b9fdc04407bf4bf76a4c22acf2759578c7210e8d78e7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671214409, "uuid": "9cddb76f-a4ba-493e-83fb-69f5bcd66388", "value": "T17424BEF12EA0E06EC141D7308C15EAE5A62ABD249E2155F33B28BA1F1D716C056FE37D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671214409, "uuid": "b218fe6b-b850-4974-b1bf-5d59ff4f20f4", "value": "3670997c8c2669588bad5b8c178dedd4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671214409, "uuid": "e030c7d0-5c48-4f30-950c-556ecb6c2af2", "value": "3072:vYgBJLxAjz80R+8ZP2SIKf/WHoAypgzXxzFIp5FrFLszrcT6j40zwUzQRKF+:wKLujzs8cVKfezBzuFxgzok40M2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671214409, "uuid": "099b7104-3d9b-4e0d-8e45-9a446c31deab", "value": 220160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671214409, "uuid": "4f5e84dd-4250-40ed-9a39-3d8a135ddc81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671214409, "uuid": "4ec3d3ac-4354-444b-9983-0865cd2df261", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba34c262-7d36-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671190952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671190952, "uuid": "43ebe95f-13b1-4f75-b91b-a78e2a0a352c", "comment": "Malware payload", "value": "f418f3c9d7248993ee8ce10313bac9de", "object_relation": "md5", "Tag": [ { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671190952, "uuid": "27882d5e-8bdd-4036-a1c5-7e3cb76a6ec6", "comment": "Malware payload", "value": "31f8a9988c3773d9a2d0b605369c7d0fbd3b720f8411fcc53be8362cd0f5d802", "object_relation": "sha256", "Tag": [ { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671190952, "uuid": "1bb91721-375a-4d84-861c-60246d9cc095", "comment": "Malware payload", "value": "bdfba977ba957da877a9da9d888d822e943597a9", "object_relation": "sha1", "Tag": [ { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671190952, "uuid": "07c465a3-12fd-452e-8bc8-bf84604bc38a", "comment": "Malware payload", "value": "6493c7c07b93d6ba5538614c71019c542cea77a25d2cb9fc1e53043c2211d3a70c82a5bcb82abc37814c2ae12208f37c", "object_relation": "sha3-384", "Tag": [ { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671190952, "uuid": "964bc603-7af5-46ba-abd1-cda5afae7812", "value": "T1F307F217F388643ED0671A3A49379768983FBB617922CC4B5BF40A8C8F355407E7A25B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671190952, "uuid": "dd81329c-37b5-4e36-bafd-e36331926157", "value": "2e4eb2eca818083f7cffd1cbc7b917dd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671190952, "uuid": "e4a5ca96-d44f-45a6-8c46-16f6a917d860", "value": "393216:JlLUeBN/IT3p+C/AsYKwLV+ZQ9LTyedHhG:JiT3p+wwLAumedB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671190952, "uuid": "a8bf39cd-1547-43e1-9f16-a7ed26263d42", "value": 17182208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671190952, "uuid": "2a05aa96-5064-43dd-a1ec-a40c98d7abb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671190952, "uuid": "e5f60d3a-7d05-46c2-8d2e-6ec1162b6c10", "value": "C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f328995f-7cda-11ed-9db1-42010a9c0080", "comment": "Malware payload (AsyncRAT)", "timestamp": 1671151534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671151534, "uuid": "797881f5-76f0-490d-9453-48ecf9f04c32", "comment": "Malware payload (AsyncRAT)", "value": "369792e4dd5b52ce36403fff34f4a99b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671151534, "uuid": "a5bdcaf5-5bff-4bdc-a900-62f747bc53c5", "comment": "Malware payload (AsyncRAT)", "value": "3275b32fec54f3fc881edde92ecb823133a1fd59a047b33bfc28adef7db53f79", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671151534, "uuid": "36b71d2f-7b33-49d6-b914-cdc8f0301d46", "comment": "Malware payload (AsyncRAT)", "value": "a0ac285cb2a62afb95f809a27990b73037fda709", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671151534, "uuid": "836c095d-6b8c-4cb7-9348-2f1fbb78e1dc", "comment": "Malware payload (AsyncRAT)", "value": "ebe70f79ef3b048e9d267b98c9f677577b2e693f3d97909a2bc0e5bc97fbbade547d756ea313cb9b3ee798c2a24efeae", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671151534, "uuid": "390fe22a-c1e5-42b1-b89e-c416e7a96304", "value": "T1CA534C043FE9D129F2BD8FB499F265444AB9B15B6902D60E1CD451CB0A33BC2D9436EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671151534, "uuid": "c1e2c3e1-7020-4fd8-b5d5-b117a35d8624", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671151534, "uuid": "1c12c024-7770-41c2-8b35-4c9f9a81b4cf", "value": "1536:OPrVFns05+DQITaSpdbQarDUOZ33q7Ax:OPrVFns05+DZaSbQaHUAHqUx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671151534, "uuid": "77513538-6843-4034-85ec-2c6305bd850e", "value": 63488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671151534, "uuid": "c0e51e2d-4d8e-4603-a294-e22d47f99f70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671151534, "uuid": "b67b07e8-441a-4a50-b73f-bfed157942ec", "value": "Stub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eff09543-7d1b-11ed-9db1-42010a9c0080", "comment": "Malware payload (AsyncRAT)", "timestamp": 1671179446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671179446, "uuid": "425328d6-5fef-4e90-8bf6-71bd579c0852", "comment": "Malware payload (AsyncRAT)", "value": "925720a8e4b7cedcda550b67b7559965", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671179446, "uuid": "d5e0e868-f7f5-4209-bfa0-6a5a0ae803ae", "comment": "Malware payload (AsyncRAT)", "value": "3369326c2ea042783b62898b91df686bf554278ec22a6b7d5aa7ad1bb2880807", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671179446, "uuid": "400609d6-703c-4ce9-b464-9295365979d3", "comment": "Malware payload (AsyncRAT)", "value": "b17058dce6395523d6fed05b12423bff5d25f962", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671179446, "uuid": "580fb6f4-8186-4b78-a427-557a50249fc5", "comment": "Malware payload (AsyncRAT)", "value": "dba6119d7dd101eb5b31239f331e86decb0f1cfbfa3d2e29b1f41371924a47a8f071cac276de8dabde56eb01a6740c88", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671179446, "uuid": "5459eede-de0a-4066-beeb-6b471f497802", "value": "T14034F145BAC8709FCA5FCE7D89213D15862C60127743F343A8A132BC59496FEA993BD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671179446, "uuid": "72b757e8-a89d-4668-af5e-b0ece78b257d", "value": "6144:79jJoVYlB0QZroh5jleTF64opuhFgA/Kl6GP4x6OoKeaz:bcYhZrEjleTF64AuhFV/Kby6Yz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671179446, "uuid": "11bf603f-cec4-4246-a9ed-e291c9c0f472", "value": 249856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671179446, "uuid": "7efdecec-2fd4-41c5-9f6a-ea32529667aa", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671179446, "uuid": "317eb0bb-c0c8-45a5-8721-38eceeac045d", "value": "PO87875620 2022 DEC.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0acc88f-7d8b-11ed-9db1-42010a9c0080", "comment": "Malware payload (Formbook)", "timestamp": 1671227416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671227416, "uuid": "19d35e27-2f43-419f-bfe8-dfc7edf2ffb3", "comment": "Malware payload (Formbook)", "value": "fa5fa07a737c5211592dc750a6d6d04f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671227416, "uuid": "2694a280-93b1-4811-b679-cbe8d5004343", "comment": "Malware payload (Formbook)", "value": "337385a92981a6384ba5b7dc6697cfa884ba1aac7f4289f3d36eecc2a19dc2b7", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671227416, "uuid": "83767ed6-7133-4123-8751-9482b0b2343c", "comment": "Malware payload (Formbook)", "value": "75b2082a1886042697976faa9fcda686ddc4f7f4", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671227416, "uuid": "5b7caced-a068-48dc-b35e-ecbc05974f56", "comment": "Malware payload (Formbook)", "value": "b7de7dd3dcd70f81a2a19c87e40e64309ec3c8ba3ed5ae7be1d3dcb251bb908a55dc0309f458c4b4c6f3c9902414597d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671227416, "uuid": "0ea5b624-7981-4211-96c7-2482759dbb2b", "value": "T1AC84239DDC27A122755746D7A03EE1931E2CEA6FCCD2BE11F9204774FCA0BA1C6D2612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671227416, "uuid": "4c921422-5be4-4430-a996-251aed8d93e7", "value": "6144:xq7aC3g4jeMbOLXBXPA0V4r8SKI7sL5u2csIdvj1/cjNsF11:xxFIb2XBXoK4qIALU2cnkJsFj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671227416, "uuid": "4181e060-2c04-489e-aba2-e6d6af1b5a7d", "value": 395633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671227416, "uuid": "03b1dafa-c18a-470a-a4a0-493962c460f1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671227416, "uuid": "b41d1682-c7fa-4825-a57e-98889561c6b6", "value": "Amended Purchase Order 71093456.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f09d763b-7d7b-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671220678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671220678, "uuid": "05e91fc3-1bca-4bda-9796-b0b4a5619f15", "comment": "Malware payload", "value": "6bb8568632dd98893b5f9ad6ec5f49e8", "object_relation": "md5", "Tag": [ { "name": "82-115-223-60", "colour": "#F7CF6B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeEvilHunters", "colour": "#9F827E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671220678, "uuid": "f72bb57a-c9ae-48dc-b405-f10e6d4d1117", "comment": "Malware payload", "value": "3458224c4b9276de9558b7f3810c3c3a0684af4173fccf6a7c0b4b7a848d5170", "object_relation": "sha256", "Tag": [ { "name": "82-115-223-60", "colour": "#F7CF6B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeEvilHunters", "colour": "#9F827E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671220678, "uuid": "dee3d9f1-5879-4359-ae38-24162ad00eac", "comment": "Malware payload", "value": "76aaa7e1dc27b2f19d7853d6170fd9eb8b4f0a2e", "object_relation": "sha1", "Tag": [ { "name": "82-115-223-60", "colour": "#F7CF6B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeEvilHunters", "colour": "#9F827E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671220678, "uuid": "eeef8918-01ed-4962-aee8-17d11de74b59", "comment": "Malware payload", "value": "55f362615c37486f8c516762a27a98f8d7e44d08d27d48ce59a10424b61e24fdfa95aeaddf59c510b42622b0ccac227f", "object_relation": "sha3-384", "Tag": [ { "name": "82-115-223-60", "colour": "#F7CF6B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeEvilHunters", "colour": "#9F827E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671220678, "uuid": "96efc3b4-0fe7-4c82-a84b-c1653b0cbcaa", "value": "T1E5A35B837B044F11E9783535D2FA5B2C23A0FDCB5731894FEF04766A1DB26A2988E6C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671220678, "uuid": "7d658e15-ff1a-44ff-b9bc-224d1a858b07", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671220678, "uuid": "1bfc00b0-f493-454d-9ec4-c17cc09353d4", "value": "1536:4sJiy+M1imE2Y2tspkd1fdGA8OuGzfdAYKgQeYr:yM0mw2tsps2OZYTr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671220678, "uuid": "0e43a911-6f9e-4f26-b99f-fcf281208010", "value": 103424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671220678, "uuid": "3bec608d-9ae9-4543-9bf7-68c470a56779", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671220678, "uuid": "dacf04da-55ff-453a-a0f1-8366ab66ca04", "value": "Evil_Launcher_Beta-win_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0518542e-7d1c-11ed-9db1-42010a9c0080", "comment": "Malware payload (Quakbot)", "timestamp": 1671179481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671179481, "uuid": "738d970f-1302-42b2-895f-dcc446531b3d", "comment": "Malware payload (Quakbot)", "value": "b12686a3e0355dd7d9d12d58c868f13f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671179481, "uuid": "aab1a085-22b4-40f8-bcdb-3503587332a2", "comment": "Malware payload (Quakbot)", "value": "34dfe27f79b02fa4aaaf8fbca0e5c441d51ffdb7c4217ff518b8b7ecd77e35cc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671179481, "uuid": "aaf35fdf-6898-471c-85ec-fa859efe28ee", "comment": "Malware payload (Quakbot)", "value": "0e95e9a1511c318468ad007aba959a0c5f364392", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671179481, "uuid": "31aae33e-dfcf-4e0d-afa4-790d77d61375", "comment": "Malware payload (Quakbot)", "value": "e419330a22b9a16fbeeb2389c30942348c3144816a8048e5f0ed1e079192ce70f6c1be78c4ee49b6acca3bdd5f38ae88", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671179481, "uuid": "64c889ea-b46b-4352-912c-38bd2e1f4c72", "value": "T109F36C02A46343B2CA714034928A5F369A7E7713037F78DFA7D87B510911AB39A3B1B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671179481, "uuid": "afec34db-045c-4f1a-b761-d8cc1847907d", "value": "3072:Og6JwDxvvhrWYqfH5tQAuJmUbR3TBf1RVO/yaAv:xtvVvqP5tluJVbR3TBNRE/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671179481, "uuid": "510d75af-ac4a-45a3-983e-74593d8657f3", "value": 172032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671179481, "uuid": "0f3bd598-64b2-4c47-87fe-41d1645d7db5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671179481, "uuid": "ea1fcafe-4649-4bee-bb5f-c43cdfbc488e", "value": "SecuriteInfo.com.Variant.Cerbu.157892.22268.6510", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d711df60-7d72-11ed-9db1-42010a9c0080", "comment": "Malware payload (NanoCore)", "timestamp": 1671216770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671216770, "uuid": "5035eda4-f98a-4c6f-a5ac-62c359603ea2", "comment": "Malware payload (NanoCore)", "value": "d678db04e2904a91787b097d251db360", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671216770, "uuid": "6c7eeb97-6a4f-4c64-8271-6aac448d2a5c", "comment": "Malware payload (NanoCore)", "value": "34f450ec184c1382da4bfb8b23a01270e6786e2b3a94170ba530dd1899bfb32f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671216770, "uuid": "3f6f9daf-76ca-4380-b516-6b69105758bf", "comment": "Malware payload (NanoCore)", "value": "87fdd3f035d4f0531ade11e7c12e04f9218c1b3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671216770, "uuid": "24188716-9bb1-4c07-b5ce-20e683251555", "comment": "Malware payload (NanoCore)", "value": "7abeda8dc5148d137885dc3e287b676bb4b44f0325808f6aa4e8e1cc721599f19232f7098ec6dbca72d7b6b9de00578d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671216770, "uuid": "19c8eab7-059d-467f-be47-06d2d191df8c", "value": "T1F3254A1D9BCCE6B0EFD3BEF2066A6FD02A02EDD81E53A159493F719D0D30210F926965", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671216770, "uuid": "be53e9fd-478c-4417-a043-801f25b148a6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671216770, "uuid": "19d873d0-78f0-475a-b5d2-54054967a6a8", "value": "12288:DLPc8ujAuYXBspO+qWecaxdYbvvToO8KxXGia:D4tjA7XBsNRaXyv7oONgi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671216770, "uuid": "cde04ac2-d670-41c9-8a2a-fd29231148c0", "value": 996352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671216770, "uuid": "58298c26-cf97-4d03-b7ca-7401915f2b7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671216770, "uuid": "a5391e1d-46bd-4ab4-ad58-a1e10f4e4645", "value": "NEW ORDER 50708, 61062.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82f34316-7d77-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671218776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671218776, "uuid": "1bd15b56-ddc5-4d9a-a13e-b226e5bf1a8b", "comment": "Malware payload", "value": "8056480598898348435a05e573ff6bd6", "object_relation": "md5", "Tag": [ { "name": "82-115-223-141", "colour": "#6824B4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeEvilHunters", "colour": "#9F827E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671218776, "uuid": "c58ea631-af21-4f61-8e7e-85b136f4cf98", "comment": "Malware payload", "value": "363bc1e5872e24c7abf6ad2ff4d92aba0a348d541a000147d0d292592d955775", "object_relation": "sha256", "Tag": [ { "name": "82-115-223-141", "colour": "#6824B4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeEvilHunters", "colour": "#9F827E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671218776, "uuid": "d1bd0e9e-f28e-4648-9a9b-af8d43f01aa4", "comment": "Malware payload", "value": "451347eaa4908b9aab0d15ec99bd70e2c8ebc4f1", "object_relation": "sha1", "Tag": [ { "name": "82-115-223-141", "colour": "#6824B4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeEvilHunters", "colour": "#9F827E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671218776, "uuid": "f1b49bc3-4ca7-45db-92f6-6e8e74938e5b", "comment": "Malware payload", "value": "aec7d3650779a5b48731a9730ca0f5548b5c53a1102e828b368ab5dcbb5d1db00af63be0cb26f1f7a723760c25a253f6", "object_relation": "sha3-384", "Tag": [ { "name": "82-115-223-141", "colour": "#6824B4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeEvilHunters", "colour": "#9F827E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671218776, "uuid": "6621fae3-3705-45f7-8f75-d4c873d16cae", "value": "T1D9262392C0BF8CAEC96756B4C0CDD745772089141873ECAB2A0361D35AB7EB1D767B82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671218776, "uuid": "fa570115-0c84-496f-9c08-a0669d4f9d25", "value": "98304:Cu7dHMKjCxdCoMw+Cqz1FPIauJndbwVszTQ:CKHM64goMwfqb7uFR/TQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671218776, "uuid": "93c298ab-c517-423c-990b-92666a069b88", "value": 4445616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671218776, "uuid": "e4bd0e34-aa88-499c-a824-e710cb3d1c6e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671218776, "uuid": "fcef3fc2-8fec-4282-99cc-b225333d1990", "value": "Evil_Launcher_Beta-win_x64.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba5ee842-7d90-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671229607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671229607, "uuid": "1c5873a1-db29-43a0-8fef-707e94f3270e", "comment": "Malware payload", "value": "9333783b330dab3cd73af726d7c6f8d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671229607, "uuid": "64b1e0ca-e844-40be-afc1-bdec850b1b18", "comment": "Malware payload", "value": "36506437df42a495a4c22cef64d4532f3734e3eadf7b36af54da4879ae692624", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671229607, "uuid": "ba73a307-cd34-4a4a-9868-5303e50bca3f", "comment": "Malware payload", "value": "43f3540594456bfc742aea8cb970c31ebf6c2ee4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671229607, "uuid": "afad4dcd-e821-44ba-bed3-a7834fbe2774", "comment": "Malware payload", "value": "be28d1f7ee931014de32e89b4ed62cbe5701d1fbfa9fc11ac45b3b1dae17f0fcfad94f4470343480550c9883a69e2a3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671229607, "uuid": "57d8b7a9-518e-4b8e-8e28-f17f31a34153", "value": "T1D824ADF26690D87EC211DB308D1996E4A66BBD204E2299F3AB143B1F5D302D059FE33D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671229607, "uuid": "8653ea6c-6261-42aa-a658-ce1acfd8524f", "value": "aa9c378109186462717e17e657d0c833", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671229607, "uuid": "d985e431-4678-4c59-a211-4baba0e65a61", "value": "3072:TYB6clnKLCMASbRI2riO1CZwOCRMpKeW925T5ZFLsz5neX40zwUzQRKF+:UB9KLCMmwiO1VOCCpKCPgz5g40M2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671229607, "uuid": "fdcd6233-9460-4210-bd6a-7def1c98f94f", "value": 219136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671229607, "uuid": "aac51a1e-5155-4881-ade6-b50cc3303ede", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671229607, "uuid": "6c8d31e4-7a5f-4f4d-91aa-0691b62efe9b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c73b7e81-7d54-11ed-9db1-42010a9c0080", "comment": "Malware payload (AgentTesla)", "timestamp": 1671203859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671203859, "uuid": "6d9c3add-bcb1-4aea-b0e2-72abf48d97f4", "comment": "Malware payload (AgentTesla)", "value": "fbb25a7237d298e46bad3a05ac6830c2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671203859, "uuid": "56fa2201-2ddf-4cef-9df0-aca0ddcf58ae", "comment": "Malware payload (AgentTesla)", "value": "36e7dd656f73069c8c78ae8f100a746a6d48df103fa11739355c09f03e45b0bd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671203859, "uuid": "ae4df801-151b-4cd6-a4b3-47a8325b515c", "comment": "Malware payload (AgentTesla)", "value": "b40d1eebf725f49fefb6a92b2cd980b4ff927574", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671203859, "uuid": "6c9e366d-af3c-407b-a800-29a12b4f4053", "comment": "Malware payload (AgentTesla)", "value": "66b172665d15644acec3e4848dc512e03addb3a1f0a70c4c6158a458d5fa8d84055643840c09a8cabf2bc781f75fc68b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671203859, "uuid": "8411914d-043a-4615-b195-c6579888f08c", "value": "T12315A3DD726072DFC85BD462DEA82CA8FB5174BB871B5203902716ADEA4D897CF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671203859, "uuid": "c3a6c478-2c47-4ba1-b886-976adce76167", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671203859, "uuid": "0a846a94-7cc2-44df-b803-72c07e1f275d", "value": "12288:1xe3Zwm7ard+JbZcE1nxMLk/Zhmmk3NqQAfSa/n7OAMNjLKKfkLaoOwtfYdBLR8q:LeJwm7ai1rJ9r0XbgAuCIJC6i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671203859, "uuid": "a62cec42-4a2c-4722-ab65-722ed2e67b25", "value": 895488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671203859, "uuid": "1b6839d5-187b-4902-a5db-d06bc13a8e68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671203859, "uuid": "2931ee85-8fea-4240-a195-c94956770f30", "value": "Invoice #booking by sea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0efcb5ad-7d12-11ed-9db1-42010a9c0080", "comment": "Malware payload (AgentTesla)", "timestamp": 1671175203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671175203, "uuid": "f5917342-8e6c-4bf0-b24f-cef989fa2844", "comment": "Malware payload (AgentTesla)", "value": "f6c1d16f884d097005b619738cc7067c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671175203, "uuid": "a3b4d1a0-4388-4b75-917d-49913bcb13ac", "comment": "Malware payload (AgentTesla)", "value": "3805a0d8d5c31e2f0a26230bfbe046b71da707cec6047cfad58aa7fc76de8c36", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671175203, "uuid": "f6a562d8-2510-4a42-a32e-56604e27da4e", "comment": "Malware payload (AgentTesla)", "value": "b82a3ae3d17522605695d8a129aa9a12b460d98a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671175203, "uuid": "5c27871e-cfd4-492e-b55d-7157de1199ca", "comment": "Malware payload (AgentTesla)", "value": "2e9e82d129b01ededfe8a95bc72cb078c6b5f1eeb666d5d59febfa239cdd162eb54ce0de16157e2d108d7fdae2d68386", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671175203, "uuid": "fbcf84d0-a2c4-4fe1-ba89-8bf13032db0d", "value": "T16115D83C8CEB0626E1B2C1B7DBF34D1BB019BC12318598A46597376613AAD1DB48BD3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671175203, "uuid": "08d4349f-7ac0-488b-b216-11ae0f5e8786", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671175203, "uuid": "e68f2ab3-d9e8-4b3e-95a2-e943f2881653", "value": "12288:2U2iNdgh/vG+BZg3HMOGhMoQRb0otLToBLgDc9z/Hc:D1Pgh/aHMlhMTGSYSD6/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671175203, "uuid": "ac917a2d-0d28-4ce7-9965-3cf139dff690", "value": 941056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671175203, "uuid": "9128c520-19db-4409-8722-cfe5cf59341c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671175203, "uuid": "9f52f85a-66e1-4d7e-82f0-9c14598738d1", "value": "SOA's.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88dcf3b1-7d53-11ed-9db1-42010a9c0080", "comment": "Malware payload (AgentTesla)", "timestamp": 1671203325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671203325, "uuid": "4391c242-f1c6-4ff2-9bbb-615352130b17", "comment": "Malware payload (AgentTesla)", "value": "de8ca2ee46700c2b8d661312abfa3a74", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671203325, "uuid": "931bea2a-d8b2-4666-8b8f-424274b380b4", "comment": "Malware payload (AgentTesla)", "value": "3a0e6a37cd71e91d60a1a3e63e6af6f320885071c0691744502883172a52b1e7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671203325, "uuid": "653e0d94-3a70-49ee-a146-c9f6d784b241", "comment": "Malware payload (AgentTesla)", "value": "949aca4504e11d55578e02152f2a25ebd88b05c1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671203325, "uuid": "3c4901ef-f1a3-4cc8-9740-0fdaf14c3cca", "comment": "Malware payload (AgentTesla)", "value": "871ca639e2320ea1114b0a286cf22cbcbcc39e151a6ffb3de2ddcf3a9c45e0720989fcdcbf77589f1e2fa3cfba4c2f89", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671203325, "uuid": "48fafae7-929a-48f7-bed4-ef44b8b195a0", "value": "T1D0742318E614B696EB5D76B41E3076EBD3FE45DE684CF0ECA5D85860C2315321A8F133", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671203325, "uuid": "c82c01ef-9cdb-4b8c-9e8b-2f15e1f33435", "value": "6144:Mki/eo+T/cZYvYCP62ht9bdxmtvAAHPr6/Qm8I+gijOyMIuzAjmijJ1:VoXZYvNP6qy7ro8Ih6M8jmijJ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671203325, "uuid": "3967117d-8bba-4069-8198-57987c00a255", "value": 352856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671203325, "uuid": "da341083-70c7-48c4-874d-6720949bed39", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671203325, "uuid": "27283549-d0d0-4ea9-9abd-4164aca9b8f1", "value": "DOCUMENT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32ebb4ef-7d2e-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671187289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671187289, "uuid": "9bbfa452-e102-4797-a8cc-5d5929cc9b58", "comment": "Malware payload (Smoke Loader)", "value": "80df48857b30a736eac233d0e0df2235", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671187289, "uuid": "cafb3b99-22ad-4e31-9ab8-e1e945be08a7", "comment": "Malware payload (Smoke Loader)", "value": "3a50214db19080eee51c0fa74810b027b3ac9f5bb96f1de8a560b6f5d1db574c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671187289, "uuid": "6592304f-75dd-4cae-9225-6253657a79ee", "comment": "Malware payload (Smoke Loader)", "value": "ed84e73ab17a73b4fbdcc4e16035479406ed81f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671187289, "uuid": "90637f20-cb47-4307-ae49-4dbe9f56b9b2", "comment": "Malware payload (Smoke Loader)", "value": "8fda1d869877067db89f89d2329affa5cf6370aa2912613466e955f1c100857aae642d89481b28a62d1d29463626abae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671187289, "uuid": "2bc4a1eb-2151-4d72-97dd-520ebd9a3059", "value": "T12734CF11B2A1C471C14F0A308969C7E12A7EED324A71AA6B37753BEF6E30A50567F31D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671187289, "uuid": "fd80dfae-bf4e-4762-a32d-6e50e49aaba5", "value": "915ad03d5b3522248c2c91d75d5158ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671187289, "uuid": "35209361-3d7d-4897-ae7e-06d6be41bae0", "value": "3072:VYhhTZML+11RcRyx1AHUDrH0KKssQTwfW1LQ2mppGT8mrcqbVXHtWqMPDcfuf:uhhCL+11lz0fWiterx38qMrc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671187289, "uuid": "a071d076-842e-4ef5-8615-f81d4c9ad912", "value": 233472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671187289, "uuid": "96b50730-2d52-4453-83f9-c9bc24f98305", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671187289, "uuid": "ff1fe28e-b2e2-4a64-a647-c1d24b753c63", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b4371fd-7d48-11ed-9db1-42010a9c0080", "comment": "Malware payload (GCleaner)", "timestamp": 1671198416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671198416, "uuid": "379f7b0f-b57d-4715-9848-8ea2827ba1a4", "comment": "Malware payload (GCleaner)", "value": "bda3651ace7994dea47e2b202bfc36ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671198416, "uuid": "a1f9b201-2241-4662-bf1e-65671380b090", "comment": "Malware payload (GCleaner)", "value": "3b0c3294f3eae2237d0c959d8fcbc10932173f358d3e59e7e5f6c6c978c0be08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671198416, "uuid": "8f5c8e3f-3b62-434a-bbcd-2b0f5376c380", "comment": "Malware payload (GCleaner)", "value": "70cddbec3307940b21b703a955ffdc14d70f67e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671198416, "uuid": "b1feb3b5-f0ad-4519-b41c-6bd0d9f43d4c", "comment": "Malware payload (GCleaner)", "value": "771eaecb5b776ae3f4eb02db9e5fe8a8afadc86365eda134868a036a0422ca092dffd366ad65159c78009378a9de7af2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671198416, "uuid": "bb8fe952-146b-40bc-9e04-cae940fcda02", "value": "T106B5237F9C901571D0B745F93867CC264AE67D272A29D89D33C97EAB77F3AC10A01206", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671198416, "uuid": "21b3b44f-57a0-4af6-97e5-769575f8ed97", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671198416, "uuid": "a65e13f8-4e04-40a5-861d-692649cef97d", "value": "49152:4pFqhUHfFUtWIP1k5XUpcLpTolBLBO1vSYdqWp1eOCgSY/imo:4pvtDdcsp0uSY7p1cY/imo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671198416, "uuid": "ed80a8ad-1bcb-455b-8e16-9abe2fe6ca10", "value": 2460176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671198416, "uuid": "c42cf904-1b70-42c0-b042-5d8e383093ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671198416, "uuid": "39f443a6-ae37-4801-a92c-12d246202b7b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "105c4f7e-7d1e-11ed-9db1-42010a9c0080", "comment": "Malware payload (GCleaner)", "timestamp": 1671180359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671180359, "uuid": "2ac10cd4-0073-4e10-af89-ff1a9c50e16d", "comment": "Malware payload (GCleaner)", "value": "dff8225c1a1a9b96254e9790e2ac5de9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671180359, "uuid": "f8ed8b24-e159-456d-af34-913d466cb624", "comment": "Malware payload (GCleaner)", "value": "3b0d8baaad8aac3a01564938f854ba6721394122d8fc95510aec38ae7a9d2318", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671180359, "uuid": "261582fb-ece7-42c7-94cd-e1f4826f9ed3", "comment": "Malware payload (GCleaner)", "value": "f5bc189d3ce363830644dd2ca5f989833bc71fea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671180359, "uuid": "5c911971-5118-4d29-9b9a-90fddd847939", "comment": "Malware payload (GCleaner)", "value": "031b35c59ca15c417b7898889a64b955c310d7fe8a17fe89be1daed95e9aa64a58d489882ab7ad6f84b2bf488a6de4ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671180359, "uuid": "97afe6f1-d175-4238-9a8a-879b928aebc6", "value": "T17DB523BBD5005575C1B346F934328D225AF76D2B7D35D94E3BA83E8B7BFAAC00909206", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671180359, "uuid": "7003f84c-0afe-4325-8aca-40404af4134b", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671180359, "uuid": "c1274359-9e6b-4759-a9d7-ea43d2fcc146", "value": "49152:MprNOsK9+THgWEAZ+9ypi6jfp/ARlIlzgATk+iRyVpp0eOCgSY/imX:MpJrHC8RiSElyNo+G6qcY/imX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671180359, "uuid": "0029b8ea-e0c6-47cd-a108-b617ba158768", "value": 2423925, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671180359, "uuid": "46f3729e-8ce1-4a00-bba9-d62d8d5d817e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671180359, "uuid": "ecc88115-87ed-43a5-b577-7782b647ddcf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad5de337-7cf1-11ed-9db1-42010a9c0080", "comment": "Malware payload (AgentTesla)", "timestamp": 1671161295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671161295, "uuid": "1cf9af93-b6c8-4c10-a6b9-b5ffb26229e2", "comment": "Malware payload (AgentTesla)", "value": "2933e4dfa72997568b99a23db201b5c9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671161295, "uuid": "fdb5f441-13f5-469c-83fc-04d513929d0e", "comment": "Malware payload (AgentTesla)", "value": "3ce0bc89c88016dc1bfb42429f6468d5d56071c2ec32310029347247043044c7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671161295, "uuid": "139e8e5e-bb86-48dc-93a9-0c924f6b8ac1", "comment": "Malware payload (AgentTesla)", "value": "08cde7a9f0385b795d7ba8d4ddaa553f8372290f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671161295, "uuid": "6948a669-0412-4d2b-a6a0-9d9d37d68d6f", "comment": "Malware payload (AgentTesla)", "value": "2d2e28c1f727b60f2af09395068ea3ef0f05105f1a1ec7a8e0b7ef746d3647c9373cf97d93c1ea2c4b5ce7224976dbd9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671161295, "uuid": "5f59ba3d-a60c-4f73-9356-49e41d6166bb", "value": "T1BD45389D31907D9EC943CEF28A407CB0A95337AE538FD6378D670E9C890D65ADE041EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671161295, "uuid": "cd20ff78-f9f2-4b15-995c-c4d096ef8925", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671161295, "uuid": "0219bd78-d62c-4b74-a632-fc1dc44eed5c", "value": "24576:FA/w+F9y07/j3Xs5rhpOl4LCiJmvwF5Vu5HQ6:qvF/sOl4WiIIF5k5w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671161295, "uuid": "13a1394b-71c4-4010-ba10-efddfb98b3bd", "value": 1168384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671161295, "uuid": "0a8f9283-8dc1-47af-b838-80afca0a717c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671161295, "uuid": "756446de-e160-4172-89d8-800d875e2bbb", "value": "SecuriteInfo.com.W32.MSIL_Kryptik.IKV.gen.Eldorado.2576.15728", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffd61fe8-7d8c-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671228005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671228005, "uuid": "6cc921fd-6c99-4c87-a6f0-2572e6f60aea", "comment": "Malware payload", "value": "257b1bc7e9ab8e0d92db5beb8b847621", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671228005, "uuid": "bf7d99df-5cf4-42eb-986d-ea2032c2f61b", "comment": "Malware payload", "value": "3d8662bb3bc999ca1de039b8152789a2412e6dfa00cd061e4bc7820ae2751cae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671228005, "uuid": "c5027327-e645-4504-858a-b227d83a6a9b", "comment": "Malware payload", "value": "18d58b0bdb8b179ff9e17b9c583d24e2150d2394", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671228005, "uuid": "329ffdd2-301d-4582-8eb7-eb384d6ddc0b", "comment": "Malware payload", "value": "b4f894514f588981a31f471b06999c357f68d07a523d5dfdccc9df0b65b665a301e0c9c7ce6b1303b0c6907433693e78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671228005, "uuid": "55199114-2f30-4359-8a35-647e87dc2f59", "value": "T1ADA3CF323640C472C45364359829C6E26B7BB4351ABADC83BB96477F8B313D2B27934E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671228005, "uuid": "6038f3a6-9eab-4408-aa02-799d97c61b94", "value": "aa9c378109186462717e17e657d0c833", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671228005, "uuid": "2a04d848-e303-438e-9dc6-954896988785", "value": "1536:tkzlh3mj4L6CcH8jTYrUZaSbR8NBNjhWsFTwxZlqsFsQN:tkzlh3JLKqcSbRozTS3F1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671228005, "uuid": "2acf9705-f80f-4186-a7ed-1181c2d2b252", "value": 97960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671228005, "uuid": "2f065a64-dd9f-4d69-9729-c2aba8cd7b9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671228005, "uuid": "4de42858-0ad1-4031-92df-1dfc4a1a3b56", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43d9dee5-7d48-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671198484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671198484, "uuid": "9304cc8e-1a8f-4105-b590-eba1b2ee4b8d", "comment": "Malware payload", "value": "81cfd5c32bda3116a509249a03efa6e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671198484, "uuid": "a8d8a42c-08fd-44d5-9e86-e4dc1e24d594", "comment": "Malware payload", "value": "3ea36baaa6ecf3104af85a12e7817fac4111951db74d4975b8f108a91c32eb2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671198484, "uuid": "1f212885-75ea-46fd-a0e4-820501780676", "comment": "Malware payload", "value": "ae48621ff8a03d751e2636ca77305cd8a704e8c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671198484, "uuid": "4d70ae0f-ef2b-4b34-ab5c-30652381d566", "comment": "Malware payload", "value": "0b360784d7d502dccf07ff9da3cd9a919e44342a537f692590628ff900d0fe35c258448410ac5297a459e751ae1e412d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671198484, "uuid": "17eb2d4f-bd61-4dc4-809e-5dc0b178b1e7", "value": "T1ADE3D0223B90E479C10264714C1AE7E1773FE8251B6389C3BF5D6B2F4E742D2A67634A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671198484, "uuid": "72bfd0d4-15cb-476b-a519-732bdc91bd6c", "value": "2cc3e4b8a374ca30888470c0a531eceb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671198484, "uuid": "b4b54556-5a8d-4bda-b945-1004aac0eb5c", "value": "3072:Rl3uK5L+kyTpSRXn2q/9lD6TIfj0i9msdgvmcLszM:H3TLdyTY2qFlD21iUsdgucgzM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671198484, "uuid": "4d352314-41a1-4eb8-9a07-574d9f8c73ff", "value": 148552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671198484, "uuid": "0baba97a-28f1-4363-8312-0194abe965b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671198484, "uuid": "3f001e0a-e81e-4a63-84ed-eddac56b1e66", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff301e14-7d7f-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671222421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671222421, "uuid": "c7690f24-a652-476d-b72f-e66e7b734f73", "comment": "Malware payload", "value": "8cbc8b195b26e122ecc044adc019d8f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeEvilHunters", "colour": "#9F827E", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671222421, "uuid": "d0aec121-e531-4938-96da-624b76378baa", "comment": "Malware payload", "value": "3f35b6ded8955c30510921864c07996c654f17ca66badb1f98d0471ce3ea64c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeEvilHunters", "colour": "#9F827E", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671222421, "uuid": "d4d8eed4-b42b-4f55-942f-5ae051b858f5", "comment": "Malware payload", "value": "392fce194affcc12b086bf5480dee1ea9fac6d6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeEvilHunters", "colour": "#9F827E", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671222421, "uuid": "cd5f45e1-6964-42be-af64-275fc894b91e", "comment": "Malware payload", "value": "91aee6cb3025dad12b63cdc8c6ef74583f5a0c14b4195bee4938aeef686823ec923c3f99c8f76cad3e41ffa382d38bb9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeEvilHunters", "colour": "#9F827E", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671222421, "uuid": "97432c17-fd30-4aba-982e-9167ac5915bd", "value": "T125D43771E088BCC6C41718F99D39E6A4115BFF9A157C8A043A37B61E947A7E23062F4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671222421, "uuid": "8447d358-d6be-4d53-bb80-134624d93314", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671222421, "uuid": "d577a468-2e55-472a-b31f-e6c15509c0aa", "value": "3072:rpGv/0ybIaKlifbwbWieKWqmCn9080CSeSPOtR8Y:rpc/0ybIlMbwbWiezqmCn90nPO38", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671222421, "uuid": "5dba05e0-e63e-4249-80da-6fbe75e750ab", "value": 627200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671222421, "uuid": "a8e18fba-4e81-4c23-a4e0-cfce5ab0eb28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671222421, "uuid": "2d876fe8-7c25-4a54-96b8-d259e6bd5ef3", "value": "Evil Hunters Gameplay.mp4.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75561a53-7d6f-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671215318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671215318, "uuid": "b5482d9a-a4de-44bc-a004-8bce3fdbf255", "comment": "Malware payload", "value": "0b29f48f33fa89ccc1fc7494cc058176", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671215318, "uuid": "3fc29937-3fc0-4814-bfe5-e94e3028dde2", "comment": "Malware payload", "value": "3f44abd5b41ac34d032bdf07b2cc03fb5523f76d1a924d1929c55f77c1cf12a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671215318, "uuid": "ec276158-fe61-49c1-93fc-4bab5afc10c3", "comment": "Malware payload", "value": "9d87fe27bd53762ba19cafda42e97352948dad9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671215318, "uuid": "c357ba63-39dd-4dd9-bd67-fc6063de4251", "comment": "Malware payload", "value": "ace54e9ce99a00518da5dfc2f4246170f35b2a01d87cd6c4b96ee94ab4762594adaa2a29ee49a6c1a0bd970b2eab26f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671215318, "uuid": "3bd1eca6-0c6c-4b14-bae6-07320a3f4d1c", "value": "T11C952301F9E4C8B2E16209371D6D5B81757C7E202E24CA6BF3D8AF6DDE301D16631AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671215318, "uuid": "111fdea3-9d2c-488a-baa5-a451d0a270cd", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671215318, "uuid": "071bcdee-b124-4bbb-bf94-df7a9528f552", "value": "24576:0NA3R5drX/WGKc5RCYx7oH2Lt6tr0SCb/QkX+eItld0YMEaZDnlSEv82iF4vOabE:V5ORm7oH2LtkMPX+5WYMEaSN2knJB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671215318, "uuid": "95e871d2-432a-496d-a0e3-275c77f3066e", "value": 1899177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671215318, "uuid": "ec474fb1-3275-4f7e-aeb7-0bf246dbddb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671215318, "uuid": "9c84b782-ae00-41fc-aab1-8fea86083893", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aebad5bd-7ce7-11ed-9db1-42010a9c0080", "comment": "Malware payload (GCleaner)", "timestamp": 1671157002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671157002, "uuid": "4ea3e451-6b49-4e76-95d9-969620370ab9", "comment": "Malware payload (GCleaner)", "value": "06bb53708920954aefa9f5f016360f4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671157002, "uuid": "72b6a45a-cd22-480c-ae43-c2b244f3487f", "comment": "Malware payload (GCleaner)", "value": "40e361b33de3c52680033c19d547df052a019a6ef12be362a443b73d926d0609", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671157002, "uuid": "84c65840-638e-4744-9e8d-072306678b77", "comment": "Malware payload (GCleaner)", "value": "0f58c530ce2a7da9f5806b221156f1691328fe3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671157002, "uuid": "2755600e-366d-4eca-abe1-a0ee769dbff3", "comment": "Malware payload (GCleaner)", "value": "a61c12c8868a7391c7c50839a8a1fd399790c42c5a30cbbef2cf478e859afb069eadd467ba56724b5dcdce50d10a3f5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671157002, "uuid": "f9eb4127-30bb-4e2f-a83d-c5f09b6630dc", "value": "T13EB523C1F09561B8DC9DDAF01819914D9A57FEBFFC26D01A30F077ED9A3A2D1C822A52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671157002, "uuid": "bf5629c3-722b-48a7-853c-682a658863d4", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671157002, "uuid": "78ca5dbd-67bd-4f7b-a1a9-511edfa0b832", "value": "49152:kNur/rssTJA3Lgi+Bv07BXDqO3prs3k1T+rzmg1qeOCgSY/m:kNy/rjogiEKJDqCmNHmHcY/m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671157002, "uuid": "ab7f0b13-6b9c-45d9-9c03-3f0883f6bb68", "value": 2383160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671157002, "uuid": "95742ff6-c6b6-4dc5-a4ff-ef22afb0915f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671157002, "uuid": "17d2334f-6096-49e1-a1cb-6e460c28f0b7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcace5dd-7d4e-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671201264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201264, "uuid": "a3fe91e2-0beb-4221-8ef4-59cdc94ec988", "comment": "Malware payload", "value": "e00a8ecde46559e1dcb068be14012c8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201264, "uuid": "bc8c5a32-a022-4be6-9b4a-39ffa24400a6", "comment": "Malware payload", "value": "4200b1d7f10ecde80a7ac28c5090bd380a87100bc0d1f367893de2e2a490a9d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201264, "uuid": "a63cd675-7354-494c-ba36-6b2b4b6abbb6", "comment": "Malware payload", "value": "59986cb0d2d4705c0855c7aa86d558d5bd5a461c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201264, "uuid": "fbeedd18-1a33-462f-85fc-2d1998fffa6e", "comment": "Malware payload", "value": "5f6603861b34901c96ef3f58ddcb71f63fe702e1109e1aae4213921323ab2b82dfba0aea98a760a2b490100973fc7fa2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671201264, "uuid": "ecdc3dc1-918a-4a54-a884-a6ad5d827ae7", "value": "T18FC1DD416EEE50CAF237073167DAB7BB11A6F5B1492E72B8718449999F31A84CC21EF0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671201264, "uuid": "27abd397-f0ea-4660-ac46-a352dfa5d57d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671201264, "uuid": "d0e4a346-5726-4228-bf86-5f004a18ebd3", "value": "96:q79ULL1bhycG8WmaiO8YtNnxJ5A6tMNtUqkkbz5FQgL/d3ojBrl:s9ULL1bhyc48INnxJ5BaNtUqkkbz7D/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671201264, "uuid": "09777949-1800-41d9-b226-2c90c3793ab2", "value": 6144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671201264, "uuid": "e30bc7ea-6cc3-4647-b418-e04ed211aad3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671201264, "uuid": "aae1400a-ba30-43b6-aebb-763063fbb6a2", "value": "asdsa12312314.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eefc709-7cdf-11ed-9db1-42010a9c0080", "comment": "Malware payload (GCleaner)", "timestamp": 1671153406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671153406, "uuid": "a293a23a-49a7-4972-b352-cac5b951c75e", "comment": "Malware payload (GCleaner)", "value": "e09c3d791b98a01b2fe9561a0b80c895", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671153406, "uuid": "efb23f6d-2441-4a90-b549-3f49324d4df4", "comment": "Malware payload (GCleaner)", "value": "43796154071311bac54328a44f066225d1cb2317901faaf8cb8d51edcca4c3b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671153406, "uuid": "f0341214-c933-4206-892f-cd1c66692617", "comment": "Malware payload (GCleaner)", "value": "03501915af3ed2e45bf9d15df145b72d30875770", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671153406, "uuid": "5e525986-81bd-4650-a3d3-065782930232", "comment": "Malware payload (GCleaner)", "value": "51daf17d7a4e2e3318a250513bb434cc77362d782a7cd2dbba7fa3c657374d9286dc1cfd1d4ddd738cee4eb01557cd90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671153406, "uuid": "91013701-cce3-4bd2-aeab-9a8286f552cc", "value": "T16FB523C3FA9156BCEDACC5B14C26505C6666FEB6A8A1C09D30D8B79E1F372C2D612702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671153406, "uuid": "f51a44da-67dd-4f05-b4c2-d49b8dd15c62", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671153406, "uuid": "62e8b107-5db7-4fd0-b407-6e79c015d477", "value": "49152:ANur/SztDjudldEJn2cS2lv9t/2kLNoZ6akTWpWsHc5GL+sBeOCgSY/p:ANy/SZ/udlaJn2cb9t/2kZfhKpjXL+uB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671153406, "uuid": "5baee393-7081-4b62-a937-c8885a972edf", "value": 2379332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671153406, "uuid": "76fff850-9dbd-4ee6-93b6-d514fcb63866", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671153406, "uuid": "b1e764b0-f5ac-41dd-9dbf-7f9c4abf7c40", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e1dc2e2-7d99-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671233425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671233425, "uuid": "32b0af50-b377-4e11-9ce5-1103c201237a", "comment": "Malware payload", "value": "6f9b38caaf2c2ef5758097d1b089d954", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671233425, "uuid": "bea359c1-b845-40a1-9bba-567d3e08b027", "comment": "Malware payload", "value": "441be9004522830564a156d3fc39b8cfd8fd93db2cd6559d7d7659e87b59d6e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671233425, "uuid": "af4f653a-07af-4c63-8bf9-ab37c00c99b8", "comment": "Malware payload", "value": "357779d09c489bf9c1aeb51b5fcaf0293008e33c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671233425, "uuid": "6166af3e-d511-4e64-8c7d-05e0c3d1a36e", "comment": "Malware payload", "value": "666439b8bae55b6a9a41aedd7e6ff792048e1b79a8a4c9931137fae7896290f262c76b6cc47e0a564003258864153094", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671233425, "uuid": "8f830fbb-954c-4499-987f-4b65ddc8aa98", "value": "T17324BFF13691E47ED141C7318D26D6E5AA26BE244A2159F32B0436AF2D312C05AFE37E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671233425, "uuid": "e2f2bafd-f859-4615-b903-ca2f7267d1bd", "value": "aa9c378109186462717e17e657d0c833", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671233425, "uuid": "fe9e0b5a-b1a8-4c6c-be4f-f8f9343c653d", "value": "3072:a/b0yPBLk+WaSbRa3ka8CF4qNO6pL3/tBXLszWZn6+s40zwUzQRKF+:QPBLk+Wa3UgcMbgzgW40M2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671233425, "uuid": "47645688-d54d-4aa0-b32e-ab07243426d1", "value": 219136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671233425, "uuid": "186f7710-531d-4b18-bd03-4d59941396c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671233425, "uuid": "0012d3cc-9006-4d09-987e-dc8b0e56d446", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fac35222-7d52-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671203086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671203086, "uuid": "e2c61b4f-f020-4629-90fa-f89b80dde688", "comment": "Malware payload (Smoke Loader)", "value": "6632bde0010f6c019c5fe4ea25d468fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671203086, "uuid": "5e0bb110-c461-47f4-8937-4d1b491207b6", "comment": "Malware payload (Smoke Loader)", "value": "447644b6abc3b5b1430324210c4ef5e6a9feb775361dc6993ffd0c0ff904b0f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671203086, "uuid": "82817177-610c-4482-8a18-a4ae0098be59", "comment": "Malware payload (Smoke Loader)", "value": "a84c3884bd000c0ba79f82ca76c9599c1c89f556", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671203086, "uuid": "dfd4f2e5-b9f7-4d4b-b36a-1514eaeb3573", "comment": "Malware payload (Smoke Loader)", "value": "039775ac9979dd9312031ae4247288dad2aa238245470e9230a6851eff9f30b67624cb661617e8fe012a6fb3922853f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671203086, "uuid": "f5943a95-00cc-481e-94b1-adced1d2f80e", "value": "T19124BEF13290E86EC152DB308C15D6D5A67ABD118B225AFB3B18266F1D306C056FE37E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671203086, "uuid": "3481953f-d9dc-43ee-9ff9-e177657f162d", "value": "2cc3e4b8a374ca30888470c0a531eceb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671203086, "uuid": "8db49adc-3367-4b98-b1e8-5df443473e3f", "value": "3072:xIM8y2SL1rW0FSR6jPjh3/nyXddZ3e7811LszwgCI40zwUzQRKF+:f8gLVWI3vytz3e787gzwgB40M2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671203086, "uuid": "eea6f2fd-0e8d-4b02-8dec-8bd83eaa3bb5", "value": 218624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671203086, "uuid": "8fc2af16-3924-4e26-8bbb-09d6f9063a49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671203086, "uuid": "d0143ab4-edb3-4c6b-b1f8-42189dbe2af8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32bbeb05-7d4e-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671201033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201033, "uuid": "b2badbc6-15f0-495a-b211-b547c2c71404", "comment": "Malware payload", "value": "c1f85f7e2b152853592d3ed8625eab34", "object_relation": "md5", "Tag": [ { "name": "45-153-241-207", "colour": "#86D11B", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FakeGaliXCity", "colour": "#607CCC", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SpaceCity", "colour": "#5EBE6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201033, "uuid": "359d2653-8bc5-418b-9b67-9fd213d3b1be", "comment": "Malware payload", "value": "45c3def87b7c9a748044bc2384ae52de40b83c401c39d0c3074af8ceff55961d", "object_relation": "sha256", "Tag": [ { "name": "45-153-241-207", "colour": "#86D11B", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FakeGaliXCity", "colour": "#607CCC", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SpaceCity", "colour": "#5EBE6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201033, "uuid": "9df9bbd4-0e35-4e16-a333-ede029d77b8e", "comment": "Malware payload", "value": "56e508cd298c1b158518e71af7f0d057b9c504cb", "object_relation": "sha1", "Tag": [ { "name": "45-153-241-207", "colour": "#86D11B", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FakeGaliXCity", "colour": "#607CCC", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SpaceCity", "colour": "#5EBE6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201033, "uuid": "d3f6da70-d31a-49db-bf2e-7acaf23643c9", "comment": "Malware payload", "value": "6fc992e2896c439a0d0b7f8f2e2880008f9342c672966b8790c5f1b916f476e903d72a7957cb2a1e50bf66fb86c6d1d1", "object_relation": "sha3-384", "Tag": [ { "name": "45-153-241-207", "colour": "#86D11B", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FakeGaliXCity", "colour": "#607CCC", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SpaceCity", "colour": "#5EBE6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671201033, "uuid": "1df904da-fe28-4d86-a569-171a760d45cc", "value": "T14A21EE727453F247DAB01415887E3701770EF9077D905D4AA2B4B8E4F8C24869A183DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671201033, "uuid": "deb3aed9-ddb1-4588-bc36-b3acd7cab4d2", "value": "24:7xXOowJlURzKghCqhJoV7ccV3M/9um1B+Vl9RZLDltUgt6LH9:pOoklUR2gwq7oV7n+lfn+JL/ltUgt8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671201033, "uuid": "691bd080-e8be-4ba1-8ffd-da502ed5e0a2", "value": 1338, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671201033, "uuid": "ae3bea55-cbb5-4838-9a2d-21cd0e2ab67b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671201033, "uuid": "a6e87fa1-d88b-4152-989a-e9cdbd829078", "value": "C6YA3FER.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf6e66ab-7d56-11ed-9db1-42010a9c0080", "comment": "Malware payload (RedLineStealer)", "timestamp": 1671204731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671204731, "uuid": "8d8b8cee-6e06-4c34-8b46-22cbe0273f25", "comment": "Malware payload (RedLineStealer)", "value": "d353f7236f28b805936850f9c9f573dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671204731, "uuid": "5cc14d73-b309-446e-995d-9cf481eee339", "comment": "Malware payload (RedLineStealer)", "value": "4609205883b4c64ef9d55e2efa4ae862b32d3bad5f1fe77225833be3ba877da7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671204731, "uuid": "e40bb08c-4882-47da-84f3-57f28df533a3", "comment": "Malware payload (RedLineStealer)", "value": "31e53dc0c6a8efde361eec0d16813cb9485f93ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671204731, "uuid": "991d17a5-6f2c-4fa0-afb0-fa57c7f5ea23", "comment": "Malware payload (RedLineStealer)", "value": "34703b1e1af2e0bd2f8898d1265a8a9f321e3d4ebbf224547e5f6d9b066c1ab7bb8e2c355b88f1da263bd510fa00fabc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671204731, "uuid": "f2932df2-59c3-4e64-9e60-f392460d4e40", "value": "T10574E0F53390D46EC112DB30A915E7E4663AB8505F6296F33A04362F5A706C1A9FE33E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671204731, "uuid": "5e53c1e7-95a0-48b9-bcf4-85433ad4e248", "value": "2cc3e4b8a374ca30888470c0a531eceb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671204731, "uuid": "1883be37-cc1e-4ff4-b698-8f6290122dbb", "value": "6144:rELAf6is7NRWWxK38yQiYu+3rMk7cgKs42+cnUMBiwgziQaM40M2b:rEsCis7Ll+VcR7cmDIZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671204731, "uuid": "6ce92793-a50d-4b1b-9ae3-ed7648c1d918", "value": 342016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671204731, "uuid": "d9bb665b-9674-4d79-bdc5-310d349a07a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671204731, "uuid": "f9a01b07-bbe3-45a9-a26d-c827fd311c3b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b6eed53-7d4e-11ed-9db1-42010a9c0080", "comment": "Malware payload (GCleaner)", "timestamp": 1671201020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201020, "uuid": "96756e34-8e9f-4c9c-b091-25b1396043a1", "comment": "Malware payload (GCleaner)", "value": "c6ee6ef9bfcfe3be49143ddbe79efabe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201020, "uuid": "dbe2c7b6-d619-4e77-9c07-847da01afc70", "comment": "Malware payload (GCleaner)", "value": "4627171faa070347a38103f023279f2254e234a7f4ddad57bfe0c2f6ecaf9a76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201020, "uuid": "8740c4e2-8015-4140-977b-c9afff529671", "comment": "Malware payload (GCleaner)", "value": "ec9515b043c9ce4ebfecf53846beb157571bcbea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201020, "uuid": "4f47fced-3f29-4f29-8064-b2fd81c33d06", "comment": "Malware payload (GCleaner)", "value": "acb6233bae21662735e57c74de635ff718c4f780c0c79e47476efec8f7dd129a29741b2a005ff9fc641717103358193e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671201020, "uuid": "33a06c3e-8811-4dea-af7d-7d4037764c87", "value": "T164C5237EB54811B2D0F307F83931CD6298EB2E5B2A25C59D37897ECBB7F29C14825246", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671201020, "uuid": "8e9562b2-b952-449b-9d58-ada37328fdea", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671201020, "uuid": "c2d61d13-c6ef-4175-af66-b64d71d188d4", "value": "49152:4pi8SIH7GLXzhd6E3wufFwblz3VmxKO45JL0nhYJGKUp72g/PeOCgSY/imz:4p0YYXddrwufylzHOOpah51ncY/imz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671201020, "uuid": "c16b8d6e-fce1-4007-977e-fc75eac469ff", "value": 2586790, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671201020, "uuid": "dbef322d-2a72-497f-8226-6c272977d13f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671201020, "uuid": "f09f285b-a500-400a-bc9a-52088fd452de", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "584827c4-7d50-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671201955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201955, "uuid": "b2da4960-6e27-4be1-a06b-02d4fc59a732", "comment": "Malware payload", "value": "a89b5fcc7e3425836043f02d4029dbf9", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201955, "uuid": "2a929526-7e4a-49d1-9446-f722cf71f6d3", "comment": "Malware payload", "value": "469b8911fd1ae2ded8532a50e9e66b8d54820c18ccdba49d7a38850d6af54475", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201955, "uuid": "95ac252e-da09-4968-9c4b-e893a4882385", "comment": "Malware payload", "value": "79cea3a004a373c3b6a3835ca5f512a138e7caad", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201955, "uuid": "58617b5f-ab88-4716-8918-ea3b45e9fa51", "comment": "Malware payload", "value": "6e55696ef3528f623a0276da3e396e952693f2ccac4d315ab994e899f998757c77053df27fe38ba352127e42d70723d7", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671201955, "uuid": "54fcf239-3da5-4afe-b03c-be177818adfa", "value": "T19B46333026F8834B3CEDF785142A81C440AFB0196D2E59B58E4367F9F2DCADD9593DA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671201955, "uuid": "5cb43e96-f962-4711-af82-debff233c1e4", "value": "98304:pb2C8SHZZkhbyKHsWrEkjKwfLonr4cdUZZKtMS2omQ7HcEt0C2FZP0AfJzeC5834:VHObyKHP1mZr4sUfWmQ78u2n02n583fw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671201955, "uuid": "a0c50cc2-d410-4772-ac7f-268c793b6ca5", "value": 5504026, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671201955, "uuid": "d8f562a8-2b3b-4c35-af31-15b9cd8a9884", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671201955, "uuid": "af7941e6-00d6-43da-a5a2-5651f6b557d6", "value": "469b8911fd1ae2ded8532a50e9e66b8d54820c18ccdba49d7a38850d6af54475.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b34bcae3-7d0a-11ed-9db1-42010a9c0080", "comment": "Malware payload (Formbook)", "timestamp": 1671172042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671172042, "uuid": "0be9b886-c081-48a2-9e09-b71cd2385fde", "comment": "Malware payload (Formbook)", "value": "76ca0fb996e12328bd045bef9cebf82f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671172042, "uuid": "28bb5e95-e821-45c1-9891-01e72fc1de87", "comment": "Malware payload (Formbook)", "value": "47b4acbb5b8a661cb31591d48c3cf3bebfdbc6be8d4926376bbcf69180075b34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671172042, "uuid": "bfe271a6-e135-4d19-badd-cff74278681d", "comment": "Malware payload (Formbook)", "value": "fe1003ca0bab3f13cd9cf5d3709c6a8b0ba57fb1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671172042, "uuid": "2c293153-d413-4a23-bdd8-392a65a74fa7", "comment": "Malware payload (Formbook)", "value": "79752a20bc0ad72850e41b5a41958b60bca8610a74ad73637c3b6f172bb6412b99800f3b14261f9c5ad5c3c4c5cc3cd7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671172042, "uuid": "b4f8da63-76c4-4c76-93a9-c71f6003be3a", "value": "T1AAD43C2839AA500DB3729E656BFC71B6D15EF6F226324C7B09F7020625129F0DF9C53A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671172042, "uuid": "72efe8d1-76d6-40f6-af99-90b45825adcf", "value": "12288:l3wglkDE76tI0Sk9EBVQxjs6dpGvt7X1MC4cQbQ/j11TQzIM:plkWusQgJW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671172042, "uuid": "cef702a4-80b5-414f-a5dd-8af5ca8260ba", "value": 638496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671172042, "uuid": "76bc3bb2-44b2-48f3-bd14-36705eab643a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671172042, "uuid": "10b92c70-a892-480a-b588-d70a9846f880", "value": "SecuriteInfo.com.Trojan.PackedNET.1293.21326.25038", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "486c68c3-7d91-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671229845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671229845, "uuid": "f9283cdd-c67b-4957-b7f7-3c7e8ff3ac2e", "comment": "Malware payload", "value": "c6df21158b267c5724ae1415f7a8780f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671229845, "uuid": "76cc2915-255b-4491-9780-65a0e9253d2f", "comment": "Malware payload", "value": "49743530b70c165abb0abcecbc9a22447c7d9a0b1408b14897ccad494870f7a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671229845, "uuid": "35c8900a-efcc-4dc6-bdc3-ba92036a1532", "comment": "Malware payload", "value": "fcd9059c95e7f0718288aa314e72ac7db29b5cc1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671229845, "uuid": "89fe77b0-cdd6-4558-b5fd-994f6979d8da", "comment": "Malware payload", "value": "dbdbc27d53693a856822d8c6836beac73b5a0f4293ad048cc48bc5b544d7d736c346a34aec2b4bb9d8d82b7780d5fdca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671229845, "uuid": "30f486a0-f73e-4c98-bec8-2c0b5f622845", "value": "T193B523BFA64000B9D1B79AFC3834AC2146F3AE575A35D98D3B987E9B77F9DC10806502", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671229845, "uuid": "6708fa5d-80b7-4cf3-bf62-eee8ed84722a", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671229845, "uuid": "64f0de4c-a0f2-415a-9f3a-6125c355c3e8", "value": "49152:wptehYXB48Dws6owJOI9kgGzUFJJGNC5TNMh2/ur3ieOCgSY/imV:wptOYBDweml9+IFDFywMicY/imV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671229845, "uuid": "79317365-d89c-4f6e-9686-b3345d472d61", "value": 2394642, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671229845, "uuid": "a2567bb0-d1d9-419d-8671-2cf597371bfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671229845, "uuid": "471c2181-626b-4370-8b55-b7fcaf74cded", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82c43503-7d43-11ed-9db1-42010a9c0080", "comment": "Malware payload (Zegost)", "timestamp": 1671196442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671196442, "uuid": "b5f83bc8-a854-4471-b6fc-186d750f6b8d", "comment": "Malware payload (Zegost)", "value": "76b2cf113b647afabe881c5b1a76dc1f", "object_relation": "md5", "Tag": [ { "name": "45-153-241-207", "colour": "#86D11B", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FakeGaliXCity", "colour": "#607CCC", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SpaceCity", "colour": "#5EBE6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671196442, "uuid": "17f3c66c-ec90-4b1b-a2f6-b0c86a151f93", "comment": "Malware payload (Zegost)", "value": "4b54c89098e15626111186a43a379adc9efb567364b4dd7b82a24e4f4d6bf311", "object_relation": "sha256", "Tag": [ { "name": "45-153-241-207", "colour": "#86D11B", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FakeGaliXCity", "colour": "#607CCC", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SpaceCity", "colour": "#5EBE6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671196442, "uuid": "27babac4-5dfb-471b-8d04-a6f345e2859e", "comment": "Malware payload (Zegost)", "value": "5d7ccaebdb3a7322787dd2348b5a7c7a6d1bceb3", "object_relation": "sha1", "Tag": [ { "name": "45-153-241-207", "colour": "#86D11B", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FakeGaliXCity", "colour": "#607CCC", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SpaceCity", "colour": "#5EBE6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671196442, "uuid": "dcdb103f-269d-4b95-aafa-8e0a6a1ff3c8", "comment": "Malware payload (Zegost)", "value": "c47a3a5be40cb31180d746389c252f157e344f0b528c6b4f7aa63a95d3be9c833ef0d0a37f3e4dc4b4d6f0a57dfa885c", "object_relation": "sha3-384", "Tag": [ { "name": "45-153-241-207", "colour": "#86D11B", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FakeGaliXCity", "colour": "#607CCC", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SpaceCity", "colour": "#5EBE6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671196442, "uuid": "39b1b07f-9af3-4cef-b531-c35a9852aeaf", "value": "T1E821EEB27453F247DAB014158C7E3701770EF9177D905D4AA2B4B8E4F8C24869A183DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671196442, "uuid": "c512f5d5-4541-4f74-948b-9db71b2b168b", "value": "24:7xXOowJlURzKghCqhJoV7ccV3M/9um1B+Vl9RZLDltUgX6LH9:pOoklUR2gwq7oV7n+lfn+JL/ltUgX8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671196442, "uuid": "7e152059-9949-4a6f-941a-a48c8350d2bd", "value": 1340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671196442, "uuid": "7e6e9070-ddfe-4345-a697-43be2a32d60a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671196442, "uuid": "7a8f4f72-30ed-4c80-877d-9cc51a004d56", "value": "44DLDF9Y.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6cc2493-7d2d-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671187134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671187134, "uuid": "78108991-75f5-4f94-9f7c-b72fe4ebe8b2", "comment": "Malware payload (Smoke Loader)", "value": "0f78da97605cdfd0d1644bf2a4df8709", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671187134, "uuid": "e40963df-2106-4d82-9ac1-04ed8a2f6409", "comment": "Malware payload (Smoke Loader)", "value": "4bcc61c60092433b5c8f62bb472fae81cd56636455ccb23a26c58a492791f79a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671187134, "uuid": "f4bb3953-331e-4106-93e5-7a006a747720", "comment": "Malware payload (Smoke Loader)", "value": "2afbf954d6651e6033a42f855dae869d0b15ddc8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671187134, "uuid": "244da343-da47-4916-b382-9f827c30d98f", "comment": "Malware payload (Smoke Loader)", "value": "86afc55a305698ee5ac6551e1efadf5b84607c0f5bee2bc80a7ad4cf10ab94146daaf19416cb6aadd407560e1492f105", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671187134, "uuid": "7fe7ce4f-9802-4f2f-9251-3f6967b4eac1", "value": "T1D234D01172B0C471C24F1530C866C7E56A2EFC355FB196273B762AEFAE30A50667E24E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671187134, "uuid": "638ec715-008e-4af3-84e4-478c28e2e3c8", "value": "915ad03d5b3522248c2c91d75d5158ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671187134, "uuid": "241c53d8-0294-4f64-97a7-454700ac10c1", "value": "3072:zrhhTZML+11RcRbTEGgCwHTXPQFdLm8/03GCRVLQ2mppGT84LXHtWqMPDcfuf:HhhCL+11YsRDQFdLmthRCtQb8qMrc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671187134, "uuid": "971a75e5-1aeb-43ac-8d04-456ac8a20548", "value": 233472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671187134, "uuid": "9c5409e7-34b9-4931-a172-80ef503979b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671187134, "uuid": "5f839abc-d54c-40ad-9c6b-22656f364eb7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7e3f0b2-7d17-11ed-9db1-42010a9c0080", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1671177714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177714, "uuid": "52424c81-23f9-4dee-a5d3-63c7fb940d92", "comment": "Malware payload (SnakeKeylogger)", "value": "ed6ea47a25a730ee36acebfaf7468e59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177714, "uuid": "859fdf95-4ba7-4c89-956b-b31973c3515d", "comment": "Malware payload (SnakeKeylogger)", "value": "4c355f38322d2cf4c55c34d6d938a91a71bf90d3263d50548fc51f315cb279a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177714, "uuid": "d49a0f67-9f47-4464-9497-b0bf8f002f1d", "comment": "Malware payload (SnakeKeylogger)", "value": "bd657158a60dde135b2bb6f49f47232eec820214", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177714, "uuid": "48adc5e5-12c8-4dcc-a7d5-4509ef4d281b", "comment": "Malware payload (SnakeKeylogger)", "value": "cdfa3ad97e4882c9470e7979b3895afc2599169504d434f2aee46f94da14b80a28154dbc96c924162e11f2e3d94d17dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177714, "uuid": "49e51bc5-6f9e-4696-8daa-537f5ee41f7a", "value": "T1A5055A0A71D44F49EA92DBF10A00B8B026973BDE25EDEA3C4EEA1FCAD511718C9445DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177714, "uuid": "2048259e-48c7-4bfb-abde-091a69c10a17", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177714, "uuid": "01de0515-74f5-4b7a-a499-6e704eb8b701", "value": "12288:9/dk3Hhd45vxLGW2CRtKPeA9u7+UxgNFRtOGUC9juBUoZ+I:URdzWJRtxA0+UWNF3EF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671177714, "uuid": "72623e73-8394-4a21-a6b3-49f830a9512f", "value": 825344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671177714, "uuid": "1449d9a8-2903-42d8-8961-8b4f82996ec0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177714, "uuid": "95e7352d-f872-47a2-aaa7-595ce741de15", "value": "ed6ea47a25a730ee36acebfaf7468e59.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4070ae3-7d16-11ed-9db1-42010a9c0080", "comment": "Malware payload (AgentTesla)", "timestamp": 1671177278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177278, "uuid": "71f2e784-cca6-40ae-91dd-89076bb8b1c3", "comment": "Malware payload (AgentTesla)", "value": "1d819f2ada3603adec9d365263a4ec3c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177278, "uuid": "777a8ef3-2a9a-4521-956f-34a44c46dddc", "comment": "Malware payload (AgentTesla)", "value": "4c556babb063523008e8542c17ddfbd6e4b421fa2e9b958cf7906f9ffc81f199", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177278, "uuid": "b65c1689-b3b6-4116-8735-5574cc06f4a6", "comment": "Malware payload (AgentTesla)", "value": "77883650540cc8c686f0d11493c1724f1225d398", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177278, "uuid": "b3f41966-67c8-41cd-b82d-740edb762f96", "comment": "Malware payload (AgentTesla)", "value": "11c308fd01d9d82ab1fa5761ed0ffc107ccb6fe9fcd9d814a16e2f98728c3ce4f8e1158a84bdd0d692476661dfe366cf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177278, "uuid": "7613c8a9-d3d2-49b0-8200-d26d79aa03c5", "value": "T148157C85A647D8A1EE8453F139B6CC70430A6F6C54FC686C1FDBBD537BBBA4A1235202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177278, "uuid": "870c4ac5-6f80-46a7-b3e4-8769d61747d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177278, "uuid": "51727e31-a365-4534-9849-c573cb79d4c2", "value": "12288:WnxQwFCv9L9/iAw2vsaNpw1FwuwzvqQFDg5xcslKbvlSMWEE5M4ILBr9r/+ppppa:OQwMvHqAwBaDw1q5F+j8WEeYH5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671177278, "uuid": "2b46a43f-a8e9-45a4-8add-e7f75424a79a", "value": 900096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671177278, "uuid": "3228e633-afbc-4e04-bbda-28a24c0e1b00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177278, "uuid": "16763901-ce31-4913-9c66-8197b5e2dee6", "value": "dhl.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc3b3b56-7d93-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671231006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671231006, "uuid": "4f2c16e1-d7a2-41e9-b01e-1b4739506751", "comment": "Malware payload", "value": "3f10133913006203c5173127c263ec5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671231006, "uuid": "bc3a727f-203e-4b7f-91d5-c9dc01cc1848", "comment": "Malware payload", "value": "4d06fe7374d79f63868fc699495d21cfd861cc8fbdb0a23e4166c377d5e126fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671231006, "uuid": "3e21a726-4a9e-4a49-adf0-6d145623283a", "comment": "Malware payload", "value": "97ce476423b246bea6b57c8394a2a2017c275033", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671231006, "uuid": "6ae5e39b-0556-4140-9b5f-538b3682c964", "comment": "Malware payload", "value": "5cce5ac06d5081c5ab03f2ef595392228404d80f9eeab7ae6b2eff4f358c526b06c21d06883f7c052e4faec152abbecb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671231006, "uuid": "d269c459-13fd-46fa-a10b-aa86cc50ee1b", "value": "T10A24BFF17A95D47EC141C7304C2596E4A97ABC106A22A9F32B087A2FAD307C159FE37D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671231006, "uuid": "92ec5d03-d5dd-4a02-82b6-c26e108bf126", "value": "aa9c378109186462717e17e657d0c833", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671231006, "uuid": "ddd69e7d-80ac-49d5-ab7b-c7cec0a90052", "value": "3072:Hjw73ZLfRbSbRfKZObuxEUrhQiphiJtvGyQgyib8JGLsz1cbHt40zwUzQRKF+:DMZLfRdfxAiLiJZGBeTgz1It40M2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671231006, "uuid": "f3661537-5275-4a43-829c-edd59d6ade2d", "value": 219648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671231006, "uuid": "595f8c74-cef7-4079-bbad-676c6acd9fd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671231006, "uuid": "515bf4b9-af63-4b94-8920-0b97ca60a37e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e64ab4a-7ce3-11ed-9db1-42010a9c0080", "comment": "Malware payload (GCleaner)", "timestamp": 1671155123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671155123, "uuid": "6e1e5c0c-60e0-43ae-b885-e0ccb055831a", "comment": "Malware payload (GCleaner)", "value": "64cc347f64dc2691e3de738c322896bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671155123, "uuid": "762e6eab-7c64-4154-b6f7-52d03f4d1762", "comment": "Malware payload (GCleaner)", "value": "4d182411dabc143f5c193b257cb3e03f853ef510b62c81ed8e662da48562996f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671155123, "uuid": "81dd388d-a288-42bc-ae05-1620f30c9f5f", "comment": "Malware payload (GCleaner)", "value": "6859052e1f882a894e437c23e4f950b89576bc63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671155123, "uuid": "979c362b-aa0f-47eb-9ece-dee46e6b93a7", "comment": "Malware payload (GCleaner)", "value": "ce9d6704a9b8b170a1915b9ec4744c8e00cd8950a87d8613658caf0acfffaf59152780be6c7359c0139021486e4523a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671155123, "uuid": "ca1b093d-b57c-487b-9d6e-5f14f1c3d49b", "value": "T182B523D3FD855BB4DAE1CAB01E29A44C4A67FD7AECA8E05930E8336F1536392C413752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671155123, "uuid": "e2073c98-07c6-4250-a525-89b18da1e850", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671155123, "uuid": "76ec8285-580b-4372-99c6-347f633c0f3b", "value": "49152:ENur/7zRm2xvTMr/QV4k+3TzSnETUkRAeKtVL+eOCgSY/q:ENy/7jQ4V4k+mETU4KtVL+cY/q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671155123, "uuid": "7b940e9e-1e33-4c92-8962-13297c9cbcf1", "value": 2371727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671155123, "uuid": "8dbd1c8c-575e-4406-9aa9-7a5315f25fa9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671155123, "uuid": "21748a94-2a40-437b-9ec7-cc44fd4036aa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b6765dd-7d09-11ed-9db1-42010a9c0080", "comment": "Malware payload (GCleaner)", "timestamp": 1671171412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671171412, "uuid": "1649a1ac-bd72-4917-98af-498becabf034", "comment": "Malware payload (GCleaner)", "value": "6019e6b6b63105ff19682ddd21525981", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671171412, "uuid": "b78ed7e2-0b15-4fe0-9d9a-5ac01849de32", "comment": "Malware payload (GCleaner)", "value": "4d534cd29a20b602b8c7e15eefdafd9ce510b8c2ba137f824b733d107cfb92f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671171412, "uuid": "ecc78754-057b-4fbf-bfb5-486547408d4a", "comment": "Malware payload (GCleaner)", "value": "598c4f8e6f47f4d47b38593d21fd7281d0a606ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671171412, "uuid": "eafb7b34-4fd3-48d4-83a8-94ad9c048434", "comment": "Malware payload (GCleaner)", "value": "54dd35e45fe869e789be811cd4a13616636b6400a7cc9376bcfa470eb5063539fc6d54810b97a70f73fbc8bf72080b89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671171412, "uuid": "6a8fc0d3-fd1b-476d-8aff-e564cda12516", "value": "T166B523BEF548102AC1B306F438269D7241E76D776C78C09E37D83F9BB6F98D2941621A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671171412, "uuid": "db35c0dc-be4a-486f-a309-804ef465886c", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671171412, "uuid": "1be87be8-ee99-48e1-b0c6-6553c502d96a", "value": "49152:kp6E8sWYiZ+l9BwQFsq4SDSgln1utskhqVhfVwBeOCgSY/imr:kpH8DYI+l3Ts5SDSglngoPfEcY/imr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671171412, "uuid": "a9daf88c-29bd-4ac3-b4c5-9c5370c5003c", "value": 2444115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671171412, "uuid": "9a45690e-c206-4ee4-bf76-a9234727e3f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671171412, "uuid": "c60016f5-e12c-441d-8115-aea4f8a00f01", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc77973f-7d5b-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671206901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671206901, "uuid": "a3317a60-0dcd-449a-b7be-f2c3e7672e43", "comment": "Malware payload (Smoke Loader)", "value": "3f882a5db6956c55b9d53655b54c7a0c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671206901, "uuid": "36ef105a-6b4b-491b-8cbe-318b0c8c5640", "comment": "Malware payload (Smoke Loader)", "value": "4dc101ad2ec4b54ee898bbc532cd8858641b4ec8a03afbeea80b90421025428f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671206901, "uuid": "084d9469-4a36-42c8-abae-d201b5090ed3", "comment": "Malware payload (Smoke Loader)", "value": "28e19c4bcf7ee7aa59a5fa028d6233bd8a06af90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671206901, "uuid": "624bb879-770d-49b0-9e76-bd451d9656ba", "comment": "Malware payload (Smoke Loader)", "value": "caa2766b4447aec1bbfd921a348c0a27debcf8fc9fe73dd601180b4c87279f6d05899ac85a468798ea1a00e1fcc7c4f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671206901, "uuid": "03aafb50-92fc-4ce3-ae07-9b2e616fd441", "value": "T10F24BEF1A690E47ED051D3388919D6E5962ABC208A22D6F33F083A1F1DB16C155FE37E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671206901, "uuid": "f5a0e656-87cc-4d80-b3d2-d5e7d1fc58e6", "value": "3670997c8c2669588bad5b8c178dedd4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671206901, "uuid": "3bed7bfe-aa9c-4bfd-8bdf-5dd995f72481", "value": "3072:/KUzwL7+r/0R7I3ySK7giFiNdYjXbBmLsz0j40zwUzQRKF+:yJLqrvjbiPDbBmgzM40M2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671206901, "uuid": "36675094-3b77-4022-91e8-1b70e1f63dfb", "value": 219648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671206901, "uuid": "9bf053e7-fac1-44f3-b610-0b6fc0aa2681", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671206901, "uuid": "11113e3e-5170-4e25-a069-7ff6b7054d99", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf10d62b-7d43-11ed-9db1-42010a9c0080", "comment": "Malware payload (Amadey)", "timestamp": 1671196544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671196544, "uuid": "c374674e-e43a-491a-aaf4-926b660b98ed", "comment": "Malware payload (Amadey)", "value": "04dab107577f1b6f67e8b02d78cb7148", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671196544, "uuid": "72fcbe36-7560-4949-92f4-0251e0ed0c29", "comment": "Malware payload (Amadey)", "value": "4e2d2f4dd505737ccf5773dd87004e846925b2c439acfdf4b05287b6cee4df46", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671196544, "uuid": "ce13faf4-f884-42d5-8fa7-02ca01661593", "comment": "Malware payload (Amadey)", "value": "15055cfa17495325d9d7859c27682bffd442714b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671196544, "uuid": "857d0c34-5415-4e4c-b35e-7b87650d8a46", "comment": "Malware payload (Amadey)", "value": "98f8735b121c4f69381a6a8a8891f5de2a145dfebfe8d3dcb0486f3376daca407b98745e8e556f9c1276f97a342c5b8f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671196544, "uuid": "0fe9f53c-1ab8-4911-9125-f5bb981acff2", "value": "T12B54F021B271C872C04F45309DAAC7B0662DED316931A98736763BDF2F30A91667B74E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671196544, "uuid": "5ec85400-8845-4816-903b-0afdc8fb7488", "value": "e21f10fb81de748812499eebaf8a1cc1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671196544, "uuid": "8b20ec23-47d7-4b56-b0aa-d1581a75572c", "value": "6144:ITuffLa3Tacz68Hg+3xAzFl/kdcS/O5ROocc4DteG8qMrc:ITuffYTL68r3Il/kdcS25aPDX8n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671196544, "uuid": "68f90016-2c06-47ab-a168-fab4ec212356", "value": 280064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671196544, "uuid": "3061aadf-1efb-4287-a212-217091cc63d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671196544, "uuid": "f59023d1-1a28-40d6-b8ab-608816a21da3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "743d5375-7d15-11ed-9db1-42010a9c0080", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1671176661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671176661, "uuid": "a83045b2-9994-42f0-89bb-a6ebf73c3d72", "comment": "Malware payload (SnakeKeylogger)", "value": "a7298ee94c76f17a43ed37e177c1af38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671176661, "uuid": "a53659aa-c714-4ff9-bb86-c940c666def5", "comment": "Malware payload (SnakeKeylogger)", "value": "4e4baf300fce997a56c9eeb313c980c574fc53c95e58ae3982752b64385cfd73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671176661, "uuid": "1fed7512-2cef-48a2-83f9-acaa9e535492", "comment": "Malware payload (SnakeKeylogger)", "value": "e1d2e5e40c7f181ce0b048394f776b9a3a6782af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671176661, "uuid": "8527a3d4-5929-44ea-ad76-3d6b411aad73", "comment": "Malware payload (SnakeKeylogger)", "value": "c8f4da005114e2ac61c3ae878775a69d50f8361f730888336868e5819b8fcf00ff71c5817daa94c82090ef06e66cdcd0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671176661, "uuid": "4a2e5913-a1e8-4019-9906-1897a1a9cba0", "value": "T18C24F10D12FE09EEC19B29746678808007E07A426975EA7FD6A870F75FF3B53A4D3225", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671176661, "uuid": "b90887d4-1754-4b72-a101-cd8026d461c7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671176661, "uuid": "20853a11-94fa-4cb7-a294-c99b9702f1c9", "value": "6144:2uFDutOc6duxKLolcw9S7vTUXvqfqpjMMzeoCDm:9FDutOc6duxKLoSPoXvqfsXzd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671176661, "uuid": "f96c6f78-2dc1-448f-8d68-f1198f09393d", "value": 223232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671176661, "uuid": "4b14f159-57a1-4ad7-9e5a-112624bf3b2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671176661, "uuid": "e409d4f0-4794-4f79-9278-493f979bbd6a", "value": "WORKSHEE.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d733ba66-7cfd-11ed-9db1-42010a9c0080", "comment": "Malware payload (RedLineStealer)", "timestamp": 1671166519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671166519, "uuid": "7f463784-27a2-420a-9d61-88b8d73c231e", "comment": "Malware payload (RedLineStealer)", "value": "6fdc4e87e85f0b08d6f7eff37c73c824", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671166519, "uuid": "2683fb14-a868-46fc-b0f7-32c81ffa9db9", "comment": "Malware payload (RedLineStealer)", "value": "4ec56f9b78e1ba52776761c3ea17d1fc03c44374a8c18bc8856d6e466960ea3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671166519, "uuid": "34e8777c-36b4-4aec-8ef1-6f1ed2002238", "comment": "Malware payload (RedLineStealer)", "value": "edf1e91562f8c7d83031055642113d51b61c0f47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671166519, "uuid": "ada7d9d0-40a7-42d8-a871-b3034cd4f968", "comment": "Malware payload (RedLineStealer)", "value": "95a906acaeea3241588ea4b2b42b0465a9695b5d4dabe2281e5f470cffd9d89701c5b46ed2a72164b5cc32261ccfd5d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671166519, "uuid": "6f90611a-eb07-421e-844f-30e5e0acd7dc", "value": "T1B374CF217AB3D4E1F831C5710826FBF46E99B852EAE2D6333319D71F9D70293856A309", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671166519, "uuid": "6238b76f-695e-4b6f-8f74-9584a970d4cd", "value": "2067eb05796787c0f2b3dc09403197ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671166519, "uuid": "05109927-471f-43d3-9f13-6319a8b6379e", "value": "6144:RUYSxLkh0QjRB58EGcZ1ecTj00iPvzpQ6ijLxQFiaI:gxE0QRB5nGcPecTj0xnzpQ6ijqF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671166519, "uuid": "21167ee0-7d4a-46ce-82f1-a6749ff7ad30", "value": 340992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671166519, "uuid": "a4407148-9476-4bb7-bda9-2c73b1e460bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671166519, "uuid": "5a2ccc96-1ab2-41cd-88d7-1383f368ea74", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4cfac75-7d3b-11ed-9db1-42010a9c0080", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1671193063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671193063, "uuid": "03cbf4d5-6d6b-4068-a3c6-2ff5939f6f47", "comment": "Malware payload (SnakeKeylogger)", "value": "20df12644e1e4a8ed702381b10c15c36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671193063, "uuid": "f21f1fd3-71e2-40fd-b668-7f2acf2ec72f", "comment": "Malware payload (SnakeKeylogger)", "value": "4f0df4f96498d2a87c06405493579eedd114095facfc78adba120f7a7ff94e6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671193063, "uuid": "e03e7598-0516-49c7-b415-fc3a629a330e", "comment": "Malware payload (SnakeKeylogger)", "value": "dae60909e10c744c3710d427331ab44e2f3bcb86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671193063, "uuid": "c62b2dd1-28cd-4a66-9029-43bf4f750a4f", "comment": "Malware payload (SnakeKeylogger)", "value": "7c2bbcb55c141749fcb634fdb4e7591e30bd3e7a3775a259aee1d6669aa033043e55495198a79df4273cdcdd71756edb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671193063, "uuid": "dde5a4ba-e148-46e6-9d39-372985a89271", "value": "T13D159C0A70D88D19EB41EAF10640B6B136977FED29DEAA3C4EE93F5D4432618DC241DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671193063, "uuid": "17c650ff-d254-42fc-a0c6-322904ae54e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671193063, "uuid": "d1ae43e8-8388-4529-a40a-6aea7f2e73bb", "value": "12288:s9f/VdvvvkM6/ca+I/a6nsigLeRFa44wS9eMmH5DnY7p5sfPVVpj8YBgX1BVt:oYRpG7EJnY7pOf9rjjBUzj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671193063, "uuid": "20fe3800-691b-498b-8421-0dfa2c00384f", "value": 919040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671193063, "uuid": "85c3b736-4c5a-4702-ba50-ed82c5225408", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671193063, "uuid": "4085a71f-f5ea-4d74-904d-386309d3591b", "value": "swift copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48effd64-7d14-11ed-9db1-42010a9c0080", "comment": "Malware payload (Amadey)", "timestamp": 1671176159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671176159, "uuid": "e9a286ff-f1e1-4da9-9c4c-8d73a76101ae", "comment": "Malware payload (Amadey)", "value": "f86b0a384f9e879af0ee3c13df6dd58b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671176159, "uuid": "44464bad-164d-4476-a243-45f022964363", "comment": "Malware payload (Amadey)", "value": "4fda6b2c736b0c3f539e17e64b10df890bd56e8fb044b0e43c12f98e2321fd28", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671176159, "uuid": "40ed479c-3b84-4913-b7da-31d10f02bce9", "comment": "Malware payload (Amadey)", "value": "b07e292735997a2da9af856aebc61b77f8968b19", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671176159, "uuid": "556c47ab-7de2-4d27-9be1-c368e9d741c3", "comment": "Malware payload (Amadey)", "value": "41eecca436648a819bb1348801d41ca7a11bb5e218bad69502e77a2dc867e39816b2497f767a4d7ea2745e4364fa5ef7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671176159, "uuid": "2d85a03c-bed2-400a-8e4f-47e7918f5ecd", "value": "T12554E122B2B0C0B1C55F06348865D7F45A7EED315AB156077336BAEF6E30A81A67E30D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671176159, "uuid": "e2d46f46-e536-430d-8ae7-8536b7238ede", "value": "b35462da489bc13bae884e55b5227599", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671176159, "uuid": "9b680b3d-afb3-4911-b8ad-a0da30f2af0a", "value": "3072:osUkoX+3HL3GD4fptcRIRogUqQ/kD/gzzyF7CTbuFhgNOfO5RLQ2mppGT8+6dHt4:bUkpHL3GD4xLognJ0Tq4T8tZZ8qMrc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671176159, "uuid": "8f1f3b33-7f0e-4ed3-b23a-b4d97fda619d", "value": 293888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671176159, "uuid": "bcd76d1b-0c64-453c-83fa-91aad0131406", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671176159, "uuid": "609f5ddc-080a-483f-aabe-804827439867", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "410c43cf-7d7e-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671221672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671221672, "uuid": "b2a63534-f92e-4dae-8533-9cf49056a611", "comment": "Malware payload", "value": "ad52a81727b3875befe052fb841b66cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671221672, "uuid": "3481601f-e5a7-4e48-97ce-d51ebd22c3c2", "comment": "Malware payload", "value": "5096b174c14339613dc84c7d4bccc198674d271f1e2c37062053e5db7cce6efe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671221672, "uuid": "4a3643e9-c020-46d0-953a-c89fdc1256a8", "comment": "Malware payload", "value": "7b3de4b9fc71a9b67c5bac4d1097ef30fc0b0173", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671221672, "uuid": "8180aead-2681-4c33-9069-b9b4c8665d02", "comment": "Malware payload", "value": "858c0e8a1385dc4573dc9b03506a9ee08bd4df13efc270e1cb6fb513753c6c16b9f1d06b588f4e3fb6ba403b2bf92c2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671221672, "uuid": "33eb719d-844b-44f9-9a92-86f65a22a030", "value": "T19F74F1F07B40E46EC541C7308C26D7D4966AA8606B6255F33F06A62F8D706C166FE3BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671221672, "uuid": "0b67ef40-aef2-4446-beba-80a62542c902", "value": "55ba8cd792699d5c43b351a2daef2eff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671221672, "uuid": "8648b36c-17e4-4af2-a4da-ddfeaf1840a7", "value": "6144:l6LpFiWPUiC3Mlo3m9jPwc/LYD5cwxEgzlk40M2b:l6riWPUiCclo3mYcS7xp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671221672, "uuid": "4653fc34-f972-4c26-9aef-2f0a8f0a570a", "value": 342016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671221672, "uuid": "b8aa5169-3282-4d7b-818e-915bac00a89c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671221672, "uuid": "e57a034c-c3c7-47c1-89ed-b78e2d03fbbd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30056127-7d3f-11ed-9db1-42010a9c0080", "comment": "Malware payload (AgentTesla)", "timestamp": 1671194586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671194586, "uuid": "6fb83421-9e91-4cba-abae-74d9b1076881", "comment": "Malware payload (AgentTesla)", "value": "dc00e74e9e2d231fefdf860003db7e38", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671194586, "uuid": "f1f71498-a1b5-4e25-9687-7e77753351b2", "comment": "Malware payload (AgentTesla)", "value": "5162709b21cf644fefffb528621939f6df26adc829fc1adcabfaf3173db6404b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671194586, "uuid": "db676036-c1a1-4fb5-994a-13739709cb3c", "comment": "Malware payload (AgentTesla)", "value": "cbc61d8aa5bd2928b8a5151784841d990d1a89fa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671194586, "uuid": "236fbc2a-f054-45e1-9cac-d92f93c6e87b", "comment": "Malware payload (AgentTesla)", "value": "84b1e064df5c17469efa8956650f84835831ca9a5d0ef57c147d4778572843a2a0756e4db59273702c80d17e90a5b6dd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671194586, "uuid": "af5dfe66-c473-4bbb-afc2-c69f19bb2123", "value": "T10D0533BA9100D8BD736AF8E5E0FDE37010F491A9E161F206913FF2047E59A2C69B5937", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671194586, "uuid": "4fd0c4d4-2ad4-49f0-9cf5-7f8f08540f41", "value": "12288:sJMjVVTC7bL9CYC+MCT+ejHK/KK3WAmG2H0x/eDyZAk523DhCXNDxV5yp6zbYU:phCzRROrff2UcyZFkDhCVxjypysU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671194586, "uuid": "c79e10f2-1ba7-47da-a0ad-bd3d3ccb9ab8", "value": 830962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671194586, "uuid": "54405dc1-9a03-4be8-b71d-d6f23bc25bf9", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671194586, "uuid": "040fed0e-37fb-4e66-859d-1ae81c05d155", "value": "DEBIT NOTE.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f485c06-7d17-11ed-9db1-42010a9c0080", "comment": "Malware payload (STRRAT)", "timestamp": 1671177512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177512, "uuid": "f74349f0-5088-4f9d-bfb4-df2e9e27aacf", "comment": "Malware payload (STRRAT)", "value": "e1a8de275b4026141a5d53ac1c07fe5c", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177512, "uuid": "812c91ce-237d-4a7b-85c3-87bb821b6875", "comment": "Malware payload (STRRAT)", "value": "524de6e63e842eac9a9c07bdcb225407ab2b4ce5b98d728402bfe8c59cd8dfb5", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177512, "uuid": "efb9d439-c6e7-4ab7-b786-bbe499f39979", "comment": "Malware payload (STRRAT)", "value": "bd3ed1220106cd22d80ab99dc013c0204ed4fa18", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177512, "uuid": "65afc4c0-bd6b-497a-bae8-a15e5580edd9", "comment": "Malware payload (STRRAT)", "value": "944af254706481926a3f0cfe2b439dc3e8d21264c82d1ccd3c3570de4651a5bdbe9bbc8df9b24bcbf8754ea1b39ba6eb", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177512, "uuid": "c8f03778-c566-47c8-a8f4-6aeb49a7bae6", "value": "T14F04F11BB85EA0F0D04F9535451892AEFD0E61D8C076F4BBB6F887495E71C29068BE8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177512, "uuid": "dd7c3012-5fea-4357-a2ef-beda7f948400", "value": "3072:9HEk26WoOBpBl4JR6P4DeUl/wRLgexDoHzxtz/L7mfRshfxS:lsBtoJRwsl/wCHzzzeifS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671177512, "uuid": "85650fc2-f496-46dc-89cd-4ec8b1f0f784", "value": 174363, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671177512, "uuid": "e5f3c471-ebe1-41a5-bc86-7e373fe32f1c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177512, "uuid": "cc3e8ebd-761e-47df-a4ef-a9c95c204b40", "value": "Reservation_payment_copy.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4b77236-7cd5-11ed-9db1-42010a9c0080", "comment": "Malware payload (Amadey)", "timestamp": 1671149308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671149308, "uuid": "8d9bf1d0-9010-4508-ac17-829fe9ce7f83", "comment": "Malware payload (Amadey)", "value": "1a8d3e98ae366f667fc72221e03a5568", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671149308, "uuid": "60e0b7ec-27ce-4919-b8d3-437e595a66cc", "comment": "Malware payload (Amadey)", "value": "52abae1585052f3b79a40fce29ea1b6d505545e145fb48df4294dbfc3e9ced5d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671149308, "uuid": "1b40fab1-b3d4-4ec7-9017-2d1d03e6beaf", "comment": "Malware payload (Amadey)", "value": "798228f5a0990a13ef87c203fd1a12124e8f3bb6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671149308, "uuid": "989d42ec-54db-4394-b006-0dfef48f62fc", "comment": "Malware payload (Amadey)", "value": "76a47472a53e4a7c6c632663a9c5ea4a488d8bcfbc4f32c30268bedbfe445acf6b8bf39e0bf5219a9cc83de3762855f0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671149308, "uuid": "ea37a484-7f9a-4699-92b3-80afbc089d66", "value": "T11184DF197A77E4F1E931C5741C36FBF46669B860A9A1DA332309D71F9C30293893633A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671149308, "uuid": "3e714f7a-d82b-4f3c-aef2-3211abc995ea", "value": "2067eb05796787c0f2b3dc09403197ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671149308, "uuid": "3bce5bf4-81d0-43e5-9c62-b72d444d32c8", "value": "6144:oZYHiLf/Bsn+VrBY7mYmWV0jW/8jyOpjnXy0iPvzpQ6ijLxQFiaI:JiLBg+Vtqk9W/8WOxXyxnzpQ6ijqF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671149308, "uuid": "f7b10975-d057-4b39-9d97-22bdfe684ae0", "value": 381952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671149308, "uuid": "5a54dbeb-b78e-4cb9-8100-4b3e219b4bbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671149308, "uuid": "68b4fbc7-ef32-4b1f-a839-bf24c8320742", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a399473f-7ce7-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671156984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671156984, "uuid": "83be7dfd-c188-4f01-ab0d-befdc95883ad", "comment": "Malware payload", "value": "fb2b837d30aa9ae5fd69e9799e37a695", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671156984, "uuid": "a4133b8f-9420-4c26-8bb0-c8c6e49cb5c0", "comment": "Malware payload", "value": "52dd59837869e0c613236b6d4739109801c61f2da66c9f237fcecf47d115db23", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671156984, "uuid": "2d0fbfbf-7c7b-4d03-9080-7774fc0a6ce3", "comment": "Malware payload", "value": "dbe7144921e037c77bdb9ea40aa316b4f5820689", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671156984, "uuid": "c160fa33-55e2-4897-a9da-5904c7f4daac", "comment": "Malware payload", "value": "7e4e60a7624db78ccbff110300ce8e31cfb9a6e93bcc5ec67fa36053d3f83817898d72f35294e7f4d890f1a99293eef4", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671156984, "uuid": "a9c7dbfe-6087-433d-ab65-c45af98bf0e1", "value": "T17B86D0D6F7D5E92AC4332172CC5667B122998C268E42CFC765483B2E34B36E84F55EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671156984, "uuid": "6dc60436-8737-4939-a8bf-9a22b20574da", "value": "98304:OHMZLpLk6NC4Oef1L4u//I37g4cxtFghd+Oxc0SzwURNEsrC8zdiKEjF:kMZBXCG3I37gjzFOPc0SBTzde5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671156984, "uuid": "3e71a682-57aa-400c-b6c9-a49d8e907575", "value": 8153384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671156984, "uuid": "bada4285-e173-4189-9858-79251ef53ed6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671156984, "uuid": "c11b7351-d040-4228-bb50-4a92fd6fa1f5", "value": "Cerberus_disguised.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da929216-7d36-11ed-9db1-42010a9c0080", "comment": "Malware payload (AgentTesla)", "timestamp": 1671191006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671191006, "uuid": "6af0a494-7e58-4b10-acc5-aa054d9c0724", "comment": "Malware payload (AgentTesla)", "value": "e6818fef0580b277973f9c46861fef79", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671191006, "uuid": "66fee838-c560-4cc4-97db-bfca9a19d109", "comment": "Malware payload (AgentTesla)", "value": "5323377995dbc8131dcc8e237c6e64b4f2e093b5d9c4d2c5e4b6657e840eabef", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671191006, "uuid": "4370a927-809c-4a50-a437-cdc5e330fbb6", "comment": "Malware payload (AgentTesla)", "value": "926f5e06147ff7a010585a3e62189bc8c0472ca7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671191006, "uuid": "772e246a-7ed6-428a-822b-743c1fb3753d", "comment": "Malware payload (AgentTesla)", "value": "cde2b3bb1f02f677cdbb7c6142c47bdd9241e6a4f133830e1a2c9994e1a5f527d293cd77b8773fdc8c4af64aac3361c9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671191006, "uuid": "f1237792-33a0-4888-a503-80a990d47767", "value": "T194E4332E71C04A06EBB19936F16E48D2F379C0091E6A6CDD351BAFA115C4F94B049B67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671191006, "uuid": "9d94c6b0-5b58-4642-96e9-4bccac8c5c0d", "value": "12288:UQIQ8s5gcmvdTtIEqAazw3CNlL3ECycoyCldZuDP9B1Pu4507g486vTgIK6W:UQIQBacm78zLlTECycpCXZ6P9TPNOd8b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671191006, "uuid": "3010371d-9ebc-4ec8-891d-1779a2621837", "value": 718587, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671191006, "uuid": "f8c5c0e0-25bf-4856-b968-70558ff630d2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671191006, "uuid": "2d5e483a-05c3-4a82-a1b8-84341b3d3681", "value": "PAYMENT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81a36f43-7d47-11ed-9db1-42010a9c0080", "comment": "Malware payload (BumbleBee)", "timestamp": 1671198158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671198158, "uuid": "90016092-2691-4300-b859-cf7e98a4f552", "comment": "Malware payload (BumbleBee)", "value": "e39789990eba9a36eb8631f4d799cb52", "object_relation": "md5", "Tag": [ { "name": "1412", "colour": "#A68250", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "TA580", "colour": "#B2D6FF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671198158, "uuid": "57f7f5e6-3e65-468f-8cf0-104ee9a90a5f", "comment": "Malware payload (BumbleBee)", "value": "547294e9d1cd43c6d8582d62813c7aa26b81ef8affe7d16f3657a4ae202af1b1", "object_relation": "sha256", "Tag": [ { "name": "1412", "colour": "#A68250", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "TA580", "colour": "#B2D6FF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671198158, "uuid": "d666158a-973a-4837-b362-354e3d7f13f2", "comment": "Malware payload (BumbleBee)", "value": "e02bd79098b812895d2ea8a8c6a60e7751769895", "object_relation": "sha1", "Tag": [ { "name": "1412", "colour": "#A68250", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "TA580", "colour": "#B2D6FF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671198158, "uuid": "882d42e8-ee99-4807-9421-f9e9b3c80355", "comment": "Malware payload (BumbleBee)", "value": "3f00eee101cb182adab28433811871d859a7dd1122bde721140f6bbf8d96a7049561f9daa38b2617168417ee4e52dabf", "object_relation": "sha3-384", "Tag": [ { "name": "1412", "colour": "#A68250", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "TA580", "colour": "#B2D6FF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671198158, "uuid": "5ba4af88-08c3-4dce-ba69-54e4fce19c5a", "value": "T15AF433FF230B116086796E3C4AD9914D6A4FE3862D3E13442958850BB9D0ACA6D1FDFF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671198158, "uuid": "c5249420-2564-4103-8b83-f60d88d67c3a", "value": "12288:Y0i/XzUqJaTxOPqGcemoVJC+mYj/7FMeuneajIOMqwQ9FX0Jg2jBqx5dNQpsxtLG:NsDrJaToP8emoVJTj/Bkne3OYtpj2NQ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671198158, "uuid": "30897187-16d1-4918-9c00-db71afda522e", "value": 753935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671198158, "uuid": "edd4eb8a-03f0-4e8e-817e-820542fb5090", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671198158, "uuid": "d7db132d-1506-40a7-ad71-c2cd81a23c1c", "value": "Desktop.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c28fd00b-7d85-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671224896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671224896, "uuid": "f767ddf6-65e4-4153-a601-57567aa9e43e", "comment": "Malware payload", "value": "ad4f18519aec5475d6d24481a2216fe7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671224896, "uuid": "7bcbbed2-708b-4feb-97b6-0c1ee7167f04", "comment": "Malware payload", "value": "54d53c15f9802c73bfdc170ce3b557463d69ac4c4df5c2c8b07c382affcd973a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671224896, "uuid": "6293802f-0007-4e45-9743-72149dbc4d02", "comment": "Malware payload", "value": "723f1e373ec61838a387c563f857c8ecd860945e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671224896, "uuid": "a8ca00e0-9560-4b66-8cf3-66e7e1381e9c", "comment": "Malware payload", "value": "96733c41a4b9d04c782e367b9299d9b14f57bf1e010493a971d9dd6bfb66bac9012fcf2c06d47f7c670982c2fad9dd99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671224896, "uuid": "cf6fc5a9-b00a-48a1-a7e6-355445d5e781", "value": "T17E74E0F037A0E46ED291D7314C16E6D45A3AAC148A3696FB2B043A6F1D306C15AFE37D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671224896, "uuid": "d522cd3c-9a6a-448e-bbd2-542278ba2de0", "value": "aa9c378109186462717e17e657d0c833", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671224896, "uuid": "f852be03-3c18-4698-9afa-a67720112644", "value": "6144:rVYLF8DyYlo9nB4IQypYzZNEPej2evRWHADyALDtb8gzfT40M2b:reWrABgcYzrEPej22WHTgZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671224896, "uuid": "027f27d5-a3d1-4eff-9a9e-a6069aa8fdba", "value": 341504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671224896, "uuid": "94dfec21-8938-447a-8843-b4bbbfa9673a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671224896, "uuid": "9d4fe3ff-326d-427a-b15e-43f4d9631e56", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d56b281d-7d6f-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671215479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671215479, "uuid": "e4bf349c-d37c-457f-b0ef-0197f769fcb7", "comment": "Malware payload", "value": "e7f8ed7366575a759a1de4cdf4bffc62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671215479, "uuid": "c3325ff3-f59e-4230-90ad-fdb2f6ba34a6", "comment": "Malware payload", "value": "54de97eec94b1284df26332bc2d37adc9ea5634294092f399c5d879d6e44fb84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671215479, "uuid": "37e089d5-0923-465d-a601-ad00310a4efc", "comment": "Malware payload", "value": "41ce7dbb3517876c4d6692532398bb36554b1d49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671215479, "uuid": "1a558d3b-07b1-4caa-bad0-f1c7b35b096d", "comment": "Malware payload", "value": "7bdbc8e11a5eeab123b027ef9c021095b401b5deaae8c87e2be7ee1f346c5171ba6ebf14aac5f402d3ef536f5b4fbf7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671215479, "uuid": "1a27dbb5-bcc1-4d34-be9d-9e06f4feaa3f", "value": "T1C924BEF13290E46EC151C7308D19A6E5A53AA8209F3156F32B182A1F6E317D15AFE37F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671215479, "uuid": "bbad7afb-aa56-4a3d-a61d-973b70f33807", "value": "3670997c8c2669588bad5b8c178dedd4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671215479, "uuid": "a04d7ae0-5a4d-44cf-88f9-4b2a461b9b5a", "value": "3072:UGiSILPPzT0RfRgPJcIV7MobyZ2WwD7MY6ZSSSHLszjqQ+40zwUzQRKF+:N+LXzxJxgn/SHgzj+40M2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671215479, "uuid": "3fb5f549-af62-4fc2-859c-291c9a017008", "value": 220160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671215479, "uuid": "07f2281e-fe0c-47f8-9fdb-caa0c029702f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671215479, "uuid": "39771b34-1814-42a8-a198-cf6c1eac2358", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57b89359-7d76-11ed-9db1-42010a9c0080", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1671218274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671218274, "uuid": "a1ed706a-4d4f-4510-877f-2ea39caad2ec", "comment": "Malware payload (SnakeKeylogger)", "value": "24fc06b9d37b9db672899b9b9d9b8aa1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671218274, "uuid": "7caf5d25-475d-473b-adfd-9c1c527e8316", "comment": "Malware payload (SnakeKeylogger)", "value": "54f4b6fef3fb5b55f34b131be3551dfae93ff74d1946d41e8ca226d24ef6a888", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671218274, "uuid": "437857c1-5494-4691-80c0-48178b9b3b78", "comment": "Malware payload (SnakeKeylogger)", "value": "e73dc1b06dc816e347a2530b434e2ec82c916bb5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671218274, "uuid": "abcc9f51-2622-4955-8735-81dc25988f98", "comment": "Malware payload (SnakeKeylogger)", "value": "da2f47b00c7b95f868a3a9cb22d74edd71fdd9e5b339beeda1053356eee42037e3b11f6e02989220c9900770b080a650", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671218274, "uuid": "7e41fb0e-a208-4911-bf9f-5e180a4e9c94", "value": "T16015F03C8AE81E3AE1B1C1F4DBD08E67B4199C1A71855D6952D337EA03BAD52718F03E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671218274, "uuid": "03736ae5-a6f8-47ee-a339-7463b962f265", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671218274, "uuid": "bc177564-5368-450e-a97c-fcab5bc11079", "value": "12288:oS2iNdgh/CBNAV5MJw20SExP83Sb+UxK3p:X1Pgh/CL858yxkCBs3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671218274, "uuid": "d6d66d76-c820-4778-8db3-195851f20eb4", "value": 875008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671218274, "uuid": "82f7c73c-6e95-49f0-901d-3acedb08024d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671218274, "uuid": "8b008f9b-ba9b-4a51-836c-d99d39fe56ec", "value": "proposal.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea2417cb-7d5e-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671208212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671208212, "uuid": "8413498a-3921-49fd-a6b4-7340ae1c4d44", "comment": "Malware payload", "value": "99a939cab370df19b5da797de4cd8a04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671208212, "uuid": "63d4bce9-eb32-45a3-adb4-6d2d58435450", "comment": "Malware payload", "value": "553fabdc1e4aeb9f808ebdd79f661653f0086a2c3e232c975e746a8413db80a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671208212, "uuid": "ccbafd87-9f4b-4537-a858-7c76a95cd88f", "comment": "Malware payload", "value": "b0aef7f9666b74aefbe3457f842bf4791ce7bc83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671208212, "uuid": "8ee7831c-c712-4295-a123-127b16d2ba9f", "comment": "Malware payload", "value": "89225ae6a8581c12b8754f76e6aa6a008807115d71f44bc4ea15dd173b55d426f423b4b8c587ef0b4f42e7ad0be5d6d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671208212, "uuid": "4875c205-fd23-4765-a400-8fde9cd12067", "value": "T1ACB523BFA4844035C1B705F16C32DD2216F66E272854D98D3BE83EEFB3FA9C15806A56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671208212, "uuid": "403abd28-7e07-487b-b20b-afd1a3904385", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671208212, "uuid": "ff21ad15-7d78-41d3-8df0-843edbe62533", "value": "49152:Up5vqVnxx/23iELLxs1OnLxUpnO2pxZ6m3ceCfmm1iZyTZqxeOCgSY/im+:Up5vqRxxe3i8qadMJZ6m3cekmVvxcY/o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671208212, "uuid": "67067ae7-1b19-44fc-b865-bafc06fd65cf", "value": 2402535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671208212, "uuid": "1718666c-d232-46aa-a59d-bc0f8304ade0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671208212, "uuid": "abb0f236-814f-4f25-ba52-16b82158b48d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "872aafac-7d70-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671215777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671215777, "uuid": "7ed2feb3-1abd-4f96-83ad-919517206570", "comment": "Malware payload", "value": "66d1683d64dc7405857089485fec738a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671215777, "uuid": "94df736b-8b4d-4a0b-9050-87558b1cca28", "comment": "Malware payload", "value": "5543b79d3d3b2f2c11a940c6b50631ff95c0d9482f1c0c60587b44f15a868369", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671215777, "uuid": "049b8cf2-ad14-4fc0-afcf-eaceeded04c5", "comment": "Malware payload", "value": "c874cae1efd79557543fde0084c2d735cbb00269", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671215777, "uuid": "ee56d820-16aa-45f3-a1c8-57de96871869", "comment": "Malware payload", "value": "22cca71b7c971a617c8aca6a1ee332220d0e89600da527f7b880d5168bbc7379445b8ffa542e64339657fd5fb3f1e369", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671215777, "uuid": "4e6f30e3-a16b-48da-93d5-1b12a7363bd4", "value": "T18154DFF17790D42EC141DB314D25D6E5AA7ABC218A2285F32B143A2F1E726C056FE37E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671215777, "uuid": "72667ac3-cafd-4676-9286-f1ba779605ca", "value": "3670997c8c2669588bad5b8c178dedd4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671215777, "uuid": "2b14a8c7-07bb-46a7-9582-6afbbfbad185", "value": "6144:KrLQOz58zgopb2WhkgA/aoPlJKOfgzBBf40M2b:KrHyzrb2N9FNJFoVB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671215777, "uuid": "d4d42b6a-d2f0-4809-a03d-513e4dde9393", "value": 280576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671215777, "uuid": "4d85462f-7044-4fed-94a6-8ce2d30e873f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671215777, "uuid": "7bd33815-3bf2-4e19-b296-9c86c03984b9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2251be6e-7ce1-11ed-9db1-42010a9c0080", "comment": "Malware payload (AsyncRAT)", "timestamp": 1671154190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671154190, "uuid": "cc26eb4e-dbeb-4275-9d58-887403b62702", "comment": "Malware payload (AsyncRAT)", "value": "6064742c6f8a136b29ed885915389ba9", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671154190, "uuid": "815fdffa-571d-451a-b1a3-fb44fa755856", "comment": "Malware payload (AsyncRAT)", "value": "55df3917ad56d204f96fd28eef9f0803169383497fd543a6e5c4dabbfa897d52", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671154190, "uuid": "035f360e-56d3-427d-b88a-515041b763cd", "comment": "Malware payload (AsyncRAT)", "value": "5bdb7964d9524b0c1c2ceabadc72e6abee55afc3", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671154190, "uuid": "314dcba7-f8da-47f2-9f32-674454544418", "comment": "Malware payload (AsyncRAT)", "value": "bb6a93f7026e02ee2c1236e8a88a0807b43281dde1098e7918c7c69b3f0996da6a32d6d4bec18b0ae62176d23f42922b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671154190, "uuid": "ffc2b5dd-8951-41e7-9d1f-73a323e6fc7c", "value": "T13E533C043FE9C125E2BD5FB05DF2718446B9A1A77A06DA4E1CD401DA0622BC69E43BFF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671154190, "uuid": "75b7a2d1-105f-40ec-a637-281301a678e7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671154190, "uuid": "c2d96ec6-ec9f-4bbb-bdde-25ae8965824b", "value": "1536:1T6dH9JYaQXD5iETdbcbpgrBg8pkLbkx:1T6dH3YaQXFiE5bc4gVLgx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671154190, "uuid": "73713c09-b509-49d5-8204-e8981ab12940", "value": 62464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671154190, "uuid": "f3384977-2d4b-4bea-94c9-c93384f5bd1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671154190, "uuid": "a3abeb50-f9f1-4d80-8dcd-504e82c71204", "value": "Stub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e908deaf-7d17-11ed-9db1-42010a9c0080", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1671177716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177716, "uuid": "82de5431-e716-4c6c-a441-93af43eec0f2", "comment": "Malware payload (SnakeKeylogger)", "value": "e1fea795b2bc413da74976d7310aea6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177716, "uuid": "6e57ab1a-b5ac-4555-9d06-e6b89da0b33a", "comment": "Malware payload (SnakeKeylogger)", "value": "5914d93dc7fd61a69548c983248d5464fb820d7de9d069de47d254e96148905c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177716, "uuid": "566039d5-76f7-45dd-b634-845061c6f1f1", "comment": "Malware payload (SnakeKeylogger)", "value": "23d6d719dc7e2d50b8e0037bea2c2968a2fd6d82", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177716, "uuid": "55250e8e-e9b4-425c-a600-7b17bbb9f920", "comment": "Malware payload (SnakeKeylogger)", "value": "9a99e17af874d5401d97952e3140a1cc0019e6f7b1b0ce7aae22bfb5836c7c7e4ccb4a768433e7ecbfd18328e2ecbccd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177716, "uuid": "fd92d528-da92-4532-84b6-c2990d7d7ee6", "value": "T1BA056B0A71D48F59EA52DBF10B10B4B02A9737DD24DCEA3C8EEA0FCA4411B18D955ADF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177716, "uuid": "8e38e9dd-87c2-4b9b-b23a-18b6bcc667cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177716, "uuid": "6fa20294-c1cf-49fc-8c33-14a2bda9c799", "value": "12288:x/dtCHs+I6nGbG59Xf9JNhnMXbBpsUS7F39IAUZ7zoeVSypCD2:RMt59Xf5hnuBbuLvUZ70eVSypR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671177716, "uuid": "d3046774-9124-4487-b5ab-df4b390199d0", "value": 807936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671177716, "uuid": "a5097040-5887-448a-8313-ed50148c5f53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177716, "uuid": "4df365d9-249d-48c4-89fb-6d1e9e284b5b", "value": "e1fea795b2bc413da74976d7310aea6e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c287947f-7d7f-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671222319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671222319, "uuid": "99df0dc3-66dd-4e14-bd7d-ee8a7a5c7882", "comment": "Malware payload", "value": "d977e3fe581fb93df44c31fd9d3d1c1a", "object_relation": "md5", "Tag": [ { "name": "FakeEvilHunters", "colour": "#9F827E", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671222319, "uuid": "40a6d811-959c-48c3-800f-1678ff758381", "comment": "Malware payload", "value": "5b73bfc98398e760c46dc457e1911ef1ad05b440beb408e870d7c69897413578", "object_relation": "sha256", "Tag": [ { "name": "FakeEvilHunters", "colour": "#9F827E", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671222319, "uuid": "a33df29d-de9e-4195-800d-933800e543b6", "comment": "Malware payload", "value": "07f1936299e4c4bcc4e3d73a9aaae8a2bf4b00f2", "object_relation": "sha1", "Tag": [ { "name": "FakeEvilHunters", "colour": "#9F827E", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671222319, "uuid": "defa9d1d-f765-4c26-85bc-a415992a9912", "comment": "Malware payload", "value": "325b87729d23b8ed5c09f83d78152d1f6fa530b7a9fde23a28c2a0676aa24de7127672e46ed3ea3b6ae6be2b82b9ff47", "object_relation": "sha3-384", "Tag": [ { "name": "FakeEvilHunters", "colour": "#9F827E", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671222319, "uuid": "da19b411-28a9-4243-8759-a8ae5d4c3e31", "value": "T10336225315A31F81CA9D427880DB4F82679DBB0A5646972F437AF66B3FF32F08C24952", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671222319, "uuid": "55f9f2f9-906b-4714-b1a7-bec7f4d81aee", "value": "98304:m6pZo3mzP2KZbYIyE4bTPv4Dv5gwb1CXVNzdgGESk0TE4LRE:m3uOKWIyEYLvWvv4Xr5vdTE4Lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671222319, "uuid": "b305b070-1084-4f15-b0c5-f80707e5a2e2", "value": 5278915, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671222319, "uuid": "0d23a833-954d-4b1a-8601-a65cc232d46f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671222319, "uuid": "12418dab-2218-47cc-92f3-9bbc25f63fc8", "value": "Evil_Hunters_Gameplay.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e97ad87-7d16-11ed-9db1-42010a9c0080", "comment": "Malware payload (AgentTesla)", "timestamp": 1671177162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177162, "uuid": "6761a256-afb9-4289-85d4-64dff76b55c6", "comment": "Malware payload (AgentTesla)", "value": "caa0d29d39216cff6986e854e9e6f879", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177162, "uuid": "bf7581fd-e38b-40e1-b48a-f6e5de181a7e", "comment": "Malware payload (AgentTesla)", "value": "5b85fbf949694d0ac8b954954db5185532bd9dc7c1b72fb688322753831ae1e2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177162, "uuid": "b765a0c3-745d-49b6-83a5-e7240d153134", "comment": "Malware payload (AgentTesla)", "value": "5e19aee3fb4569d3f8b4bc48879443dcbcafdf54", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177162, "uuid": "2a9846b4-eb77-4fa4-ab3b-b41e597f06e1", "comment": "Malware payload (AgentTesla)", "value": "087619e812c370b990a823d669b5c137b67ea0998d35e9171cd06a4ae42eb9ca85946166cbd80d1484645066b2c6ef4b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177162, "uuid": "5d880d8a-3439-47e2-b860-183a5f205561", "value": "T16ED1C701E2F441BAD86D773868AE4B40B3BABB877941D75D34AC2116CEF634008A57B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177162, "uuid": "4b803bc7-9f91-44da-bd03-d9b66c8f4cf8", "value": "96:JLO4KNcozDc1/jX0t1DVLD2CiOTxv4YRs7AVFu3Sjsrh1zNt:BOFXDcJjXYDNi7OV4YRskUCjsdP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671177162, "uuid": "a71eb3ba-2bb5-4e68-8dc4-ece58c2f0c7d", "value": 6656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671177162, "uuid": "3f375372-798a-454a-bff1-b17c91febb46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177162, "uuid": "3838d0ff-367b-4219-9fb1-cf86f4f8d466", "value": "Payment_Advice16122022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7def898-7d02-11ed-9db1-42010a9c0080", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1671168641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671168641, "uuid": "3bea84c2-d8c2-4fd9-9032-8a9ac3fced51", "comment": "Malware payload (SnakeKeylogger)", "value": "0eedefd7788d443737e8faf4e1dcf174", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671168641, "uuid": "07d01437-4d5a-42fb-bbef-35a53af368fb", "comment": "Malware payload (SnakeKeylogger)", "value": "5c09e7051d0b4847dc370ee19d2702b2d7b79bfbbc68deaf24057c49ec4024f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671168641, "uuid": "36166fbe-0cb9-4d69-8ca6-c3258b9248f2", "comment": "Malware payload (SnakeKeylogger)", "value": "774deab2059680f45bc5bf27f8021076808d88a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671168641, "uuid": "79cd3107-89a7-402a-8d19-91a9408c0165", "comment": "Malware payload (SnakeKeylogger)", "value": "caeae79da7190d02336719a3a32486d407e8b5d5506d5555789fc90bef853ab9e4842fa7497a446866dabbe4802c6c79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671168641, "uuid": "2281e019-5d73-4b82-8ff2-cb0b137c8c78", "value": "T1D02402EB64FE4AB8D2E71AB570642280CB50220766ABF777AF1165F3CD61F30C963950", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671168641, "uuid": "32a7e917-3deb-4bd7-90a6-aa97fd416034", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671168641, "uuid": "705056f9-33ba-4e57-ae1c-2fe566a17683", "value": "6144:2uFDutOc6duxKLol7r0OK2YCRoaaXrVMvbzMzeoCDE:9FDutOc6duxKLodJ3YCB4VMv8zd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671168641, "uuid": "71dea872-15a5-4cac-8136-bdd335b7437d", "value": 223232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671168641, "uuid": "76648e60-4e0b-45a1-ac11-05b0cc720ac6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671168641, "uuid": "ff82cc43-61ba-4b65-b070-e6aebb75f46b", "value": "SecuriteInfo.com.IL.Trojan.MSILZilla.24394.18487.4640", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d6783d4-7d50-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671201909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201909, "uuid": "32ed12da-9b80-4dcd-8ded-312e1f25c582", "comment": "Malware payload", "value": "04e7629fda526600b5d1695fcceb678c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201909, "uuid": "ec30512c-d174-4c9c-8158-84cd2cef5447", "comment": "Malware payload", "value": "5c1dae4686bc9e601092ffac55ab2e28a47e0a204b213024b69b2bdfee8a29d9", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201909, "uuid": "01b85448-189c-4bf2-98e4-2c998feccd8f", "comment": "Malware payload", "value": "430c6b4fa8ef4a6a48de8fbb8cdeac2d40057d82", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201909, "uuid": "fcea20cb-7bdf-456c-920d-c12a7a8dd682", "comment": "Malware payload", "value": "20caf220bb9e3a752c7deb4e7dd07cb195ce66d6366502bd45ac4f78ca2f4502cdbe6990ff5d967c1a284095122e7929", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671201909, "uuid": "6b11d379-e0c4-4288-8a89-8a3f93be661d", "value": "T19933E702FB96AA36E25B0174945683D0B375AC6EAF558717398C3B1C3FB11309B6371A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671201909, "uuid": "dfd1de41-934e-4e85-b14e-a65b9ad1e525", "value": "768:Zq7ctikJv8ted9eNtC6CAN0oZZi/qeN/K7M:GiJv8MqNtC6CAN0oZZwqrI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671201909, "uuid": "85629622-2b7a-457a-a6ee-d1dd75097888", "value": 53760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671201909, "uuid": "6be6db27-5982-424b-8ce6-6f522c9be85d", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671201909, "uuid": "00153834-79e8-4cee-b743-c7b3fc0bbe11", "value": "KishoreG_Updated_Pr_0912202295124.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31df9bb2-7d5d-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671207474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671207474, "uuid": "a1f30311-fbb6-4e89-9dd2-c8e6fca3a1d0", "comment": "Malware payload", "value": "f964d529b87f8292ee72cb965eac9151", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671207474, "uuid": "05deae1b-461e-44c4-a184-35ee78218af6", "comment": "Malware payload", "value": "5c2fa44ce41ecc533065415d578d0f93cc7adbc71357cfe32244b92d46398320", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671207474, "uuid": "844ca949-32eb-4c1e-a7b3-8f2a7aff6fc2", "comment": "Malware payload", "value": "7f36e0dcbfd46ecd02ed151f8404789f69ae83a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671207474, "uuid": "0aae7f40-b5da-457b-bda6-895eef6fd47c", "comment": "Malware payload", "value": "43129b0d96b289572286d4a88a5f3fce582a3c494ff87d2812df1806ef0ffd77a98dfe68d44e5345486dfe58bdd42fc8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671207474, "uuid": "3eebb0fb-844b-4c7b-95a7-ec788ca1cdca", "value": "T125158D0A70D95D19EB46EAF10740B5B13A933FED29DEAA3C4EE93F590432618DC241DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671207474, "uuid": "18aa7aac-6f0e-4255-ad14-f4b5e5cc0ec9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671207474, "uuid": "99f8858d-eb58-4537-9ee3-f7dcc3abf21f", "value": "12288:03ZNVpvvvkK6/canFF4lZcA9VUspKwkZ2rOhoK7xBmZqBr45s/d8uau+Ik7:oanFFaZcGVi7+OvmZm/2j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671207474, "uuid": "622dd0ef-1b2c-475d-8329-bb33cdc6f316", "value": 940544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671207474, "uuid": "4a018cb8-e5a7-4138-a3d3-806947cb556b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671207474, "uuid": "99f8a29c-40a0-4c9b-952e-73038db27c17", "value": "PO.00151222.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7042d304-7d6a-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671213162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671213162, "uuid": "10d41cac-9cc9-45f2-aa06-0661fcf8a468", "comment": "Malware payload", "value": "52d108c6b8943f2dc03b5c34bc7cd204", "object_relation": "md5", "Tag": [ { "name": "1228806356", "colour": "#B96B05", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671213162, "uuid": "586dc2e2-d92b-4736-bf68-1c80f1989083", "comment": "Malware payload", "value": "5d39b75eae07ccfe77968f0056eeb6feec2b124cd5d52327f4b162827beba604", "object_relation": "sha256", "Tag": [ { "name": "1228806356", "colour": "#B96B05", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671213162, "uuid": "a925e408-fd87-4a70-ae11-7641637e3909", "comment": "Malware payload", "value": "0e492ea670a1efa45d742c7b1459966b29e3b6e8", "object_relation": "sha1", "Tag": [ { "name": "1228806356", "colour": "#B96B05", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671213162, "uuid": "785f10bb-10f0-4d2e-8323-9c08584b0013", "comment": "Malware payload", "value": "faa0994ad22fc4187596f0d0a99678588c010242be8b38020cab520e581be9962c713b28b273613dae4c57a9979f5f5e", "object_relation": "sha3-384", "Tag": [ { "name": "1228806356", "colour": "#B96B05", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671213162, "uuid": "bcb83637-90a3-4b01-91f3-d64e5af26ad3", "value": "T1772533AC54312F753374A2D419D1A8796D1BA725E585371F3E07C8620A9BE8ED1303FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671213162, "uuid": "15859367-02e3-4eac-993d-63b491cfc30c", "value": "24576:wrDBZuUzIwElVntXzUi1JN2ZS/fOnV5i5ln6mVPl07ntxnJJ8mrWKn:wHB/z/ElVnBzBJN2ZS/aBIMzP8mCG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671213162, "uuid": "b690053c-6081-4f2b-a78a-a76151436a50", "value": 983349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671213162, "uuid": "b25894fe-b47a-474d-a347-c81e0bb31b33", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671213162, "uuid": "57860286-d7d7-41ca-b523-e54817c67270", "value": "Setup_Win_16-12-2022_16-47-34.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef3558ab-7d4d-11ed-9db1-42010a9c0080", "comment": "Malware payload (Amadey)", "timestamp": 1671200919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671200919, "uuid": "7aeb535c-034a-4c7d-ab0c-fb3eaea1b9ba", "comment": "Malware payload (Amadey)", "value": "093eda0545a4314b5a947a980bbda4cc", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671200919, "uuid": "8a14498f-150b-4874-ac5e-3997137e5ffd", "comment": "Malware payload (Amadey)", "value": "5eb90b93f807ef1c6274c6a41fc4813f824a9870f782234258064bc67b67dcab", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671200919, "uuid": "205c3ec8-cef7-45b7-a041-d19882427387", "comment": "Malware payload (Amadey)", "value": "20f4fd70cc9e3ff6e219d73b01aef4c6a45aa8dd", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671200919, "uuid": "5bcc5c62-b8c8-4c14-85be-a3885779335e", "comment": "Malware payload (Amadey)", "value": "018a80c9e45ecc99fe1ab8754815c0a5030cddabeaf9fb27a411acaaebcaf793e0f328352c4bd0a5410ec87808040119", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671200919, "uuid": "a96158cf-a148-4008-bc7e-1fc54bd41d43", "value": "T12754D0F03691E86EC151CB304D29DBD8AA2AAC159E2145F33B54BA1F19703C196FE37E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671200919, "uuid": "a014638b-0eb6-430c-a06a-f7ca277ed16c", "value": "2cc3e4b8a374ca30888470c0a531eceb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671200919, "uuid": "159475d3-b8f3-4b12-b7b6-a8eb7eb71104", "value": "6144:wdLM/4y7+JxJdHl7x/wAeumN/0hgzTb740M2b:wdanSxTRd9euu/0a7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671200919, "uuid": "3d210e7b-b737-4149-b6ec-0ad9479a8f9b", "value": 279552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671200919, "uuid": "47e0b5c2-f61e-41e3-8441-77a8859e7a15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671200919, "uuid": "78d2db81-5e4e-4cad-a7fb-89658c830518", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0489044-7d34-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671190130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671190130, "uuid": "8a2eb4d7-fc21-4d18-bc61-c1ad5f9e5f15", "comment": "Malware payload (Smoke Loader)", "value": "456fdd340561a5e6d0d5e4fdc5cb1970", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671190130, "uuid": "a039bce0-8dd9-4c18-8b77-33700236b10a", "comment": "Malware payload (Smoke Loader)", "value": "6006d7e72fd193b89cfb0effd1ab09da2b937a433a3fc8ae30f0cfae264dd29b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671190130, "uuid": "91ccf32a-5f93-4a3e-ba7b-217b908485e6", "comment": "Malware payload (Smoke Loader)", "value": "3dc09ccb8b3aff499b743478fc553fb468d9ff7f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671190130, "uuid": "3ebf1b96-c54e-43f6-9847-aba79d99cab1", "comment": "Malware payload (Smoke Loader)", "value": "3e481aba7490d1d01e1b93f55a4f244bed355fb9b894d02ff4797256df0f12ab829a0f54ed3ed3386cd27c4481322a6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671190130, "uuid": "7ebb21f6-6f76-4277-b07a-3e8e816e6d10", "value": "T15424CF10BAA5D472C11F457099A9C3E09A2EFD317971A5033B353B9FAE30BD1A63630E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671190130, "uuid": "8104c46a-322d-465a-8486-fd213c419049", "value": "875e7ce4bbed8fa04d22755473fc97c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671190130, "uuid": "62e5f54d-1485-462f-ae3c-3e4057ee0848", "value": "6144:wofnL4DPUvJ4AurN4m3IBbtQx/98qMrc:wofn2US4mEbG/98n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671190130, "uuid": "d19c4b9b-6e73-4b16-be4a-5e525b78f4a5", "value": 226304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671190130, "uuid": "58f85fa0-0f93-4c78-b47f-e929a8d1f113", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671190130, "uuid": "70ebb25d-b8ab-49f1-96c8-78e7d08211a1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88c79551-7d15-11ed-9db1-42010a9c0080", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1671176696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671176696, "uuid": "ec62f07e-4da4-4f11-8451-d895eee787b8", "comment": "Malware payload (SnakeKeylogger)", "value": "f1b34239d73ced30cfbacaaa60c8b9bb", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671176696, "uuid": "ba272286-d480-47d3-8007-c535053636bd", "comment": "Malware payload (SnakeKeylogger)", "value": "60758b6b4ebbaa83e0db9c18686dd093961be3c87a30b14cc924ac0aa0f5c71c", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671176696, "uuid": "57f8547a-7a78-4b49-b341-d408290f65e8", "comment": "Malware payload (SnakeKeylogger)", "value": "48c6de0da1a255ab87086058d511e43f12b149ce", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671176696, "uuid": "0138318a-402d-4086-9375-98f6b4ad7f80", "comment": "Malware payload (SnakeKeylogger)", "value": "4c6d8d72115def8479af033df4f56a120100744b6aa15041452e29f23543c329feec1b072e7821b02d084c80d8707424", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671176696, "uuid": "e1d329d1-6d01-40b2-b63b-a51a69cc9513", "value": "T1E4056B80E5C50368EB1FAF72843FDE7439166DBC983848DD15DA7E1737BAA931006A1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671176696, "uuid": "7ef0db2c-c189-4b3e-8fc1-fd7bb6a013cb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671176696, "uuid": "2c6407b2-fa23-4bdc-80f6-0fa2eac9d7ae", "value": "12288:QoMwNyZcRSDNdKg4Sw2R5sarXE6/btOb2tbVG8ir9r/+pppppppppppppppppppH:PTRShd/7w2RN5OahYjW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671176696, "uuid": "ae47fc7d-374b-4fd7-974d-84addccc3d9f", "value": 837632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671176696, "uuid": "26087fd1-698c-4f12-93c9-3b2716e10fd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671176696, "uuid": "0dbe93ca-ab00-49bb-8631-306ae0382fe1", "value": "DHL 102.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b574f96-7d6d-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671214335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671214335, "uuid": "837fa237-3fb2-4135-9b75-f40d43114387", "comment": "Malware payload", "value": "56ecf76e6031ce85e240f4fc0213c3e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671214335, "uuid": "2364aae7-bc0e-44f6-8630-914578c91ed2", "comment": "Malware payload", "value": "616a2c49d5e2f30065d905767dca057c39b668b74c0022f7ab80688e3bf04a9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671214335, "uuid": "93a0066c-dbb6-4230-a3df-f8ddb662ac2d", "comment": "Malware payload", "value": "344a59fbaa85a8238f2428785939c3c50cd5d656", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671214335, "uuid": "0cbb6253-8ce6-4a42-bbde-3bdf7cdd739c", "comment": "Malware payload", "value": "24b186e853d010bb87967cd0628b4cf985235e2741a24c67fd75fea31fafc2d76b14f6456bc7220a25228df86e178b6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671214335, "uuid": "07cc6de4-1e66-4589-a771-3be0c2c214ee", "value": "T1DF24CFF172A1E42ED152D7308C19E6D4922ABC214E3295F32B1C2A1F5D702C196FE37E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671214335, "uuid": "352c60ff-7c40-4514-bb03-8c7bf5847566", "value": "3670997c8c2669588bad5b8c178dedd4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671214335, "uuid": "54c32cb6-a6ef-455b-b9ea-805c83a1b250", "value": "3072:oNSIFLXpTM0Rzn5kS9PZpgojq7FTXoLszb6UQLW40zwUzQRKF+:gtL5TzkwPfdW7qgzbX40M2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671214335, "uuid": "5842b208-398c-44f4-8191-65db10af06f2", "value": 219136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671214335, "uuid": "a0f38568-fcaf-423e-8072-918ba93d842b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671214335, "uuid": "fe683aac-b899-4fc9-b235-295c955cb8be", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c61155d-7cd8-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671150502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671150502, "uuid": "7a026476-21e0-4b69-9c5a-16a68d8dcaa0", "comment": "Malware payload (Smoke Loader)", "value": "b2a3328fa4c4b109e0a44565bea3b2ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671150502, "uuid": "560beffc-262c-4a44-b5be-13e0aeb56bc0", "comment": "Malware payload (Smoke Loader)", "value": "61a881776859aa787790ee666d24a62b0abb37e14e19950ba2c09231afefed00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671150502, "uuid": "7ef41efd-58ae-49a1-8e98-2168017f7804", "comment": "Malware payload (Smoke Loader)", "value": "cec61fc8f9465ee055d401369fbe4e16f221cee8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671150502, "uuid": "7f006f55-b5c5-495a-98a8-caf1f00c3273", "comment": "Malware payload (Smoke Loader)", "value": "3e745cf07b9144c6b6689a3ad9b4354efeb42b7b99215a4d2f5feeb60b9a6201dd34cfa88bce8c30bdfe3523cec7b2f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671150502, "uuid": "2327fc2e-68de-4bb2-9b1f-b636fc6ca462", "value": "T15274CE083AB7D4E1F832C5745836FBF46659B820F9E5D633230AE71FE9702938966309", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671150502, "uuid": "78f9861b-7bdf-455e-980c-025fbec354a1", "value": "2067eb05796787c0f2b3dc09403197ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671150502, "uuid": "f4760c8a-1a08-4fa7-8e7c-48aeaa49d438", "value": "6144:uEYQT8LAQ60nqsUf30YmPCkKg0iPvzpQ6ijLxQFiaI:1ot6Io9v1gxnzpQ6ijqF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671150502, "uuid": "eeae775a-62cb-49a0-aa58-8473c647baa0", "value": 341504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671150502, "uuid": "b72a0650-cfc0-44bc-9483-2147eae3065c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671150502, "uuid": "d38ae9db-08c1-4d54-b1b6-4b04062d8376", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82acb7aa-7d11-11ed-9db1-42010a9c0080", "comment": "Malware payload (Mekotio)", "timestamp": 1671174967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671174967, "uuid": "4ba9a2da-2c23-401c-81ee-a91c19ba62cb", "comment": "Malware payload (Mekotio)", "value": "b4f3c46a6da8e0163b848d6e5d6ce1b4", "object_relation": "md5", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671174967, "uuid": "00524234-140b-4177-b630-b3d956a8110b", "comment": "Malware payload (Mekotio)", "value": "635329a3e60baf7fc0d50d16b87c4ddc8f9300c710696dde863c3d90abb1b4a3", "object_relation": "sha256", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671174967, "uuid": "5a917a70-1117-471d-bfc8-22aaf77140e7", "comment": "Malware payload (Mekotio)", "value": "4f0325e16c1bfa806deffce2eb9467ea100c3a09", "object_relation": "sha1", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671174967, "uuid": "2f9bd949-9ff0-4f10-bb29-0b7ff4420768", "comment": "Malware payload (Mekotio)", "value": "f1d26dd7ae5cccf2b54e5f01bf6192aa4d7d9d47b8cb0aa09b50e6ed39e054cde4ac910af02bf9fc65bae62bebc2f42c", "object_relation": "sha3-384", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671174967, "uuid": "001c007c-0a72-4b82-9846-c35d7a286740", "value": "T11056232372968535C0EDC574592BBFEA36F61B298BA140FB62C869CE35725D09333E43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671174967, "uuid": "9a615119-1fc2-4789-9f44-f8f780e7da93", "value": "98304:ZYntMEAd/I+xrYpt9jR2bUFhhUWRW/f8FmXFtIQSxpfPHpq75rFXbge8:WA/HrYpHRqU5RRif8wcQSLHod", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671174967, "uuid": "a86728d4-2500-410c-bf46-fea215b9767e", "value": 5996544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671174967, "uuid": "1c3820b7-45ff-42be-9aec-a12258006715", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671174967, "uuid": "fe8b4718-58c1-46b2-b076-dbd97c5c0f35", "value": "Factura639b5.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c602728-7d39-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671192083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671192083, "uuid": "27f541c3-dde0-471a-bf5f-567930a4185d", "comment": "Malware payload", "value": "c3a42698d7c30307907b251b0c09e231", "object_relation": "md5", "Tag": [ { "name": "fakecrack", "colour": "#E25CDD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "github.com-lemonchik22", "colour": "#97EF03", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671192083, "uuid": "75f31ea6-7e7b-4249-96d1-ad560f7e52a1", "comment": "Malware payload", "value": "63cd8ce5e8cbea9a895e988c6c9710dc0f35397557098f96f06051762dee864e", "object_relation": "sha256", "Tag": [ { "name": "fakecrack", "colour": "#E25CDD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "github.com-lemonchik22", "colour": "#97EF03", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671192083, "uuid": "b31cf8c1-4baa-4bec-b5ba-c1c452c5a90b", "comment": "Malware payload", "value": "68f3285d9afdceb7f1c876d4d3ceff189aa2eee0", "object_relation": "sha1", "Tag": [ { "name": "fakecrack", "colour": "#E25CDD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "github.com-lemonchik22", "colour": "#97EF03", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671192083, "uuid": "96ebe633-95ed-45bb-9469-d4c6e1e3a064", "comment": "Malware payload", "value": "1860cd232041c904be73c0d099babd5725b5ca5fcec90566de1b18c69f59df9c0e0d8f3a324703ac5c822d554da7a1a5", "object_relation": "sha3-384", "Tag": [ { "name": "fakecrack", "colour": "#E25CDD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "github.com-lemonchik22", "colour": "#97EF03", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671192083, "uuid": "e73f895f-cd9e-48ee-8388-0cd930183468", "value": "T1B2443A213B4997FF41D6F9418F26F81D2E617F7E891DF6EAB7821BDB4688841E802434", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671192083, "uuid": "cca9c3f5-0af7-45a3-b88d-1ce6391ace48", "value": "6144:I+xmgCAuajc/40+j854goo20YWRuMYEGOF7MY:Id9r/x+j854goo20/maz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671192083, "uuid": "609db518-43ee-4442-8200-500643851488", "value": 275130, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671192083, "uuid": "1ea244d6-af00-4640-b5f0-73468a03c6a4", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671192083, "uuid": "e6643edd-9c58-448e-b14a-0cbc5cffd740", "value": "Desktop_Full.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2f04f88-7d4e-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671201328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201328, "uuid": "8cb6e3da-024e-4ef4-b60e-eaaa33f7cbaf", "comment": "Malware payload", "value": "038c21e92311ecb6e67e143128c3a350", "object_relation": "md5", "Tag": [ { "name": "45-153-241-207", "colour": "#86D11B", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FakeGaliXCity", "colour": "#607CCC", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SpaceCity", "colour": "#5EBE6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201328, "uuid": "a341bbc3-f494-4ad8-b5ec-e39b1d6b89c9", "comment": "Malware payload", "value": "649c9081b96d38aaea3052741d8549bb693a6a5327676376dd11d98ef51f697a", "object_relation": "sha256", "Tag": [ { "name": "45-153-241-207", "colour": "#86D11B", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FakeGaliXCity", "colour": "#607CCC", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SpaceCity", "colour": "#5EBE6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201328, "uuid": "5c70cd42-b76c-472b-9df9-3dde14a74e08", "comment": "Malware payload", "value": "f5e8b300cbd58238d12b755298edf3c565755dc8", "object_relation": "sha1", "Tag": [ { "name": "45-153-241-207", "colour": "#86D11B", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FakeGaliXCity", "colour": "#607CCC", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SpaceCity", "colour": "#5EBE6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201328, "uuid": "03ed867d-2e13-4d1b-9d79-fae80f634f75", "comment": "Malware payload", "value": "e080b4a20e9f056c531760f889a8197fe61dd40277a9839394327089b5a66ed8bcdb647afda405a7c80d5e5da7bcb9d2", "object_relation": "sha3-384", "Tag": [ { "name": "45-153-241-207", "colour": "#86D11B", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FakeGaliXCity", "colour": "#607CCC", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SpaceCity", "colour": "#5EBE6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671201328, "uuid": "ee404989-ea9e-437e-8346-b670a0954a6a", "value": "T18131FF71B462F386C9B009458C3F3B01770AF947BA840D0AE2F57CA0FDC2986AA593DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671201328, "uuid": "cb449d90-193d-425c-ad92-aaf17e4ac379", "value": "48:pOoklUR24UR6wq7oV7n+lfn+J2dYURIJagtuv:pbmHWkSwJaV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671201328, "uuid": "a68efa15-03c5-49ae-835e-36fbc29e1765", "value": 1619, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671201328, "uuid": "7f590a5f-c37d-4cfd-b9ca-b9f8a3f321c2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671201328, "uuid": "1949e994-69cc-47f0-b986-d85f41bf4a86", "value": "CA41I4OE.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdd5e6a0-7d8e-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671228754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671228754, "uuid": "d126e781-901d-4c40-8fd1-4eba686f4b3a", "comment": "Malware payload", "value": "b6a18789ab0263f4eab7ab97287ecbee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671228754, "uuid": "52bdbccc-f5f9-4f67-a4b0-cf90eb62e541", "comment": "Malware payload", "value": "651ee42db18f616fad32be821a25bed84dc6c75bad45284382273d3d07d55597", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671228754, "uuid": "3b2fd2ec-119c-41ad-8b1d-25fd57d098a2", "comment": "Malware payload", "value": "8787cee17a183d20ad0251076168953110ab90be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671228754, "uuid": "ca9e84bb-e0ea-4889-93ec-df1a4e144eb9", "comment": "Malware payload", "value": "f42ea42d69945d01bf0990ec45cadb12d0b7ff2519163e2179b7c8980a1d972c25c42c625ce0aad5724023d3eb69db18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671228754, "uuid": "49dfb0b7-d54d-466b-8c78-b0777abe7ac8", "value": "T1974473C0D45091EEC9B57BB6C47A4CB00AB13DBBEAD179681794706F387D1CB481AB2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671228754, "uuid": "c5caf387-9d76-49ef-864f-8e76c1e3c670", "value": "1536:x6r3JgI5plLY23JQvnFCohuftzEPKqa4gi6CMhSZFiyBRZkKs3I6C04s1lPkWttv:xK3xtLY2NfWyq+wpRTMaqx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671228754, "uuid": "863d1bb7-490f-41e6-aad5-48b01e096d6e", "value": 255488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671228754, "uuid": "4b8b647a-9094-4add-bf20-7aea9f712a22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671228754, "uuid": "c1cb2917-e129-43bc-9b7b-19df4cf9d42f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7205ca65-7d18-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671177946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177946, "uuid": "e76587ae-f2d5-44ba-a87c-4299bea6f729", "comment": "Malware payload (Smoke Loader)", "value": "6781a4fa1902b29729154cc556f7ba9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177946, "uuid": "fdafba7c-56cf-4e62-a4d1-14907d095a31", "comment": "Malware payload (Smoke Loader)", "value": "65c66c06b934ddfa0e90df3fa57097fd85a8381edb43a75b320f88452b1b047f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177946, "uuid": "cc454dfc-db58-4403-8aa9-5f3230a9b6c2", "comment": "Malware payload (Smoke Loader)", "value": "0e79ce3aaadd5685f1e5483c842866e6397aeef2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177946, "uuid": "29285965-3de5-46bf-a5bb-ae05f0e76c79", "comment": "Malware payload (Smoke Loader)", "value": "beee491db38cbdba3fd621d59dba6be72cbf633c23d94d77a165cd7c345570da80113cb8bce115914ce1c4ad4705320a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177946, "uuid": "0eac9c05-a042-4218-8676-361bec4a9efe", "value": "T14864CF01FAB3D5E1F832C57C5826F7F466A9B820A9A5D233370AD70FB9703A38556316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177946, "uuid": "ebf5080f-01c6-41d1-9e7f-eb4feb87e2d6", "value": "d134d10c41936619073a08bd546852f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177946, "uuid": "1f3aa584-2924-4ebc-ad83-8ddf52a52c8b", "value": "6144:KYrBL8Mm+tkoM3UsR08BdL0iPvzpQ6ijLxQFiaI:rIMmMtM3UsR08rLxnzpQ6ijqF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671177946, "uuid": "66490dde-b54f-4aeb-b094-3194a69e979d", "value": 334848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671177946, "uuid": "83f3533a-b862-4e77-a655-9e5523e63618", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177946, "uuid": "cca1b5ce-ce20-421c-bce0-4e2980eadfbe", "value": "6781a4fa1902b29729154cc556f7ba9a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3ff46ee-7d99-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671233515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671233515, "uuid": "c7d3d0b2-d5a9-496f-ac20-206b7b904dbd", "comment": "Malware payload", "value": "cf0e32e1bdb361cadcbce6c9ffa4ae05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671233515, "uuid": "31c034b5-3d32-442b-b20f-2b9df2c0ee3b", "comment": "Malware payload", "value": "65ff31620c302a7344d79070b905e60d68bc2ee1d4e4ace2f156536646875fcc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671233515, "uuid": "22959588-8172-4d1b-98b0-a9f30b32a4d9", "comment": "Malware payload", "value": "60836e2631485b43aaf0660e3a448cfce5cc1fb6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671233515, "uuid": "8666f459-5a92-473d-a507-c726fc16296c", "comment": "Malware payload", "value": "1c4ce5bd73417bd003c9cf9914c7be60947ad316808670eaaf751adfc251b8c28e1ffa19a673e0f676e2c8fab607afb7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671233515, "uuid": "b6bc60dc-2d7b-4e52-98ba-476e90a6024f", "value": "T183B523FEA94401B2D4F34AF97C359C224AEA6E1B1D71E49E3B96BD8737F6CC18406142", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671233515, "uuid": "9cb3206d-6a9a-4d7f-9232-d37ad8163a3d", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671233515, "uuid": "0402ba00-b634-4b37-b8b7-2b86e77297a7", "value": "49152:Ip4BcBNPrGfiaIK6PIAe6gYp+3Twbpn/a6D+t1qeOCgSY/im8:Ip4sNPr2oK6PKIp+0VniZccY/im8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671233515, "uuid": "9f409bf8-596e-4f05-b6cb-e505844b4380", "value": 2421732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671233515, "uuid": "39dc30e6-d090-4282-af95-876e84e911ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671233515, "uuid": "63e16b84-9c67-424e-b143-163d5e3bd246", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f55791c5-7d5a-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671206513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671206513, "uuid": "6f4149a5-1cf5-45fe-af6b-34ea1cc67a8c", "comment": "Malware payload (Smoke Loader)", "value": "d1cf3c8a3990acddc9de7443ebf35c90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671206513, "uuid": "29f03ad1-4293-4b3a-b07b-2e838a0c4931", "comment": "Malware payload (Smoke Loader)", "value": "660484295e9e209725d9c96fc84d21a8dd880182f5d07e06805cf4a73a6cbe7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671206513, "uuid": "423e1945-42f0-4d44-ae15-4fc9b504280f", "comment": "Malware payload (Smoke Loader)", "value": "ef0af0bed701b78ee4b94a3cd0895a759b3687d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671206513, "uuid": "4998b3b3-d031-4004-ba49-02d2cee2df86", "comment": "Malware payload (Smoke Loader)", "value": "f701f0fd33292376c96407354e93b8f52be3a22b1c7ed77b620952992241e4b8e0025808d6038b154c01cefc71618d4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671206513, "uuid": "3df17fdd-3383-4682-a10b-6988000f4bd5", "value": "T17724BEF07A90E42EC151D7308C1997E8962ABC156E2159F33B14662FAE303D19AFE37D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671206513, "uuid": "4c633493-15b3-444b-8f6d-1ff9a3faca38", "value": "2cc3e4b8a374ca30888470c0a531eceb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671206513, "uuid": "03cc5f11-71e3-47ee-bce8-f2c4730aa2d8", "value": "3072:qZaH24LUBio6SRvwNLqOCbUokAF9VM7dweJvBLsz3rOLQRyzT40zwUzQRKF+:UCL6iUAxokM92GehBgz3rOEy340M2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671206513, "uuid": "06047579-47cf-45b3-bd72-5307063c7314", "value": 220160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671206513, "uuid": "0a937740-165b-4eb2-a9eb-9ad8bc12633c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671206513, "uuid": "b38b0b9c-ce10-48f6-a999-ace47b4a64bd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91a71aaa-7d15-11ed-9db1-42010a9c0080", "comment": "Malware payload (GCleaner)", "timestamp": 1671176710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671176710, "uuid": "17f4316a-3ba4-46f0-aa7d-ce140f576d79", "comment": "Malware payload (GCleaner)", "value": "6a0751a9ae4fb0ef3779bdc79e0b3196", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671176710, "uuid": "6611a54c-4ca0-432f-967c-63050f646d58", "comment": "Malware payload (GCleaner)", "value": "66167775a282707080bc2b277768662981b7f21081047fdc96c5c1f6c78088d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671176710, "uuid": "97e68083-79c6-4a99-b88a-132afcbea443", "comment": "Malware payload (GCleaner)", "value": "02b12b1abd6ba4110256862290182a5c4a5bb6d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671176710, "uuid": "c5e3d763-2da8-457c-a315-2c2c31a5a099", "comment": "Malware payload (GCleaner)", "value": "08eb8750dc723220fabdc87a5652b7ef83ca5917500dffd02e46c99f0eda5b1960d7d7b548c2427ecf2aaef4716d570b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671176710, "uuid": "244a8875-84e9-455b-ace6-34302021accf", "value": "T1ACB523BDA45404B6C0F748F83C216D6195E6AD1B2D39E58E37CA3F8FB7F69E11809209", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671176710, "uuid": "e28c076f-ad15-453f-bb50-7488425fb647", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671176710, "uuid": "62b6e44d-405a-4722-bc5a-783c34d2f6ee", "value": "49152:Ep3aUlhwJLsodd6wIhhxxqiS6HDEGkbxl+zZGmdUV7eOCgSY/im8:EpqUAd0vj3DLkllMZGF7cY/im8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671176710, "uuid": "e5effbe7-ed81-4455-bc7c-d82567541725", "value": 2430871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671176710, "uuid": "4c9bf44e-f81d-4ce4-8b95-cb4376f051ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671176710, "uuid": "4ddee236-88cf-4173-9fe7-80ae58d50c6d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1ae38dd-7d2e-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671187582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671187582, "uuid": "51b7ebe8-c0cf-490f-8625-dc719222e29b", "comment": "Malware payload (Smoke Loader)", "value": "61426f288679c8cedbaf9c9157741393", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671187582, "uuid": "d7111da2-fb65-4151-8277-0aef3ea1f148", "comment": "Malware payload (Smoke Loader)", "value": "66a866c9f2f60d077ffd6a13fb33c23fd6cf1103b7b6373427a2a116f56f62de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671187582, "uuid": "769ee31f-fba4-4c4d-80e4-22588a5549cb", "comment": "Malware payload (Smoke Loader)", "value": "82583bf16cde3be75228445ab9b226c8b9498bb5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671187582, "uuid": "3acfbec9-ce5c-400c-b1c6-7ed972970a85", "comment": "Malware payload (Smoke Loader)", "value": "34478b7e913fece0c2f71563b3c92e0030bc2c7da860c6361745d55589802a4bcf90913baa22c913308420deeb0dfbcd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671187582, "uuid": "61b16027-7e2f-4b8d-957e-f9481c59b6c8", "value": "T13034DF11B7B0D432C1AF45318D96CBE45A2EFD3189B1650377353AEF6E70BC1A62A70A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671187582, "uuid": "da8ae898-1643-464f-9db9-5e04c82e2eac", "value": "807baf2431f1bb1a8bddbe264b439a93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671187582, "uuid": "7a5c5cc7-2790-4abe-ad65-14e5b11888f4", "value": "3072:pYjhhZxzglWLdYgznCkJ5Ui3sa1E3L8GyeNQeZxLQ2mppGT883oJdHHtWqMPDcf4:2hhNLdYgznCS3zILOt03G8qMrc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671187582, "uuid": "f43b8b86-e272-40ef-902b-a997a3b3fc66", "value": 240640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671187582, "uuid": "d0d14c2a-2ab7-4279-9c44-544076de8e75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671187582, "uuid": "1a85bf64-e203-4c54-b325-cad209697057", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5237b809-7cdd-11ed-9db1-42010a9c0080", "comment": "Malware payload (AsyncRAT)", "timestamp": 1671152552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671152552, "uuid": "aad9ed77-8cd5-4bea-aadd-006757f99c7d", "comment": "Malware payload (AsyncRAT)", "value": "019911e444e2adfbda459f685ef41951", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671152552, "uuid": "92031ff3-5119-4567-879a-1042c5e5cd25", "comment": "Malware payload (AsyncRAT)", "value": "66c396a2de0735aea2c247bc06a56d2456ab5c83c4dd1bbf147737a303a34b46", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671152552, "uuid": "b2a2b436-974f-4548-90f3-7729146648c9", "comment": "Malware payload (AsyncRAT)", "value": "2bf98dbd966482159b4cd70d232ec57f407cb267", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671152552, "uuid": "44676ace-3f24-47c3-b9bf-c3d67c7464ef", "comment": "Malware payload (AsyncRAT)", "value": "ae1fd15d24a0f36f167e9e13adc1335a3fd0706883e7d90cc30f2d46ce54ceb58732e9c1886d03bfd1362438025c1d49", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671152552, "uuid": "d6674758-10e3-4502-b932-2f95238e99ba", "value": "T123532B043FD9D126F2BD8EB4A9F3754449F9F2576902DA4A1CD442C70632BC689427EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671152552, "uuid": "ce839079-3219-4b2f-884b-61158cbc861c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671152552, "uuid": "63453c25-e8b5-4cf7-ad81-beaa766bb710", "value": "1536:gGFcUOY758NiXSkmLabJmvpKh9yq2lkUq7Vx:gGFcUOY758NiXSkmLabJmghUvkUqBx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671152552, "uuid": "72611349-a509-414e-af52-bff05355d9ae", "value": 64000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671152552, "uuid": "c2a8db72-3104-411f-9501-8de0136581a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671152552, "uuid": "7294ca4d-569e-4940-9d9c-b5417d79d002", "value": "Stub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae3bc793-7d39-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671192220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671192220, "uuid": "03bcfd7b-caae-46a4-a167-10d838b64cd8", "comment": "Malware payload", "value": "f3bdb49ae74c4cdf4456ed3a09dfc522", "object_relation": "md5", "Tag": [ { "name": "blacksoftw-com", "colour": "#88A5F7", "exportable": true, "hide_tag": false }, { "name": "fakecrack", "colour": "#E25CDD", "exportable": true, "hide_tag": false }, { "name": "pw-soft", "colour": "#C772CC", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671192220, "uuid": "d95b9cf3-2cc7-4075-a03a-ae86655cafc2", "comment": "Malware payload", "value": "67f73debc90aea67b1b1df080bfe11d064d2b15ce07d22b946984bf13c740ea6", "object_relation": "sha256", "Tag": [ { "name": "blacksoftw-com", "colour": "#88A5F7", "exportable": true, "hide_tag": false }, { "name": "fakecrack", "colour": "#E25CDD", "exportable": true, "hide_tag": false }, { "name": "pw-soft", "colour": "#C772CC", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671192220, "uuid": "48089961-5da6-486f-b57d-3a0920a359ca", "comment": "Malware payload", "value": "907dfb19b64e71cb53463635d19c18b24385c42e", "object_relation": "sha1", "Tag": [ { "name": "blacksoftw-com", "colour": "#88A5F7", "exportable": true, "hide_tag": false }, { "name": "fakecrack", "colour": "#E25CDD", "exportable": true, "hide_tag": false }, { "name": "pw-soft", "colour": "#C772CC", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671192220, "uuid": "ec2938f3-631a-44d1-94c8-2e25415f4885", "comment": "Malware payload", "value": "a1ae3a28504f5364af2e8509947315c054a46d10809ba7f10ebdeee172f932635e2b6cf90c84cb12dfdab5877c2ef72d", "object_relation": "sha3-384", "Tag": [ { "name": "blacksoftw-com", "colour": "#88A5F7", "exportable": true, "hide_tag": false }, { "name": "fakecrack", "colour": "#E25CDD", "exportable": true, "hide_tag": false }, { "name": "pw-soft", "colour": "#C772CC", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671192220, "uuid": "e7cb005a-72e6-4ed5-891a-d0a0bbcfddb9", "value": "T1AE6423B3B4E6B2A3369C72158859E2DCEE61ACA0334878099097C25D37369CDB4F7D47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671192220, "uuid": "e23d5074-aff3-4fc8-b01d-cab8d5aab038", "value": "6144:Ppr/m1wtVS4MFg6myyrwZnXejK7KwHYqCUx18G1KBvlWGwwwU2MPsjy1ESlcc:Pwiq4c9m1auqK3rC1KRlfT2Mmyvf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671192220, "uuid": "e6a99722-3ada-4514-a128-12c727aa1c81", "value": 318430, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671192220, "uuid": "1bc35822-a78f-4684-acea-840b3abdfebd", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671192220, "uuid": "e3f90b88-bbe3-4613-9d18-de4fa9392009", "value": "File.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb385483-7ce4-11ed-9db1-42010a9c0080", "comment": "Malware payload (AsyncRAT)", "timestamp": 1671155815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671155815, "uuid": "fef00f48-3a85-4e58-95b7-6465f99dcd61", "comment": "Malware payload (AsyncRAT)", "value": "fb15d35b386dd9f9cadfbd8dff55b7d6", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671155815, "uuid": "b75b20ce-a239-4b51-89f4-d28fe62eefaa", "comment": "Malware payload (AsyncRAT)", "value": "6a4bde618c5f4a8d087364e26be121e332f35f947baf55ba4c02a4f796cceda9", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671155815, "uuid": "4e0beae9-9d6f-40a5-8696-112bc9aabbce", "comment": "Malware payload (AsyncRAT)", "value": "1663084c6fb2404fa0be3f3ae1170589f6df8ff2", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671155815, "uuid": "6a7b924e-8c38-4a9e-9b51-1758d928cf99", "comment": "Malware payload (AsyncRAT)", "value": "8c870956e004d1ed7c8c8895f5333197f952b02b5823cf76c714445339dfc1c662929ac1f58a8fd85470f0bd397db64b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671155815, "uuid": "99bc391c-efd3-492e-8806-f1c6b6d9d909", "value": "T1B234FDB5A4A7C89AFE5ACB40727CFFA555B271B399C80A30133C6504CBE9F952E4C14E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671155815, "uuid": "fcf1d751-549b-4c02-86ff-640beb2b592a", "value": "1536:h3aRvIDi0gcXRI65uSiNdnYJCmLEmg7Tvve0pAGFBQDp/QI+OcD/55j9VyAGuELw:uC6S/QI+Ocvj6cmGfl+owmGcAg3Ap6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671155815, "uuid": "6d5f385b-2e47-4898-a71b-281d6c50a347", "value": 248875, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671155815, "uuid": "ecd21121-593b-4c0c-be3d-a1ef6a44e840", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671155815, "uuid": "9b7efb2c-c4cd-4ae8-aea7-be647bed8f1d", "value": "x.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c762798-7d7e-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671221665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671221665, "uuid": "ae66e07c-93b7-46df-bcf0-16e484f4e353", "comment": "Malware payload", "value": "d66877cb5fb47178b207e3b4a7e8d8b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671221665, "uuid": "f57c4211-b227-42ed-89f8-4bc06358f167", "comment": "Malware payload", "value": "6a9d7a409663799a4c3dd3dfc98db0671b59d293893365c87ee28a98775bffa6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671221665, "uuid": "7af54320-af68-4e15-8e00-76da5e3ca740", "comment": "Malware payload", "value": "30cd34b85545877e08e40cede617d8376074b595", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671221665, "uuid": "d9419695-49d7-4655-b7c8-289bbdf729eb", "comment": "Malware payload", "value": "704bc3f04628a9870659066ec48145795f2b45616ca504ba91895199a6d74c3a08d4eeff8ebc5eacf0cb45c2d588dd1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671221665, "uuid": "d01600d8-0f07-47b5-869f-17ee9b21f826", "value": "T11324BEF076A0E47EC152D7318819DAEC996ABD114E2295F33B14262F6E703D05AFE23D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671221665, "uuid": "6ffce159-edca-4e73-a3e5-ea68d8811d10", "value": "55ba8cd792699d5c43b351a2daef2eff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671221665, "uuid": "5f87a2b9-a39f-423c-917e-c94b11d6a451", "value": "3072:PL3uy3hLK4mfhl0RRMCwyMk2QkjQmNLszFoaO40zwUzQRKF+:jlxLdmaEBQ2fNgzFoB40M2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671221665, "uuid": "56762805-fd66-4805-82d4-0468997f7a84", "value": 219136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671221665, "uuid": "5a8a9621-3191-45a0-b483-da5cec4088d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671221665, "uuid": "e0209861-d85e-47ac-a1d2-065a2461150f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c43d070-7cdb-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671151817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671151817, "uuid": "e3ea92a4-3e83-47ae-8ae7-fd083c7741c6", "comment": "Malware payload (Smoke Loader)", "value": "ae9e2151503f2639fe943fd0e49332cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671151817, "uuid": "d55a537d-e000-4c31-ba91-ffc319edc948", "comment": "Malware payload (Smoke Loader)", "value": "6a9e58cb348afebb07601988820abb0a3f727abd271a18363b7beb405d1ae5d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671151817, "uuid": "068e1613-ee8c-448d-a9d2-53bd73341701", "comment": "Malware payload (Smoke Loader)", "value": "d328f46ac79485ac6ba08f3d4ee02c73c8db23ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671151817, "uuid": "7b3b8683-4d3c-421a-be6f-997aa7e5f285", "comment": "Malware payload (Smoke Loader)", "value": "ac3b27b4c6f7ac64d7f95892b8007c457aaaeee0c327e5217f69ccaf78a6f2b5c10bf23e968241891ec8c3585b374526", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671151817, "uuid": "e35b9065-0f46-4a47-b619-353b5bc416b5", "value": "T18374CF007AB3E4F1F932C5754826F7F46669B860FAA5D533B60AD30FAC313939926319", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671151817, "uuid": "61a532a3-5f3a-45a9-9bf5-8f2f20bebe97", "value": "2067eb05796787c0f2b3dc09403197ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671151817, "uuid": "17b3d454-65ad-4f9e-be64-740dfed7e6f0", "value": "6144:MOYYGLACP0ntV1dM/tsAmtGe/d2ao1DJX0iPvzpQ6ijLxQFiaI:9G/PIEtsbtjVo1DJXxnzpQ6ijqF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671151817, "uuid": "b3940feb-30ae-4a58-8592-29a73a9d3f6c", "value": 341504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671151817, "uuid": "0b3c945f-8916-4c71-9a14-14eb6b21603e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671151817, "uuid": "f8da5ed8-2067-417d-af95-62bea35e03f3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de423685-7d6f-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671215494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671215494, "uuid": "21a501fb-8bd5-4893-a0e8-bbe1da296916", "comment": "Malware payload", "value": "4569f81ad725c65ab4ce8c6bb4adde58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671215494, "uuid": "32e7b34f-0dd0-46ee-b487-da49cc5b1fe6", "comment": "Malware payload", "value": "6acde2d4a9ae84d6772ccc4c8f027e72e735b7a1665624fbce6bd1f3ddc62c16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671215494, "uuid": "1eb2e399-40ab-4b16-bea8-35669f641cde", "comment": "Malware payload", "value": "e0290ecc4fa208719967115560bd4f5e6854ca12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671215494, "uuid": "ee5c3294-3229-4c8d-9206-bba75b31a776", "comment": "Malware payload", "value": "0d23aacda0b58bd762d9c93af98297601ea492f199fc7bab832e23990524dda7c6ed28923333ee9562402e7a8fb4ca88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671215494, "uuid": "36921e60-5c22-4248-9108-ce8f915da564", "value": "T16474E0F02690D46EC165C3308D25D6E4A63AAC505E2586F32B147B6F1A716C0AEFF37E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671215494, "uuid": "2a21e6e5-6d87-44da-8ffa-ccb35c65451f", "value": "3670997c8c2669588bad5b8c178dedd4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671215494, "uuid": "924f5c12-a6d7-480b-b5ba-638469210bec", "value": "6144:k6ML+HAtMUPIP5mM8+l41tOZbykYAhnf7gK6Kg9TjBfbgzH440M2b:k6M0IIP5mssOsjcR6Kg5jtU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671215494, "uuid": "5378a3f8-144b-4ebd-b4ae-ae4ff34adad7", "value": 342528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671215494, "uuid": "bf9c7fdf-e8ed-489e-9211-22a1c6338964", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671215494, "uuid": "2ed972da-6006-449b-b4f3-901da976fd9b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa81bfef-7d1c-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671179893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671179893, "uuid": "1d893014-093d-4411-ac25-d82abf8c0411", "comment": "Malware payload", "value": "feb31139c26b083f45bac3fedd811e2d", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671179893, "uuid": "7358f7ae-490e-4d6d-ab59-f3dd958e74da", "comment": "Malware payload", "value": "6b0f67636b41da6d6f69d57dd2b421c140ee5090c168eb09b08357c00eb1963d", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671179893, "uuid": "89bd586c-fc6e-4ce5-b0f6-da88fd914d6e", "comment": "Malware payload", "value": "8c2b7d9d9a953a9f944c141498724da53624a12c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671179893, "uuid": "b003d57a-d9d0-4eae-8a82-fc73bad7dab7", "comment": "Malware payload", "value": "e44515a5d4f7cc9338d2f9863c049b7f195118aca62d560b792b7542b1615ecf2f272362f35c2305aa32b2923c6a51cd", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671179893, "uuid": "69641c5f-e90d-40c1-b434-446a4998cf98", "value": "T1C361172A3C8D2CC6DB6B18A3E930BEBD145EF0B15DCE5AD0308AF9E0092E22D7950D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671179893, "uuid": "c04d4f4f-df01-45fc-9101-8c83be54b4da", "value": "96:idnxvrRnmJVFEHWhgVhDDYrBMRpt+85Rz6GY5lI:iB9rFkAWhnBapoxGuI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671179893, "uuid": "64361f19-2b84-4aff-8f4b-6a17efcde08c", "value": 3323, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671179893, "uuid": "e18da619-26ef-411b-8232-ce76f6eca1b5", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671179893, "uuid": "f07b98d3-0161-4571-add6-21de2adb7e07", "value": "000003_20221206.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64f696b6-7d2e-11ed-9db1-42010a9c0080", "comment": "Malware payload (Amadey)", "timestamp": 1671187373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671187373, "uuid": "dd6c4302-874d-4b88-9031-199de84d64d0", "comment": "Malware payload (Amadey)", "value": "5042366fc8a3711d86f436285b41d5b1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671187373, "uuid": "5366865b-fe31-4b46-8536-04c6acd1faa8", "comment": "Malware payload (Amadey)", "value": "6b2b43b211d67ed0609ef84453212749a401057ac30abb9b06d54e0021b8c727", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671187373, "uuid": "08403678-69de-4e83-a48f-8cf421d1c2bb", "comment": "Malware payload (Amadey)", "value": "c752fac2871f71950b656e797bf1460218f337ee", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671187373, "uuid": "f362cce8-f8d1-47a7-9bf9-6dc809bc77d9", "comment": "Malware payload (Amadey)", "value": "ead5a49f3a7b3c1366c29664cd423b949efc5bd452901beea3f0665a330c0b87624dd8c490ef3987c217965b52cc859a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671187373, "uuid": "ecd95a7b-b2e6-47c9-98b1-c2b36332272c", "value": "T1A754E11172B0C032C16F1630C962D3E58A7EFD311E71E6473776B6AF6E30A91662B74A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671187373, "uuid": "706ec68c-4a51-4f5a-a30d-515f91778122", "value": "915ad03d5b3522248c2c91d75d5158ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671187373, "uuid": "08e72f2d-ca1e-461f-af71-d6fe0c3c2099", "value": "6144:n+htxLmN3xDrdgwOJyzIUkILYPNkQ/Optse8qMrc:n+htx23x9VThYPGv8n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671187373, "uuid": "ee4e3e7b-ce78-4fb5-ae6f-06971b30ea38", "value": 293888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671187373, "uuid": "534b1d6a-bc90-4bb8-9244-09325fa368b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671187373, "uuid": "61cf3dd4-a423-4982-af8a-d01365d168da", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce458711-7d65-11ed-9db1-42010a9c0080", "comment": "Malware payload (AgentTesla)", "timestamp": 1671211172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671211172, "uuid": "f6bb6ff0-7229-4189-9a2e-03b140a052d4", "comment": "Malware payload (AgentTesla)", "value": "c8233716e0395010570404444ddb99cb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671211172, "uuid": "6073dbe0-4327-493c-b494-168865b89a56", "comment": "Malware payload (AgentTesla)", "value": "6b94f193ac7b1023c525eade768ff0fe7410e4037d34b6d11e8f4ca1f9187df4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671211172, "uuid": "8623b144-90e5-4cb2-9192-e5de36ff51d9", "comment": "Malware payload (AgentTesla)", "value": "d5df6b8ef6a41f87634ae736c87ccba32aa18719", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671211172, "uuid": "1ad82a8b-6b14-4b77-9231-5e0b733f4b91", "comment": "Malware payload (AgentTesla)", "value": "0135fed10cad8fc2db76e20779c9fc1ef5ad7c2327f002a35c6662a223c7bb8656fb4c1e8e71698f45bbdfee7f728cbe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671211172, "uuid": "74a08a68-07d2-4b33-a1a5-225b50c111e4", "value": "T174057C0A70D88E58EB46EBF10650B5B036933FAD25DEAA3D4EE93F4D0432618DD252DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671211172, "uuid": "87864e6c-a8dc-44d5-a33b-9b79f5ccf838", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671211172, "uuid": "f7f97cf5-d184-45ab-b881-7d405e715d21", "value": "24576:hTA+eGdQUSYBZ6EAP5YNo5wKWEoZYM5Z:hTA+eGdFuFP5yo5wKWE5M5Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671211172, "uuid": "219cb3bb-e44b-4da1-a6d9-6cdf1c6b4966", "value": 860160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671211172, "uuid": "a5dff41b-b633-42d6-9b48-0339c2524b93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671211172, "uuid": "5fd819bc-6f23-48ac-861d-aa8d35624202", "value": "PO-136942 227pcs Sample Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c970bd5c-7d46-11ed-9db1-42010a9c0080", "comment": "Malware payload (Zegost)", "timestamp": 1671197849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671197849, "uuid": "e4f68bca-7674-4f5b-8629-375db218be6d", "comment": "Malware payload (Zegost)", "value": "6e9d5145a5348c57af6ff82df4e523d2", "object_relation": "md5", "Tag": [ { "name": "23-106-215-217", "colour": "#1B858A", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FakeGaliXCity", "colour": "#607CCC", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SpaceCity", "colour": "#5EBE6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671197849, "uuid": "9c9fb968-ca5e-4142-a86f-8edd6091bc9a", "comment": "Malware payload (Zegost)", "value": "6c36f537ce6cad4fc9ba7114286d295dd7756a593703ab01d1eb15b68219ba58", "object_relation": "sha256", "Tag": [ { "name": "23-106-215-217", "colour": "#1B858A", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FakeGaliXCity", "colour": "#607CCC", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SpaceCity", "colour": "#5EBE6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671197849, "uuid": "84f7315f-0689-4945-b01c-2e87cca9b682", "comment": "Malware payload (Zegost)", "value": "b986310cc8c72938f2b23a7665f16983809f21c7", "object_relation": "sha1", "Tag": [ { "name": "23-106-215-217", "colour": "#1B858A", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FakeGaliXCity", "colour": "#607CCC", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SpaceCity", "colour": "#5EBE6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671197849, "uuid": "d9ec7cf7-1d2a-4e48-a5d6-690953dcb326", "comment": "Malware payload (Zegost)", "value": "91f7a357c02f2690edb87a1ce4e77dc1f5c58218d3329d3f4679a45b0b78ca509e075cc91541f088e2d57e5966cf969c", "object_relation": "sha3-384", "Tag": [ { "name": "23-106-215-217", "colour": "#1B858A", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FakeGaliXCity", "colour": "#607CCC", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SpaceCity", "colour": "#5EBE6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671197849, "uuid": "127aeb37-b353-440d-9a11-59ed7a6acbc1", "value": "T10421EEB27453F247DAB01815887E3701770EF9177D945D4AA2B4B8E4F8C2486AA183DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671197849, "uuid": "da08907b-1e29-4a24-9e34-9623b1ea7b10", "value": "24:7xXOowJlURzRghCqhJoV7ccV3M/9um1B+Vl9RZLDltUgX6LH9:pOoklUR1gwq7oV7n+lfn+JL/ltUgX8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671197849, "uuid": "2c481e66-c0e9-4dca-93bb-81176182d22a", "value": 1341, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671197849, "uuid": "6dd72ed3-68b1-45bc-85c2-51b64b672834", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671197849, "uuid": "3de67950-ef40-4f0e-9fe5-cd254d9dabcf", "value": "87PK772R.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "406d6bd9-7d3a-11ed-9db1-42010a9c0080", "comment": "Malware payload (Amadey)", "timestamp": 1671192466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671192466, "uuid": "9c0d8bcc-9ce2-451d-b67f-79787ab0a612", "comment": "Malware payload (Amadey)", "value": "0d19dd34e4a3cef4d08487cec753152c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671192466, "uuid": "855a15d1-8537-4078-b6d9-8de731428d50", "comment": "Malware payload (Amadey)", "value": "6cc55822beeb659db5a012f49e425b5ef485f230dbe2e34b92654127151ac8db", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671192466, "uuid": "80aa4412-d78e-4a34-a8a9-571d03362a23", "comment": "Malware payload (Amadey)", "value": "9df832af91f699cc204a75f772c0a06cd94a3584", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671192466, "uuid": "04e341e7-e0fd-4348-ae35-0bc7852b0d9a", "comment": "Malware payload (Amadey)", "value": "83d94accf45663d3d295b1a15d76f61a4cc632c646f0a2bfec0efd5fbe16970dbec6835b69d9b99e05c4a404c838a26e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671192466, "uuid": "37c41a06-91f3-40e1-8d7d-34388818df5e", "value": "T1E654F121B6B0C4BAC15F05708956C2E05A2DEE315E31960337763BEF2E30A91B53BB9D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671192466, "uuid": "59f6e186-d140-48ef-9784-e8939455a5b9", "value": "e21f10fb81de748812499eebaf8a1cc1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671192466, "uuid": "48855202-1db8-40cf-87c8-4c537f5f4119", "value": "6144:4TuffLa3ABzimv3vXxyJAxOegbDx6UCJtps5U8qMrc:4TuffYamANFskUgfs5U8n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671192466, "uuid": "93cc38a6-9453-43d1-95e6-3012118c30ab", "value": 280064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671192466, "uuid": "f64c77e6-66c8-4b73-86cc-a8a95302f0ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671192466, "uuid": "cfd8a2c0-1b32-4974-a8bf-efc9b7d55286", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05ed76d1-7d20-11ed-9db1-42010a9c0080", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1671181201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671181201, "uuid": "e78af63a-7135-4c44-a475-ec3b04da2b2b", "comment": "Malware payload (AveMariaRAT)", "value": "c97e0614fcb0a15ac753ac6761278174", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671181201, "uuid": "5ba8ae16-0acc-48ac-8bea-c2f9f3f6f989", "comment": "Malware payload (AveMariaRAT)", "value": "6d28cc21516060b0c31dae6a4a8f3c4a23ab261e9cc00fa8a836e0efaf700e3b", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671181201, "uuid": "d4ed23b4-2364-4881-a7d1-0f8164c5cb4c", "comment": "Malware payload (AveMariaRAT)", "value": "960474a0aa0811bf3a09f31c4270a485c084fe5c", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671181201, "uuid": "78644f46-28a0-40d6-9e26-36a47b440df4", "comment": "Malware payload (AveMariaRAT)", "value": "b5e837d8454c5446e29812bda6994563af4aa4aa401921668dd0792ef5df122bae73c5dc561af6e53ae88e4d0f5e5746", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671181201, "uuid": "dcd15011-da1c-459d-be6f-6afa5a4e7202", "value": "T17B33E51A33FC8A22F1FE4BFAA4394110833666678632DF4C0DDA25DA466B3C05D95F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671181201, "uuid": "35aa3476-45ec-415f-bc29-573c6303fea4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671181201, "uuid": "0ba42f03-11df-4fb0-83a9-2244dd8f343e", "value": "768:KjQwEjkAi6TQDpeJhR62JIWoyk8IfUq9/TBYkEhVK1lEY6n/K:KjQwJAhJq/9/ik4V0l2/K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671181201, "uuid": "a582b657-6fa4-4d3a-998d-e88292c9065a", "value": 51200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671181201, "uuid": "57fac7f1-b805-4930-a95f-2b475d9abefb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671181201, "uuid": "9b08b730-600d-4f97-9ced-8758487a1dfe", "value": "253-03-22121705-01-(UNIVERSAL-WAFERS-TWN).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dd31e60-7d2f-11ed-9db1-42010a9c0080", "comment": "Malware payload (Amadey)", "timestamp": 1671187844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671187844, "uuid": "b5254540-6ba1-49de-9fc6-2b8ab6c013f0", "comment": "Malware payload (Amadey)", "value": "f4ea3c569a58d13de2694ac45d0faf49", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671187844, "uuid": "d5aa67e4-5366-4b5d-a779-ae8d3760cd31", "comment": "Malware payload (Amadey)", "value": "6d8ec9353bb2e59cd687e526c71a6b9c9f2c88ff8a56c30b928e62e65046061d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671187844, "uuid": "7266469e-1b87-4dc1-bc39-c4936efd9c4c", "comment": "Malware payload (Amadey)", "value": "0e56c7d6a594a5be346c4c0635cf5a1a3f422498", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671187844, "uuid": "8ee4483a-c271-47c3-a75a-69773006deaf", "comment": "Malware payload (Amadey)", "value": "c942fc145142fe4eed2eea3e019d2cea94b9661c09eba942a4b666b686d5b723767acc08100f4ee03500958ac99a89c3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671187844, "uuid": "f0915e19-9338-41d2-a950-3ea4c4ebf697", "value": "T15B54E012B6B0C032C19F19718969CBE59A3EEC311F71A547733D3AAF6E307D1662A349", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671187844, "uuid": "faeba372-4667-448b-a04b-21002ba415da", "value": "807baf2431f1bb1a8bddbe264b439a93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671187844, "uuid": "5d0c6605-1433-4e1b-894d-3a24379a34ea", "value": "6144:pWhpLZISv08vSx1nnyz5xbFTiv+Daqtl9B28qMrc:pWhpyM08v0oxBM+uqj/28n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671187844, "uuid": "23dae4f6-a580-4d8d-afed-35d208b19780", "value": 302080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671187844, "uuid": "b0dc1ff8-3c6f-4b07-ab6b-47a4a5a9fb5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671187844, "uuid": "9d420fc4-7be4-4c2f-8c54-9d871be04cc2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bae17827-7d69-11ed-9db1-42010a9c0080", "comment": "Malware payload (GCleaner)", "timestamp": 1671212857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671212857, "uuid": "6388149d-f960-451a-a448-86e57609655a", "comment": "Malware payload (GCleaner)", "value": "5492e5f169a879f7e6cdcb668f70622c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671212857, "uuid": "d2e2beb1-ea1c-428f-948d-6945c0197817", "comment": "Malware payload (GCleaner)", "value": "6e81247fef4c285699e01e78060688d414c90d87736964c57e6ba5eba0244d74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671212857, "uuid": "7e72c107-911d-410a-ab90-eeb0f307169e", "comment": "Malware payload (GCleaner)", "value": "3fe4df3fdeb6b5c01167b0cec423f27c825a73e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671212857, "uuid": "1fb5d971-ec73-449c-a9ae-1a03d8c3eea0", "comment": "Malware payload (GCleaner)", "value": "0abef65181d7f70e1b5b018927d68360de9ff5917e7a2650de25b1004b00d4142f844e2120b62e19056cb012c809d860", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671212857, "uuid": "e8b6442c-d6a4-4887-b6aa-8a50b4987f67", "value": "T18CC523BFA48514B2D0FB48F43C29AD2284F77E171864E80E3BAD7E6AB3F25D11913549", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671212857, "uuid": "16e79fae-f42c-431a-a49b-b298f28f84e5", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671212857, "uuid": "1055d1d3-3fb5-4b63-b3bc-f10067f3793b", "value": "49152:opQ+9ApcN+FVKCKK/DSqirj3ITUuKP+qcFaxJpZenpqiXwkreOCgSY/imi:opQ+OpW+bKCKkDKQ4utatMlrcY/imi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671212857, "uuid": "90cea68e-3904-49a5-a3db-c57f75abc68e", "value": 2584174, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671212857, "uuid": "3a685e2b-74b4-4183-a94b-ec6ca94aac3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671212857, "uuid": "9e1ba9e3-010d-43f4-a02f-b7f9d1b4fdfa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7193df45-7d1c-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671179663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671179663, "uuid": "f09e6400-b676-4da0-a3a6-b86e809a68a7", "comment": "Malware payload", "value": "acf4e96f632122fa1a077ccd63da8663", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671179663, "uuid": "d0d5547a-c8cc-4546-9e8e-58aec7f12c32", "comment": "Malware payload", "value": "6e879608718f93231950e53511e5b1018068f35456fdf07c339b04c6990f7f52", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671179663, "uuid": "d7418eac-7c29-4e2c-8cc5-3f7799844758", "comment": "Malware payload", "value": "337e2adce6334fd0ac7d52ba815b14f67e2d466c", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671179663, "uuid": "257e16e8-f062-4079-a574-7364624ac17b", "comment": "Malware payload", "value": "8e6c7f04adfa8678cd358bcd3fedc33fdb0eb0cd3151afb2e53b731aa7cea6a474535ce8f22d05d28c33ccbd95e765ef", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671179663, "uuid": "89649938-f108-4921-bc4b-640e63c38e43", "value": "T13685330481A982215C79B7F686DC2DE229B4025DC72536F16B4DFE75AF5CFEE9BC000A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671179663, "uuid": "1ab0a6ea-7037-4cbb-8e76-7fd99a704b25", "value": "49152:KbPPI7EWi17LuNfJbn3K84OrVybLA0HML:KbXI4Ztyvna84OrVy6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671179663, "uuid": "408f4fcb-f715-4d08-8f2f-17354b053204", "value": 1763270, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671179663, "uuid": "505b06ed-8f56-4f50-8c2a-0cb690546351", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671179663, "uuid": "01034971-e36b-4cdd-aace-0a205819e24a", "value": "PO_NM18164975.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38c86e0a-7d95-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671231537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671231537, "uuid": "0a6cab4e-eb83-4334-98fd-8f7588e6763c", "comment": "Malware payload", "value": "86865165a5adaaa860b1a3fd82fb8525", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671231537, "uuid": "bc572daf-b4bb-4d46-9070-0ce30edc07d1", "comment": "Malware payload", "value": "6ed361ae83599cb34ab5b406114ed5249a635ab24b825b51702b84f20d20042a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671231537, "uuid": "e2dce04c-88e6-41ff-8d65-c91090c840ef", "comment": "Malware payload", "value": "b362fc8c005f6c35683fb29ccc489b215659fd46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671231537, "uuid": "b8ed8829-3c3e-401b-bae7-3cb60ef37352", "comment": "Malware payload", "value": "bdfbff3fa29e679b06298fc5e8e4e0a92c0ea7b079cd70341903bec0f9caeb4048e02718e7f48a75f3d431515e654df6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671231537, "uuid": "bab3f5fd-19f4-4565-abbf-74f29ce950f3", "value": "T19C24BEF137A1E43EC151C7308819DBE4952ABC215E2295F32B082A2F1D766D19AFE37D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671231537, "uuid": "2fc0e448-8436-4686-a85e-bf79aaab70d3", "value": "aa9c378109186462717e17e657d0c833", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671231537, "uuid": "7d7ea65c-06fe-4429-9fca-c38f7df0f4f1", "value": "3072:jaTzPvLuWKSbRitCMscfzSaEyGxSNgDLszeW1HAyR40zwUzQRKF+:2vvLuWygmbSaETSCDgzeUgu40M2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671231537, "uuid": "e502fc13-c864-4de1-a992-564fada21b45", "value": 219136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671231537, "uuid": "3b234fd6-eaae-4850-b69a-412aad927598", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671231537, "uuid": "6a5de089-9195-43b8-91d0-20f2a037a1c6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56593c5e-7d7c-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671220849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671220849, "uuid": "7c85ed70-64aa-41d6-9b1f-b43577ac0e55", "comment": "Malware payload", "value": "cf52f30e135f5ad224c662fdc7956abf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671220849, "uuid": "3d34ce03-aba3-4d6f-9a53-030b9a3b6046", "comment": "Malware payload", "value": "6edf94a1944efb877db8d595b5c55b745aae7c1cac8c44df63236145830082a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671220849, "uuid": "e2145812-172b-4918-b9ee-1df4edcc16fd", "comment": "Malware payload", "value": "5c5d8dae03bea7d28a405aa72a2b78e7583ae9f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671220849, "uuid": "d2e412cc-8600-47b0-91f2-db6c6f80d1bc", "comment": "Malware payload", "value": "4005450ffa5c2b8d8739e188320b7d2074c6827b82a17e0fa2d533aee7f1a564ee5a6e998c66373186115a4e8881552e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671220849, "uuid": "31c80372-ccc8-4e81-85d8-7d9c97bf0c9c", "value": "T1D474E0F12A51E46EC182C7308C24D7D8A63ABC211E7155F32A196A2F1D317D166FE3BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671220849, "uuid": "7418ebdc-ab2f-434c-831f-b2a53f41eb10", "value": "3670997c8c2669588bad5b8c178dedd4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671220849, "uuid": "7e9e68be-bd28-42e5-a1f5-30cf1cff398a", "value": "6144:FWL6D1wAtUn34w4+ANH8yQD495xUYfgzoka40M2b:FWcmB34whUH8yZ9IVd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671220849, "uuid": "fd438fc8-9b50-45dd-8565-b96011f48e39", "value": 342016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671220849, "uuid": "a052d365-6430-434e-8fc9-72f685285abc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671220849, "uuid": "4020a40a-05cf-48c7-bd01-5ee7df879ca3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40e7f042-7d63-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671210076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671210076, "uuid": "80bbef06-4636-4c45-8c1b-1d2654a4e479", "comment": "Malware payload", "value": "55d1183935fa132cd3f5901feb0830bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671210076, "uuid": "fc43f4ad-cbbc-4060-b777-7f11f1485863", "comment": "Malware payload", "value": "6ee734c6f2b4fba1db0a951fab31491dc8769177ce7fdc6d29da8b79913dc1fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671210076, "uuid": "cdde64f7-d7a5-457b-b11d-4fe2ec0c8d4e", "comment": "Malware payload", "value": "8b8fc44387d6d6f6f357453cf39052e266b43a53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671210076, "uuid": "3102cf2e-fa33-4417-bbbd-8eaf669c57f1", "comment": "Malware payload", "value": "393bc1dc798ded30d047a4cde4105f2ff247612d97266080ec7e198f91804efd32a8a0216528b29dad7bcabeb5059728", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671210076, "uuid": "54ad9f9f-d06d-4897-b01d-b4842d29004b", "value": "T16E24AEF17690E42EC171D7318D25DAE49A7AAC105E2259F32F082A2F1EB02D059FE77D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671210076, "uuid": "eb01baf9-7f4a-46d0-ad6d-de2da0dc5063", "value": "3670997c8c2669588bad5b8c178dedd4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671210076, "uuid": "f8278ab1-341e-4e7f-b972-8dcf8ccd0664", "value": "3072:SSJH+L6Lp7F0RDOgvitBvfzaAa9FCbjpD+ADELsz7pco40zwUzQRKF+:zsLSp7+JiPvfzaAJjoAAgz7+o40M2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671210076, "uuid": "57958aef-e4f6-4419-959e-9586f66cba62", "value": 219648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671210076, "uuid": "0b74b3be-113f-4ab0-b527-fe37475b5fbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671210076, "uuid": "98d6273e-455b-4be0-b4bc-6f2120cf1fbc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46ee90e0-7d86-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671225118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671225118, "uuid": "b4174a62-a150-4caf-9fc0-570ac0aea2ec", "comment": "Malware payload", "value": "bf0df756e99e93816c92601f23bc5eaf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671225118, "uuid": "b66498e7-e806-4b4d-ba13-57159670c65b", "comment": "Malware payload", "value": "6f0be85cffdd59d4a1d520b6985820b6a62ad3978d3325be19b0c2f0e58dea14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671225118, "uuid": "00655cba-769d-41ef-bb18-eb05f78ffb95", "comment": "Malware payload", "value": "8cb8d7cd5b4f9946bf9378120b3b479e1788d49d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671225118, "uuid": "980f0c4c-7692-44cc-9eda-9c6621e2128d", "comment": "Malware payload", "value": "7c86806d06cb4c33f0526addb68df54663be6c233d79b9ed88f13611f60eb54940d4656c76fa272fea74a8fec62d4d2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671225118, "uuid": "d9585533-3b5a-4491-a12c-201fbb7540e6", "value": "T123C5082291713712C8ECC63271E90957EEF0EDD59C2912593F4F3D8A9B7D8814BE7A82", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671225118, "uuid": "368e4e06-0ee3-4f53-bfc6-cac538b8e245", "value": "ff0aebcebcc76030787a8c45223ad3bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671225118, "uuid": "30e825cc-ca78-4724-aec8-bbaf6b155cdc", "value": "49152:0OjmMTy3rFGnVpVYK/nmO+ZNAtkqX+qGk+:WK/nmO+ZNAtbXB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671225118, "uuid": "6120cd9e-2c0b-49a4-9387-5b57e6148459", "value": 2603008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671225118, "uuid": "61bb356b-e1f4-43a4-ac54-a4e2f091ea60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671225118, "uuid": "e06d7c52-01ef-4f08-9722-0acfe9f751a8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1fe2ca6-7d16-11ed-9db1-42010a9c0080", "comment": "Malware payload (Formbook)", "timestamp": 1671177275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177275, "uuid": "5f09617b-1891-4008-97bd-2dbf2e4650c5", "comment": "Malware payload (Formbook)", "value": "9e80665137b973febbf9128b87ac0af5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177275, "uuid": "cd08df61-891c-4eef-8025-bd1a5bf68606", "comment": "Malware payload (Formbook)", "value": "6f2b6e82f97c4b3ca9ffbdb88e0e5478b7ec144df0d8108893322c48b35ca701", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177275, "uuid": "9be8fdc6-188e-48d4-ade1-02c5c15f4a9e", "comment": "Malware payload (Formbook)", "value": "39a18501a2ad37479a4d12ff2c376e0587292cd0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177275, "uuid": "744ab2c4-6468-4f21-8447-0131dd29fdeb", "comment": "Malware payload (Formbook)", "value": "b95c2d43c71a21c972729e0be207d9507f0d9a874dd131ee0a89503c734027e69676507517d26ae49da9d1e9dc3cb899", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177275, "uuid": "b52882dc-a32c-4595-be54-ba9274eb28a1", "value": "T152D42C2839AA500DB3729E656BFC75B6D15EF6F226364C7B09F7020620129F0DF9C53A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177275, "uuid": "20f8405d-9318-427e-9fab-47a5770cd5da", "value": "12288:RbYtThQn6m7NK3Phs1UoqvjEXM1NdRLas0KPo4i8c6dT:qab4W+JaNO5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671177275, "uuid": "82ae3d35-3c47-45d8-b760-238ed6913ef9", "value": 640544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671177275, "uuid": "9989004e-2797-4cb3-adda-60481df98dcd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177275, "uuid": "5b057c01-cc4a-467b-843d-7d8d32927952", "value": "Ziraat-bankasi_SwiftMessaji00015122022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "884ecccd-7d19-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671178413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671178413, "uuid": "0c187a25-a457-41b8-8e0f-641b670f61f4", "comment": "Malware payload", "value": "8234dac34a5bcb59e31116d238e9a848", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671178413, "uuid": "debbbb73-a3b3-4665-a961-7cbc4f8bca77", "comment": "Malware payload", "value": "6f78bd7184bd1dfd970ea56edb2b8ed7458d3375cddd8014a05e0a66ac8e1913", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671178413, "uuid": "319c8225-0c19-481e-a78b-524fb73d8849", "comment": "Malware payload", "value": "35cf00db87401c4b82b3606400fb41376c3491d6", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671178413, "uuid": "3b94cffb-c776-4ca8-827e-6b91d699ea0e", "comment": "Malware payload", "value": "c4807de77ee9c21dc5947be822c6c929361f013b2245188200bea614109f05139157bc0364b58f6d3078c89e8a01007b", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671178413, "uuid": "beb9b397-e0df-4b9f-a54a-7d3c3e19c17a", "value": "T122429FB7DD42F91AC28B85BEC82655E4F21E21034612A21E2760764C4FD41D79BCB9E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671178413, "uuid": "907a1adc-c00f-479c-b51c-6502650e4cbb", "value": "192:ScIMmtPsCJdUxHkyfCGUrSn5bv/05cjubj4tzsAj07HBX:SPX1Y9fCGzIL4tjgHBX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671178413, "uuid": "2e9d6b26-2a2a-4883-83b6-b11120e82414", "value": 12625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671178413, "uuid": "937ddaee-0313-403b-b17c-7f3fa0d51857", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671178413, "uuid": "f5fa8dc8-c47d-4f2f-b801-20b149dd5d7f", "value": "\u0648\u0632\u0627\u0631\u0629 \u0627\u0644\u062e\u0627\u0631\u062c\u064a\u0629 \u0627\u0644\u0623\u0645\u0631\u064a\u0643\u064a\u0629..docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b5f33e3-7d52-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671202846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671202846, "uuid": "7e03c3e4-b75a-4187-99ee-d52908093667", "comment": "Malware payload", "value": "a3e96ebecf2698264d94c16a94eb3348", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671202846, "uuid": "2330c567-856b-41fd-ab59-e445d50e2bc8", "comment": "Malware payload", "value": "70920411527f8afcad28b950813e5994644a5d9a2c8e137b14f083fee6eb298a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671202846, "uuid": "f5b632d2-433a-4a62-9a05-0ed942545906", "comment": "Malware payload", "value": "2626c9f2dfbe19fb08b35d02ece651afd4d6d559", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671202846, "uuid": "36b9810a-f9a6-4e5c-a4e2-6c19a7bc8d07", "comment": "Malware payload", "value": "0ed0b52fb24162868f08b0d49c86e3d11d10262c5ea39c495c60d815c0ceecb50133b327ab093c940dae02402c5e0fbc", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671202846, "uuid": "a54242e3-216b-402c-813d-1c4fb1c4917f", "value": "T1E326334E93A84990ED2997BA9CFD0A37110E55ADFD2F2176B8AD3DC34B31D90078CC99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671202846, "uuid": "7606acf9-8d77-4326-aa0b-4517a97f8143", "value": "98304:pIM3OE2ppE25MCJoEv5ZGK07by3acyWhsdSk4Ex5r6VZRsTcHFh4aAzM:WCbaGEvLMby3a+hU595r6TPFaaAo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671202846, "uuid": "b982a596-a823-4d19-a396-875c4d255786", "value": 4745779, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671202846, "uuid": "f0c52f1c-2f26-4ff4-a37f-aa091cf0d5e9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671202846, "uuid": "ffe1d78c-eabe-460b-805c-fb98dcb5b9b7", "value": "brazz.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2f9f4e7-7d63-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671210348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671210348, "uuid": "bb43126f-6dc2-44b3-ba98-f7ba7c3b1a1a", "comment": "Malware payload (Smoke Loader)", "value": "6da366898946deb47ed51e27acbffa30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671210348, "uuid": "08401b0d-0126-434f-bc4a-6b7215f8b213", "comment": "Malware payload (Smoke Loader)", "value": "70db2b63edcb928ed57f8b4742d80364e6e8ad2f14ed6b33c43734ecee111d53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671210348, "uuid": "0074ac12-db83-4f34-8d7e-945f9824350e", "comment": "Malware payload (Smoke Loader)", "value": "35c65e8cbb0c003a7d8f80ff90af24aacf5f38ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671210348, "uuid": "fcd276f7-c50d-4ef0-be57-63afcc475f76", "comment": "Malware payload (Smoke Loader)", "value": "b4d227469180f55178401f058fd690cbad4705b3d7e7df472c78efc5cb5c678dfa9eab385653f23bee04dfb9ba73bf4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671210348, "uuid": "4c91d4b3-ea4f-403a-a60c-1807c9397d05", "value": "T16C24BEF17690E42EC151D7308829A6D5A63AB8154F2299F37B183B2F1D702C15AFE37E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671210348, "uuid": "558c4db3-1f0a-4774-bdba-defddeeb983d", "value": "3670997c8c2669588bad5b8c178dedd4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671210348, "uuid": "0228e714-c4c2-49e7-b520-a45ea81822d9", "value": "3072:Xa4/2LTWXR/0RS4wuUHel7rSHL+gjSIwux0pXLszM2Tjd40zwUzQRKF+:qLLCXaw7HegHqgjSIw5XgzM2vd40M2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671210348, "uuid": "a35cedef-9356-49da-9640-468e695dfd99", "value": 220160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671210348, "uuid": "2534ee12-9dd4-4f21-a3be-c926d3f92c99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671210348, "uuid": "8e0a239a-d512-4a41-bb63-3c967cc23c12", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5707ee99-7d18-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671177901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177901, "uuid": "73bc92e0-7458-445e-b528-a9d47970aa4d", "comment": "Malware payload (Smoke Loader)", "value": "9c06b180481364e6ca02d9fad0ef9638", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177901, "uuid": "b7bae8f9-3d9c-454a-b838-4f2371dc0049", "comment": "Malware payload (Smoke Loader)", "value": "7238758e84a1bbeb2feaaada73190bd8a8a6c7f74e9385701fcaa11e44050c38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177901, "uuid": "7faf831a-667b-415d-a29f-c5c64ba1f2b1", "comment": "Malware payload (Smoke Loader)", "value": "a3127f078a022817121a50724ad18adf89ca289a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177901, "uuid": "b67847fd-39bf-4a0e-9f88-975c3af3faf2", "comment": "Malware payload (Smoke Loader)", "value": "4ef83f9ae0164c00bc1f732d13a5830a22f9867ccb114127513704595dcddb5206fb0d3ed61a1f45609d3948b74a5b20", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177901, "uuid": "1da30ee6-d7b0-4b6c-becd-a5599bf6edb5", "value": "T19164CF017E73D4E1F832F5704827E7FC2669B850F9A1D637270AD71F9970293896A32A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177901, "uuid": "819244ff-6363-4023-9f42-bb366b76b45f", "value": "d134d10c41936619073a08bd546852f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177901, "uuid": "e16d7479-2e70-425f-a279-b3faa2c5d366", "value": "6144:MYrRLKH2oWLXwA9kE5+or5e/0iPvzpQ6ijLxQFiaI:d2H2DLXwI5+or5e/xnzpQ6ijqF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671177901, "uuid": "ef66fba9-14d4-4da4-9c14-6e8c94923aad", "value": 334848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671177901, "uuid": "0a8190b3-f306-4e41-b191-708cb976a36f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177901, "uuid": "b0599517-fdbb-4bd6-ab26-98b9c2df9910", "value": "9c06b180481364e6ca02d9fad0ef9638.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c020ac76-7cf8-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671164333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671164333, "uuid": "245d23f4-2efa-4a94-982a-4f624d2909b4", "comment": "Malware payload (Smoke Loader)", "value": "acaeb194054c9fe0219da00f1fde7025", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671164333, "uuid": "1bbcb5aa-58ea-4062-9716-4973e3241866", "comment": "Malware payload (Smoke Loader)", "value": "72473e50b1fc2a182514692b6c743add29885a78890d0df9de3e2beeddaea7d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671164333, "uuid": "8dea5c40-a8fe-45b5-99e2-c2c121504497", "comment": "Malware payload (Smoke Loader)", "value": "354662693144d4630a798e2635987d60bc919e88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671164333, "uuid": "f25930da-c2db-4e94-8fd6-5c64be13906c", "comment": "Malware payload (Smoke Loader)", "value": "6f4f10c553878d1a2e26bb423dc559ce62677f2a9b0ab19d4b916ad7c637baefc858289b40898fa6e67d5297f731262e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671164333, "uuid": "5c909929-bc3b-4806-9a40-6955e8258320", "value": "T1AE74CF00FA73D4EDF932C5715826FBF466A9B820AAA5D633330AD70F9D702938766315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671164333, "uuid": "f84de4da-036c-4b0c-9831-a2f531fc6d40", "value": "2067eb05796787c0f2b3dc09403197ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671164333, "uuid": "58368b9b-8c7c-47f9-94ee-141c9889fa48", "value": "6144:OLY5yL6RzEnGMLtR1wsglS4GV+EGqGW0iPvzpQ6ijLxQFiaI:TyOz4GgPicjUE7xnzpQ6ijqF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671164333, "uuid": "35d6979c-d9ee-4bac-9e7e-d4e27d2c0b86", "value": 340992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671164333, "uuid": "53eb7245-2b21-48c9-a28b-fbb39572e1c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671164333, "uuid": "3f3a55cf-154a-4208-9070-f6d117380139", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e2702e3-7cfa-11ed-9db1-42010a9c0080", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1671164893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671164893, "uuid": "89b6b29e-cf62-4532-8c53-126acd6fdb5f", "comment": "Malware payload (SnakeKeylogger)", "value": "e8cd37cdb75b3db0b9379963cfab5cfe", "object_relation": "md5", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671164893, "uuid": "7c3cbc2d-41cf-4540-8294-002812f08adc", "comment": "Malware payload (SnakeKeylogger)", "value": "72d39c29d29217fe8430dffe3bbc7aad2ed70d230e0b78f1dafa1a9d733566ee", "object_relation": "sha256", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671164893, "uuid": "b0b60a28-47d9-4542-a6b8-d4f4c1d4e328", "comment": "Malware payload (SnakeKeylogger)", "value": "1a16ba4478e00e25985f4eeefbdc2dc8cf540449", "object_relation": "sha1", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671164893, "uuid": "7f687814-1bc6-4290-af6d-88776b58dae2", "comment": "Malware payload (SnakeKeylogger)", "value": "7e77dad2006d7bf775a2e31ff89cecda70886d98710c40849089dec9fdb3b414f8032b010472758d1ad4f0a59be3ba1c", "object_relation": "sha3-384", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671164893, "uuid": "746536cb-883e-43b5-9da1-bdc404fb4e0f", "value": "T1FA031957F7D81378479201E27A1E1BD9FB2ED43933A09491386C926423A5CB6437BBEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671164893, "uuid": "f6efa1ab-ca07-4371-b68e-32bd9c3d8afa", "value": "768:uFx0XaIsnPRIa4fwJMRFx0XaIsnPRIa4fwJMFVlHB52gIHi46Y6+:uf0Xvx3EMRf0Xvx3EM3FKHi42+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671164893, "uuid": "3e7d9b88-51b7-44e1-afed-b87347e4af93", "value": 38731, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671164893, "uuid": "aee2481d-d42b-4154-8ceb-fba45427c5be", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671164893, "uuid": "9bf01d10-8856-46a8-9e51-fbbc109c5f3d", "value": "SecuriteInfo.com.Exploit.CVE-2018-0798.4.8214.13626", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d3ed626-7d89-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671226390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671226390, "uuid": "71a04a80-27b9-4d8e-8607-5f66276518d3", "comment": "Malware payload", "value": "a7094dede83e5d6e7567ee3e77a0bc5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Noberus", "colour": "#D12696", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671226390, "uuid": "22a2f12d-94b4-4b19-a965-f4409813d8fa", "comment": "Malware payload", "value": "72f0981f18b969db2781e874d249d8003c07f99786e217f84cf54a148de259cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Noberus", "colour": "#D12696", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671226390, "uuid": "c575868e-a566-4070-a08d-72bf961b1dd2", "comment": "Malware payload", "value": "c5e9d39e259a322a237ebedb29bb3fd00b2a1ddf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Noberus", "colour": "#D12696", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671226390, "uuid": "c35f46f0-1097-4fab-a048-329870f497a7", "comment": "Malware payload", "value": "c20b57f80f1b19d44de58ebb45a2b4c480d57d21b633197bbe8a834566ed936f1641a30726a738a930b2db5703593db8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Noberus", "colour": "#D12696", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671226390, "uuid": "6403a200-9b59-4dc7-8bdd-d99a91bdd932", "value": "T148E59E49FA9356ADCD671870341EB33AE7304A2D421E8E63D7E4DD64BE2E7203D8461E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671226390, "uuid": "df674f28-65b5-4f48-bcb4-84b8a8b66462", "value": "b9247c9e8d968989696a85c3451cc615", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671226390, "uuid": "211580fe-6dc5-4568-b2ca-980f0b89f8ab", "value": "49152:OUTGJr6qiAKBijlbwbbS1FNRp1KCdJ3NmRWG92XLYvxnqtf03mmmBQu5:uJr6QMCb4u1Fb5dNG92Ztm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671226390, "uuid": "758450e3-cdc5-4589-96d4-da45d970fe45", "value": 3132416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671226390, "uuid": "f67f5d67-f666-4b8c-88a0-79eac72fed33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671226390, "uuid": "9b5c7f8b-017f-43f8-8d96-068a63ef8708", "value": "72f0981f18b969db2781e874d249d8003c07f99786e217f84cf54a148de259cc.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01a61ff3-7d49-11ed-9db1-42010a9c0080", "comment": "Malware payload (Formbook)", "timestamp": 1671198803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671198803, "uuid": "fd582cf7-d9fb-436c-8c46-8b3b2c6780c5", "comment": "Malware payload (Formbook)", "value": "44cc963af98db0bdadeca7f215e34001", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671198803, "uuid": "92bb2d78-3c03-47ed-a5e8-735aecc211d2", "comment": "Malware payload (Formbook)", "value": "732a0908b58ddff1c6e701667a165ffcfd006b84ca2b15974d671eceffde0002", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671198803, "uuid": "9383e29a-74e0-48bb-bfa5-f8306f1c63b2", "comment": "Malware payload (Formbook)", "value": "057d7f5293e9f72a3b3781b475f41e1206341c5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671198803, "uuid": "a50d530a-25a0-44d6-9a89-3b88f1da0093", "comment": "Malware payload (Formbook)", "value": "904c838399dc646cabd7d0558392cee0cbbf00888a5ec186016c99e4c952ed8510b5f3ecc9fd6fa97614b266109f3777", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671198803, "uuid": "dc6e8c04-e32d-4870-baee-e923300dce0d", "value": "T15D74124303E060F7E2E61AB2C8BFE326D3B99E09418956431334FFD65C74ADB941A799", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671198803, "uuid": "a03eeaf3-e5d2-4fb8-b97b-f4a3804430a0", "value": "ab6770b0a8635b9d92a5838920cfe770", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671198803, "uuid": "804f7ac8-77b0-49b5-a98f-d761b1de07c8", "value": "6144:MBnADwdlZS8UOUhuUFzO5Ina3xQN+MkBfbNpR8QfU5VuJ1mGdPsTbPdb:RDwM8UvDNkipCT7R6OBPQPZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671198803, "uuid": "69c1fe51-0b7b-4c68-b119-0e053d1270b4", "value": 345269, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671198803, "uuid": "9ad96bf8-9617-4b52-9a18-0fb6e67868b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671198803, "uuid": "76b848d8-4bad-48a1-81c0-ee707abe4e4f", "value": "Neue_Ordnung_20220712.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3cf7ad7-7d73-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671217221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671217221, "uuid": "81b1433b-a6fb-4da2-87bf-802898145e5f", "comment": "Malware payload", "value": "bb15ec495846803bce49c14a17541e22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671217221, "uuid": "271d7c71-2dc1-4794-9f7e-e6f60b10ca5b", "comment": "Malware payload", "value": "73483b07b5131d89cd8a9b1a8a64643b23137d8e96c537ed45b91117fc800d68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671217221, "uuid": "b0958933-f201-445e-9ca5-97aa43a7f7a1", "comment": "Malware payload", "value": "fbd6865c40b91eddaa821b52aa662d5aa4172834", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671217221, "uuid": "ec043e9c-bca6-47d9-92e6-4be863514e6a", "comment": "Malware payload", "value": "dd45412fd0a983b11906a4e730ce348c3e94421138dac9a306af02de915fc895c451ed016177f5ae9872c9ab8d992776", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671217221, "uuid": "2e08464f-e3a8-4b32-b448-187cf62e4f6c", "value": "T13074E0F22A90D03EC151D3304C2AD7E5662A68105F2166F73BA43E2F6A706C159FE77E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671217221, "uuid": "db165ad2-d565-4109-b88a-96e6f7d5a128", "value": "3670997c8c2669588bad5b8c178dedd4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671217221, "uuid": "418a6530-438d-4867-aec3-a6e551765dac", "value": "6144:TaLnvr1rRxns4b2HE5NG+fZOulBfqmpuTmnoJgzxZ40M2b:TazFU4aHcvlQT6oS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671217221, "uuid": "1901017e-5ffa-4100-808c-e5dc300a31b6", "value": 341504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671217221, "uuid": "9f27227e-667a-4e1b-83fe-ceb432e1be32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671217221, "uuid": "25e797e1-f2ed-4a3a-941e-a8c37b843bed", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7640c67-7d14-11ed-9db1-42010a9c0080", "comment": "Malware payload (Mirai)", "timestamp": 1671176371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671176371, "uuid": "5ced81ff-6ddb-4077-925a-e7cf6b77e205", "comment": "Malware payload (Mirai)", "value": "4929e616b5e7cd87a88e98c2a2e8239e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671176371, "uuid": "5d510218-ae24-4cef-8933-8b5654bb9902", "comment": "Malware payload (Mirai)", "value": "743153d468739f7a5bd1643d9f78d5ddbbc3675e37671b2b312ad8076d836348", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671176371, "uuid": "a4f82a43-4fc7-4597-9910-b50138182936", "comment": "Malware payload (Mirai)", "value": "113c1357584f35291185b04bea74de44fdb3923c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671176371, "uuid": "38a6a6ea-2763-4013-85a5-14d4b6de9741", "comment": "Malware payload (Mirai)", "value": "439e418aa6135c9fc20f4ff598a215eb0cf979d014f5616848ee15f9a5d08eaf9a70062dba321bcfc706d3bc435a0dfc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671176371, "uuid": "82be062b-6927-4b7d-b9e8-20db90db3413", "value": "T11D533A51B8819613C5D4137BF6BE428D3B2523E8E2DF3217AD222F513BCA82F1D67A45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671176371, "uuid": "4be1c1c0-c85e-457a-8c83-e05143940ccb", "value": "768:lP6aHMzAR6hM2uQBTPpdxnlILKU0vVONyRgGhd2G4NMiplImpcvwJZY10UPZvBqJ:0aHuAzgjjfUKU0NONyRgG+7XtJa10oB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671176371, "uuid": "79ea7e13-b296-44fc-b119-df0ddb1d17c1", "value": 60760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671176371, "uuid": "7b898177-7196-4249-8bc0-fdb9b014739e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671176371, "uuid": "9f368d91-bdc0-42dc-bdc3-b8fe9dd63f3e", "value": "4929e616b5e7cd87a88e98c2a2e8239e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69aa703f-7d7c-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671220882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671220882, "uuid": "8f18dae4-74b4-4649-9a2d-28b4006e4c71", "comment": "Malware payload", "value": "b1ea66e7cd1cbbaf320fbf25d05f8770", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671220882, "uuid": "6e0ce35b-9d88-429d-8016-91718150815a", "comment": "Malware payload", "value": "7492fd9df7e90e257e22463c6f3a9fff2da125c88d03d388e8ed9234c95376a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671220882, "uuid": "bf027f70-a063-4ea7-921d-8dcee9110bed", "comment": "Malware payload", "value": "cb37565ad84e5c1b0289bf5c1f224c266c99b3e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671220882, "uuid": "e4eca2e0-df5b-401b-8695-420b13eedaa2", "comment": "Malware payload", "value": "6805defcfb4931d3032edf7ce2203543bddb92ccacb4f5e683023da7fd0aa29e614071e9bcf71e39557ae965ad2e7d65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671220882, "uuid": "7f6eb05e-8861-434f-96a7-a1a1f3261c42", "value": "T1ECB523BEE5900522D2B75AF97D36AC3195935C232D39C44D33D83F9B7BF69C18A0620A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671220882, "uuid": "17e4443b-4a11-474c-8509-543cb0ed9e45", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671220882, "uuid": "567c168c-a1ff-49f5-9fb5-8429e5b90985", "value": "49152:kp2hrHgro8FPaSRurObwLUPu1/2sMRyP4dl4zZb9KIi7r4ROiD+tfucWeOCgSY/V:kpwcvPNovw4/CRywLcbAS5EucWcY/imz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671220882, "uuid": "821feb18-45e9-4fb2-8fc8-27f5b83e36e7", "value": 2377148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671220882, "uuid": "0c57aecd-0c65-4223-8bb1-9efcf2d9d287", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671220882, "uuid": "bf024087-bdfc-405b-9d0a-a9719fb9b006", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "777c2e06-7d59-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671205872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671205872, "uuid": "d032242e-80ac-4a1a-874d-3b6e718b5751", "comment": "Malware payload", "value": "ecafdd057b65375eac43838e9013bf9d", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671205872, "uuid": "931e6913-6d3c-40a3-94b6-c2fd2e8911ff", "comment": "Malware payload", "value": "7553c451f8bc7159aaf5afcc364090428f512068a0b68701ffc31e8e11c31502", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671205872, "uuid": "e2e675bf-468b-45d1-92c6-a99d185559a5", "comment": "Malware payload", "value": "204f391ec767840db1b5caa855cce1ce2ec3e607", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671205872, "uuid": "b1b102a6-3a00-4594-a9f3-8569d91164c9", "comment": "Malware payload", "value": "b685aeec363726da1f4a67e484237ccec27d3c03e2d5dd7e40795a8a08c942bca60ac0e8e7b95865a591123c1727ebb4", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671205872, "uuid": "e5f6436c-66e1-49e4-9e7e-0162d218c0d3", "value": "T117F4336CEF2752504A2945B186789B2A9B3D973C07D06FF61F0ECB0483E9C9E4E351B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671205872, "uuid": "afbd7957-d822-48e6-bafe-35ca36a6c462", "value": "12288:+Pv4dWI/3/JUXWrC4lqpxtLjJmdvUnkZ+uWsi0OUpJpsAY6E8X3aD1O4eSTaGFup:+oAKUmTqdLjQdx8u/5F/YOX354eSGOCf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671205872, "uuid": "35d54fd9-6a20-41b7-b043-013518f79b78", "value": 791866, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671205872, "uuid": "64a56a3e-b1c1-489b-9109-a1496e22922e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671205872, "uuid": "2b186a65-dd07-4ebd-85dc-14dbe0e862cd", "value": "REQUEST FOR QUOTATION_NEW ORDER LISTED URGENTLY NEEDED.GZ", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4d6e6ec-7d49-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671199184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671199184, "uuid": "12e408f1-960b-4e07-a4ef-a31f649fd997", "comment": "Malware payload", "value": "dbbdfd25c954ccd01cba76f4b7b9279b", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671199184, "uuid": "dd0da55d-4d8c-48e8-8338-5ab74612b38b", "comment": "Malware payload", "value": "75ead6affc7b3c3aa847095c2f8ddd88d6993760f94302713fac740381ee17da", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671199184, "uuid": "9c3aa534-c57c-4817-8a5b-dd14862c4074", "comment": "Malware payload", "value": "20e746d5f90b17a95b1bfe0f5f61a8079ace36fd", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671199184, "uuid": "a7aecf78-deb8-4503-b643-cc0180b4c905", "comment": "Malware payload", "value": "f5e1be61acc6de8f400d8f1cb871306f2f90e86d16b77cbc0a0724fea8f1f85eedc011f12a37ad1249f32e0bbe4d79b0", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671199184, "uuid": "8496d3cf-e626-45e8-91e5-e81345ce4114", "value": "T1DC13D18AD6991FDAFA591D884D9DBE24486C3C333CC010F5E67B424AC1E1BED0D9395E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671199184, "uuid": "97b58a2a-9b25-495d-b329-338b3a1cdafd", "value": "768:mCR231pYrRXvP2FPBQph/d0EGC8e2NfhpAVdVDJLh64kVTRDiIFIh8Rd:DR231p+RXvP2zQp70EG4Sfhpqdvh6ZOk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671199184, "uuid": "4d61eb0c-2eb1-4540-9e72-cf04d92189ec", "value": 44013, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671199184, "uuid": "d15f6ea5-2941-4fe4-b394-a46ed937a9c6", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671199184, "uuid": "9150814b-d01f-4564-82e9-af5af9fc1b52", "value": "Telex wire transfer swift.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e86ca7e8-7d14-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671176427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671176427, "uuid": "bfaa8c73-b974-429a-98ad-649331a01c73", "comment": "Malware payload (Smoke Loader)", "value": "401283c4d4d108269801a0a050e7bac7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671176427, "uuid": "edcf3b3c-2ed4-4bd2-8df5-f668dcd247c7", "comment": "Malware payload (Smoke Loader)", "value": "765dac3d43f4529c91cdaa5cf92a738149f11ac180583e30ecaaf8ec83fcb221", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671176427, "uuid": "2a29c8e1-41cc-4f68-a5ae-f5a57c8c111c", "comment": "Malware payload (Smoke Loader)", "value": "3c2a7dd69d053e301549829e4b63c3b22246c18c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671176427, "uuid": "dd955b84-d80f-4c0a-adfa-9e37897940cc", "comment": "Malware payload (Smoke Loader)", "value": "640682d280ee043b3475d0fd49db8887c9d718d42deca9164273668438d3d2946e313e7a0b435510f176b951bb527b52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671176427, "uuid": "a1d5dc0a-87ec-4518-bbe9-4a3a059c3c10", "value": "T14D34DF117270C0F1E59F053088A6CBE05A7EED329A71960777753BAF2E30B91963AB4D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671176427, "uuid": "957e7539-cf23-46c3-a7cb-09b21f240420", "value": "b35462da489bc13bae884e55b5227599", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671176427, "uuid": "a4a5869b-66ec-43f5-ab39-002d00750173", "value": "3072:J9qckoTS7LAu1fWGcRAE9LmymUiz04wLQ2mppGT8omIszHtWqMPDcfuh:XJkNLAu1ukE7mJTztiM8qMrc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671176427, "uuid": "ee45ec23-3931-45b2-9cef-6ff672f3a5b7", "value": 233472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671176427, "uuid": "2e05ec99-1f77-41ce-b9e0-a2cfaeb16eb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671176427, "uuid": "e7ef5f64-fa87-4b5b-87f2-bbaaf9815780", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eca3f25-7d03-11ed-9db1-42010a9c0080", "comment": "Malware payload (Amadey)", "timestamp": 1671168948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671168948, "uuid": "0970ab0f-2b9b-4aba-9c0e-457a2e458ba0", "comment": "Malware payload (Amadey)", "value": "b7f0855a38e270a7d2d939d62f20174a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671168948, "uuid": "3d5a968d-c97c-4d0c-9055-dfda2d99e7e6", "comment": "Malware payload (Amadey)", "value": "76f53358df7fb36537cbfa5dcb9c6625d299438eb9ddabe1ca4897b9952b98da", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671168948, "uuid": "95267abf-f991-4800-b1b7-6e3480776af1", "comment": "Malware payload (Amadey)", "value": "7ae4e3d97c18e0c2b250dab479621a82ccc88555", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671168948, "uuid": "9df763af-8cb8-4e28-a57e-f19f721c91d0", "comment": "Malware payload (Amadey)", "value": "484aeaddf79d319b9fa44f1a863c9ca9e6b0dbfcd34d70cb52d8ebb2c5d04864341aa09ccdb90417604b7b76e6d8f233", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671168948, "uuid": "eae9c646-babc-451d-991a-881823ff2d2c", "value": "T11454F12272B0D471C59F41308D65DBE54A2EED325A71960777753BAF6F30A806A2F30A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671168948, "uuid": "5738081c-9dde-4347-9282-23d8af3e16b5", "value": "b35462da489bc13bae884e55b5227599", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671168948, "uuid": "b8bc3726-7337-4ac1-b286-b977b7b6f19f", "value": "6144:0XkiLw8PBfHzx15maSvpDrLPagR3MyI62DtF13VHj8qMrc:0XkiU0x910LvtPZ3My92DbHj8n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671168948, "uuid": "e86d586b-ae0f-4b2e-816e-27e8d865f052", "value": 293376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671168948, "uuid": "46b30701-3800-4302-b2e1-59b691fc83d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671168948, "uuid": "5394e1a6-3c32-4916-93a3-36f89e31a9f5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4a3033c-7d1a-11ed-9db1-42010a9c0080", "comment": "Malware payload (Amadey)", "timestamp": 1671178917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671178917, "uuid": "c191bc9e-19f7-493d-8700-31f63af93fed", "comment": "Malware payload (Amadey)", "value": "a6357e58442163a18ba0eefdd41ff351", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671178917, "uuid": "7dca3f99-cfcf-40be-9e39-129c5eac84f0", "comment": "Malware payload (Amadey)", "value": "7777793cc9f294585bf69f5a935dd44b8246dea33231cde1adf738e205d9f988", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671178917, "uuid": "a11e3a7b-dcaa-4851-ae43-4e960819602f", "comment": "Malware payload (Amadey)", "value": "47732b71b1d5080f59d2d1448c6850f59a0ed0cb", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671178917, "uuid": "367765d0-6676-4656-96f0-1a232f88f1a1", "comment": "Malware payload (Amadey)", "value": "44993f5100a7249f7a186ec6bafb38fbebf96e4bec8771bf82140bbd34522666b21994d539a5d9e43944e04439dc2306", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671178917, "uuid": "db572c49-8c52-49c6-9455-b423f3cda40a", "value": "T1D054E02276B0C472C49F08308D65DBE54A7EF9315E71A60777723AEF3E30A91A676309", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671178917, "uuid": "c4a32ccf-eaac-4e53-b2d5-f5f6351dfcc0", "value": "b35462da489bc13bae884e55b5227599", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671178917, "uuid": "c7d3665b-1228-4ab9-9aec-db448388b05c", "value": "6144:pdkArq/LXAjLsskPOJG/HN5ccP71SbH8wFVbbyitV6L/8qMrc:pdkAU8jgdOJG/HzbP76hFVBE/8n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671178917, "uuid": "e472542f-85b1-4338-884b-814f772d692d", "value": 293888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671178917, "uuid": "96eaf2f2-b0e7-4ccd-a855-4abfe49f00f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671178917, "uuid": "94851101-e5f0-4cc5-b4fd-7b4e9593d73c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b832e29-7d30-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671188297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671188297, "uuid": "33a30303-ad03-4802-bf30-a7d330688c65", "comment": "Malware payload", "value": "599b02dc5d67352f0eba3cf29dea4a1a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671188297, "uuid": "e8e21ff4-2e3f-40ae-bfe8-9007f92019ff", "comment": "Malware payload", "value": "77f857ef1b23d74ffd97212fc7f5a74016a3ab2ebc792735c89cebdea9cb43e0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671188297, "uuid": "f899c663-91e8-4bd2-8153-31ebae5f16d2", "comment": "Malware payload", "value": "309601376ad8c9688c937259a2093720f9ff4cee", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671188297, "uuid": "69c2b419-44b7-48ff-b39c-75b77339216b", "comment": "Malware payload", "value": "e6895e8ea945d6846e727c5f5824c283f45c9526d0892ec018fb9cad967592d32c8b99253fcf52d9f981abbe9b00f50a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671188297, "uuid": "775fd63e-91f9-47e1-a786-d1d03f9c011c", "value": "T150D4AE48644A62C90441E1FECA3A06E7AD2F2FE983178522BF62D477B5DC1FB056D18F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671188297, "uuid": "70a545e5-e590-446b-bfbb-2af6262f5ffd", "value": "12288:Uespjv8p9p8ZujHDFgC4Ecz8EGtsSOWCuiklH+1z8SOtlwqYxUeQ:U5jkp9p8ZwmJEFEGtsSnYPOt7UXQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671188297, "uuid": "b887f6ee-aa72-44b1-87b7-10c5aede4be5", "value": 627712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671188297, "uuid": "1bc089f6-c8ff-4316-aff6-09071e6b5507", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671188297, "uuid": "45124736-990e-418c-bf08-f66a6f746af9", "value": "inamfwmnaro.bmp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aefd0f31-7d24-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671183202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671183202, "uuid": "f1b9a8a8-6412-4aac-b922-2f31210c67a6", "comment": "Malware payload", "value": "62dd02c1ed7b7bcd2ad2b8f90dccfbea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671183202, "uuid": "7ceafd3a-2d07-4ebc-8126-c7830aea0e19", "comment": "Malware payload", "value": "78209b6f468f6077142e45f3a21806bd36c47897d63124439b85d73aeffd028b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671183202, "uuid": "9c9afd27-667a-4ebd-bf4b-e36a8eed075b", "comment": "Malware payload", "value": "df6086dbe9b1e6b11763b1784b5e8f0a19dc8dee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671183202, "uuid": "9b1f5c7b-10c9-47e6-9f03-ae4ccd8c600c", "comment": "Malware payload", "value": "3673650d791ab12fc2be49d894391c91f3a0088019b0cb8a4a48fbabb13fbbcfbb66ae7d721b80d8ceffb409301ac50f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671183202, "uuid": "a50e3d51-a32f-4244-819f-740021edf1e0", "value": "T1E0D35B2071C0C272D51510B687A6CF71493A7C382E269ECB6FC90AF50F75DE6D72A38A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671183202, "uuid": "ca3492ea-32a2-4753-94b2-d7dc1154ae3b", "value": "adc0955cc8ee35b478eedc0c066bed22", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671183202, "uuid": "11de2823-7a9e-4f71-b9f6-f473d239ed83", "value": "3072:8e1IPQK+4LqCi51n/mOJJin5wnl4+U5NR5:yQK+4L851/H7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671183202, "uuid": "60c98948-0e87-440c-b4ab-11572fa3f412", "value": 131584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671183202, "uuid": "9f4b1685-9289-4f33-9c2a-c3e72ec06ebe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671183202, "uuid": "effbf3ff-e082-4071-8966-c1be6a336bf2", "value": "SecuriteInfo.com.Win32.InjectorX-gen.12735.539", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d30ebb2d-7d43-11ed-9db1-42010a9c0080", "comment": "Malware payload (Zegost)", "timestamp": 1671196577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671196577, "uuid": "b4bada76-ed31-4acf-9548-ec1f99a7b8f5", "comment": "Malware payload (Zegost)", "value": "77754f75888b235231a26cc363ba1bc5", "object_relation": "md5", "Tag": [ { "name": "45-153-241-207", "colour": "#86D11B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeGaliXCity", "colour": "#607CCC", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SpaceCity", "colour": "#5EBE6F", "exportable": true, "hide_tag": false }, { "name": "Zegost", "colour": "#84DF17", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671196577, "uuid": "3158b6d2-96e4-42c4-a14d-f966ab19d764", "comment": "Malware payload (Zegost)", "value": "78be65f626e4a9e81c655b36c96dacc8898287d4954cbffd98788e602369f8ca", "object_relation": "sha256", "Tag": [ { "name": "45-153-241-207", "colour": "#86D11B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeGaliXCity", "colour": "#607CCC", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SpaceCity", "colour": "#5EBE6F", "exportable": true, "hide_tag": false }, { "name": "Zegost", "colour": "#84DF17", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671196577, "uuid": "b8a8ae43-1092-4e47-a09f-bbe994a08e58", "comment": "Malware payload (Zegost)", "value": "6eb136f17a62ffc3038e485ad209b21c794dc2a3", "object_relation": "sha1", "Tag": [ { "name": "45-153-241-207", "colour": "#86D11B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeGaliXCity", "colour": "#607CCC", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SpaceCity", "colour": "#5EBE6F", "exportable": true, "hide_tag": false }, { "name": "Zegost", "colour": "#84DF17", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671196577, "uuid": "46cce915-1aa4-4102-98cb-ea6e466ae549", "comment": "Malware payload (Zegost)", "value": "b96df399c0dad07c29ccda862d0f7987f2e4a189cd195b43312e751e142b9477ba60ae297af787b71d3187b766c29b01", "object_relation": "sha3-384", "Tag": [ { "name": "45-153-241-207", "colour": "#86D11B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeGaliXCity", "colour": "#607CCC", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SpaceCity", "colour": "#5EBE6F", "exportable": true, "hide_tag": false }, { "name": "Zegost", "colour": "#84DF17", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671196577, "uuid": "35c70814-117c-424d-b146-69407214e02c", "value": "T16454BF81B2DFC1F5D94601B05CAB7B7FFA789970051E9AA3A384CE1528634D6393A3C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671196577, "uuid": "9fabe74c-ef4d-41ec-b2ce-c9ff6b12273c", "value": "1423675632cb4d478eba3debd725c59f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671196577, "uuid": "a92dc760-5c4e-49c3-9b8e-655337d37f31", "value": "6144:1xEDp/PY3+WgP0LlZW/Rdki1OkbXxs0ddp8PIQO:1xI/PY/geqf7jOF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671196577, "uuid": "2d4ac5b2-0d0f-4456-a263-9f3b5794b33c", "value": 293888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671196577, "uuid": "c8656971-830c-4255-aa36-2e62de0e8e17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671196577, "uuid": "95506a59-cddf-4f28-b563-a08e246ca867", "value": "winsetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51b53a11-7d4e-11ed-9db1-42010a9c0080", "comment": "Malware payload (RedLineStealer)", "timestamp": 1671201085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201085, "uuid": "63a4c7ed-ece0-4512-b2b7-35146e353195", "comment": "Malware payload (RedLineStealer)", "value": "0c130948dcc26b2805817b62064c8608", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201085, "uuid": "367d3d5c-8af8-4f6d-93ca-0b18d415e732", "comment": "Malware payload (RedLineStealer)", "value": "794a2a7d61474cab046305b0a0dde24e4236a7c9e5421bbcbf70d674c49f0547", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201085, "uuid": "d853082b-1aa0-4c48-bb9c-4f03e1884758", "comment": "Malware payload (RedLineStealer)", "value": "01a6b38521da4611464ac4e17468b5869d35a328", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201085, "uuid": "6141e77a-9c8f-435c-8ff0-a8e75cc980e4", "comment": "Malware payload (RedLineStealer)", "value": "eff5e73042a90a0aad3dbd555dfba6f85dcd75082f7540e2c7a3ce58531eaca2dee402d7aae64f6b69f097538f59ae88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671201085, "uuid": "53a2b4f6-6f2f-4dc4-ab5e-350eba4cfa40", "value": "T19074E0F13394D82EC551C7309E16E7E4A66ABC114F2259F33B142A2F5A706C16AFE23D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671201085, "uuid": "3d935daa-b052-45eb-9776-d2aa2c75010a", "value": "2cc3e4b8a374ca30888470c0a531eceb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671201085, "uuid": "af100d5c-8781-426f-83a0-7eb8943448f5", "value": "6144:7iRL/2pfzxgWoL4pnv72mMN+5Bif/u3LWND3lzxVQbgzUnOmy40M2b:7iRypfzxgWS492Cg66xlzxVRK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671201085, "uuid": "2b2b693e-ea1a-4bae-a956-d5ef081e7a66", "value": 342528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671201085, "uuid": "748baed5-f9cd-4897-827a-b7b12dd45ec5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671201085, "uuid": "9c81c3d6-0c4d-40f4-82b3-ad2113003f6e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96002378-7d5d-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671207642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671207642, "uuid": "a7b204f4-2843-43f1-b33e-8a077e9ec835", "comment": "Malware payload", "value": "7ae57dcf9fbeb4090f1f1ab2b9a36a7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671207642, "uuid": "f6becd5c-4112-4b2a-982e-f6540c7c4c33", "comment": "Malware payload", "value": "79d6c51b91cd1d72bbb8ef7e196c7a9ee91aa571ee4e0b0676e3b7a5fe09af4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671207642, "uuid": "c648f445-5d2f-4adb-87d8-fb0bbabc83a5", "comment": "Malware payload", "value": "944ccce3438f17e1423a0c462b1f77be3dd21706", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671207642, "uuid": "beea0de7-1bc2-4267-87fe-10292d6e3ef6", "comment": "Malware payload", "value": "2f7551ffa656cf47dbbe3d046daadd547d30826be4ebd1a88cce6053fdcd4bcaef474e793f39ab9bc28de2c72a604bf1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671207642, "uuid": "0c497746-69f1-40f5-9614-385061cc3e4e", "value": "T11924BDF177A0D42EC211D7308825D6E9A66ABC115A22D5F33B183A2F1DB02D159FE37E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671207642, "uuid": "ab9362a0-2ec4-45de-8c84-69110291d4cc", "value": "3670997c8c2669588bad5b8c178dedd4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671207642, "uuid": "8f69530c-0b5e-468d-be8f-7f2de0bbd9a2", "value": "3072:AGdwXLbj4At0Rx1QfZiHD20fUrnapxTLszq/MaH6mw40zwUzQRKF+:hWLgAYwYHdUr4Tgzq/7H6H40M2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671207642, "uuid": "d431c96f-3cf3-448c-8229-f1cd6485e347", "value": 218624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671207642, "uuid": "42409966-b5cd-4380-ab29-613ba1f48295", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671207642, "uuid": "647b687c-2ff8-48c3-a146-0a05dbae9db6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "664326bc-7d57-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671204984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671204984, "uuid": "40b7a02f-7a1d-48ec-ad85-b9ec276ef5f9", "comment": "Malware payload", "value": "c47f950d8cbbdb57ee833af1bf5c3ee6", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671204984, "uuid": "ca5eeb72-2223-42ba-a384-17e48e18d6bb", "comment": "Malware payload", "value": "7b621d22261dcf61af1fce0f4a3ac11879086a97f683bf278e768193a20d541e", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671204984, "uuid": "7acc1da2-a8be-4250-8032-ec6291fabae6", "comment": "Malware payload", "value": "86f54812d09ae45cd47a92d2148085bcf947a2d5", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671204984, "uuid": "b6de3637-ace3-4a61-b9f3-a61379d75d58", "comment": "Malware payload", "value": "f7baff3fc4f5234c442e01eb27d9dbcfe8ecd433b86ca11b213a974e7510fd07c0631c974b5c756bd81a265848519cc2", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671204984, "uuid": "9974440d-1238-46d0-b9aa-a4bf29a6bcd3", "value": "T15CF4CF038C1D8987E42982FCBD124D9C3B263A4CACD676FE16625EDF7E922015D5E06F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671204984, "uuid": "c5c59c81-9186-43ea-81f5-4d7fed9c9165", "value": "12288:oTkT9b5N578oIUOl7p33LTi8lost7wE3txcoEtqPux1JHoLJJA4BApUjjjjj8dcC:gkN57JjOl7p3KUtJvEH1JHoLJdAppZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671204984, "uuid": "c28c85b6-0db8-4a37-a0be-3765b6860769", "value": 722893, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671204984, "uuid": "ad4fb25f-79f5-427c-9905-30d5377d262d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671204984, "uuid": "830de167-ba2c-41ec-87ca-e8219249274a", "value": "CLASSIQUE.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "035b882e-7d3a-11ed-9db1-42010a9c0080", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1671192363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671192363, "uuid": "074c97cb-15d3-4b87-a3e0-59c986599f22", "comment": "Malware payload (ArkeiStealer)", "value": "47ad12e22e6f26086fb4edd0e5bc4524", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "fakecrack", "colour": "#E25CDD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "github.com-vilma683", "colour": "#431216", "exportable": true, "hide_tag": false }, { "name": "pw-1234", "colour": "#ADC330", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671192363, "uuid": "ea00a732-3a34-4f3f-96ab-5d092035e828", "comment": "Malware payload (ArkeiStealer)", "value": "7c550beda75eb408fb416162b17432b116b25e71dcb3ca8d763d77b1a090c7ef", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "fakecrack", "colour": "#E25CDD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "github.com-vilma683", "colour": "#431216", "exportable": true, "hide_tag": false }, { "name": "pw-1234", "colour": "#ADC330", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671192363, "uuid": "3fdb7eb2-ed8d-4274-b6ba-752e60abe354", "comment": "Malware payload (ArkeiStealer)", "value": "b882b9aebc2e7717063b1064a46ad00da0b4d73c", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "fakecrack", "colour": "#E25CDD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "github.com-vilma683", "colour": "#431216", "exportable": true, "hide_tag": false }, { "name": "pw-1234", "colour": "#ADC330", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671192363, "uuid": "b3d84b61-5799-43e2-9b26-07d913793053", "comment": "Malware payload (ArkeiStealer)", "value": "94cefa2ab7415de526f0c8d471d49a45a4ef880e589087b4b2588d36508358fa9a2ed2245c1d5bc832abcd02f14f1779", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "fakecrack", "colour": "#E25CDD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "github.com-vilma683", "colour": "#431216", "exportable": true, "hide_tag": false }, { "name": "pw-1234", "colour": "#ADC330", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671192363, "uuid": "94cf7f17-068c-41cb-a369-b97f7fc86e87", "value": "T1375633C76B5C264928EED3EDC60696F7ECE844C4572B38823D876EE50D3271738B2196", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671192363, "uuid": "2109eb12-f668-4bc1-8498-a6a0b8a49280", "value": "98304:kKJ938JECbawYljr7NV7pXsMTXA8zv8aRsYsQ4vPqFeoWFtvmVpGn0XswXxZbPdZ:Ff3xQObN1pLXA8zmYtHFeXcQ0sQTZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671192363, "uuid": "a0b253a2-194d-42bf-b9b2-49cd8f0da27d", "value": 6198366, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671192363, "uuid": "238184ac-c055-4c8a-8918-0e88d8c5b090", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671192363, "uuid": "130e0118-c6f0-4398-8fb7-f6d0fd973bd0", "value": "Desktop_Full.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18135189-7ce1-11ed-9db1-42010a9c0080", "comment": "Malware payload (Amadey)", "timestamp": 1671154173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671154173, "uuid": "1f88e61a-bc05-4286-8aa1-1617e8f7c39a", "comment": "Malware payload (Amadey)", "value": "9573efefeafbce340279695e3ec4dcb5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671154173, "uuid": "aa7c628a-48ec-4ec7-ac3f-7568e1ca4e9f", "comment": "Malware payload (Amadey)", "value": "7ca01759004cb3e81a463e92f75b141f8a4255308d1c3bdc3f5d3aa99c403a1e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671154173, "uuid": "13450d92-6ff1-4970-9957-b28954f36a6a", "comment": "Malware payload (Amadey)", "value": "a085decf05269687ff252ca67b635def4590e0d3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671154173, "uuid": "410c1932-dadf-408f-a67e-7c228be5252e", "comment": "Malware payload (Amadey)", "value": "15760a5c84cff06d96bccdd2ee54f10643c4068da5d01934f21d6239863e56c1d56b967e4a11d2df1dd1225cf8026315", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671154173, "uuid": "397de9ba-f081-49c3-9967-7d0971f46834", "value": "T1B684CF047AB3D4E3FC32C5754C26E7F42669B860B9ADD236B70AD71F99702B38926305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671154173, "uuid": "4e561e62-99da-403c-aef5-64cfff979c74", "value": "2067eb05796787c0f2b3dc09403197ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671154173, "uuid": "87731f3b-b1cf-4ab2-a333-9e0d7df3d8c2", "value": "6144:BIYFvvLb3GTIHGQE506GLauIs9WvZfHUJtSk0iPvzpQ6ijLxQFiaI:XXnGTkhE5DGuu0ZfHUJtSkxnzpQ6ijqF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671154173, "uuid": "7d55d344-07ce-4999-bfef-c30fe61cd2f1", "value": 382464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671154173, "uuid": "ef13450b-7992-440c-ac83-5cc08e50dc85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671154173, "uuid": "da028fb3-d4c2-4275-aa79-1db6a12d6174", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88ad8314-7d34-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671190010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671190010, "uuid": "9ca605d6-2acf-44eb-9f53-08a256a7e701", "comment": "Malware payload", "value": "f0d09698d2e786de717b2eded65325e0", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671190010, "uuid": "8f2878a5-6099-43c4-8cc5-30536e7035a1", "comment": "Malware payload", "value": "7caa4150173e63635ad827d506cb57d0ef5787f5a62be18578614ae96e47bc8d", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671190010, "uuid": "13e91bac-714a-43f1-b65e-8a55025cbf57", "comment": "Malware payload", "value": "c998d786b899ba735bc0ab2d7d448204ef09323d", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671190010, "uuid": "d5c97894-4125-4167-86b6-607a5e3cbba6", "comment": "Malware payload", "value": "9ff0ab4cb248a73b6dd5275610aff0ddbbbf4669f6c89ef8b76cb89d636873c90f5d0666cfa021be39969d9b6c03206d", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671190010, "uuid": "b58e3b36-aa5a-47d0-b103-d773961c2bdc", "value": "T19D228D3CD201F81AC122457DE195C2F1F7699197E221F92D3018339E4BA11DB17DE6AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671190010, "uuid": "2c3707e9-2047-41e6-bc92-2f08577f2f22", "value": "192:ScIMmtP8ar5G/bfIdTOfnamWBX8ex6y3E7N:SPXt4ATOfnosMEZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671190010, "uuid": "d704d776-4f48-42a7-9303-7b2f038f122b", "value": 10384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671190010, "uuid": "0659a071-b669-482a-ad4e-0974934067c7", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671190010, "uuid": "96c8255d-2e75-4213-aaf4-37e9bc251479", "value": "PO1271511.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c65e061b-7d14-11ed-9db1-42010a9c0080", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1671176369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671176369, "uuid": "cd92ec8b-cc35-492d-9dfd-4e8780906ba3", "comment": "Malware payload (SnakeKeylogger)", "value": "f56abe27058605c0aba1345d77e41bd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671176369, "uuid": "c0c26b37-2d37-4adc-b0d3-82cd3704fbad", "comment": "Malware payload (SnakeKeylogger)", "value": "7cc808f5e3a9f254b3b05549e8e794f261da1c8f425ec40c3b330195098a2aec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671176369, "uuid": "42547927-e1c7-46b1-8390-64e76fb884fe", "comment": "Malware payload (SnakeKeylogger)", "value": "589bb6c76898695f4c9278ecb5f372284a4b1e01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671176369, "uuid": "6da25f81-0021-4b81-8374-3914f5a0cc33", "comment": "Malware payload (SnakeKeylogger)", "value": "113ccec57ecc48045832d9e3b1cdf6004547fe3704cd45d74f5d80e37db0f3ff684e0139c9d2a7daefc4ec30cfc40a7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671176369, "uuid": "bf1cdc5e-0883-40e4-b475-a26816b39698", "value": "T15D24025612DD85BED1D75A7EB09962A243B0234284E3F73FA3E531925E52E308CB3673", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671176369, "uuid": "06f542a7-1a90-40c8-af7d-6a51122c6984", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671176369, "uuid": "d2698110-d385-4f4a-a4f1-42d61e9ca723", "value": "6144:suFDutOc6duxKLolwIcrUSvapFlxoOHBMzeoCDF:/FDutOc6duxKLoSIcrzgydzd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671176369, "uuid": "1409fb73-a882-4eb4-84c7-db3ac1ac8742", "value": 220672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671176369, "uuid": "db4072d4-8141-40ce-a16b-e227759b6d14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671176369, "uuid": "79568277-80dd-49cf-919d-dcd18aa62abc", "value": "SWQ098765456789-IO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50e86f22-7d1b-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671179179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671179179, "uuid": "70761836-efa2-4068-84c2-fdc3bb53f93a", "comment": "Malware payload (Smoke Loader)", "value": "612783eceed3edd151d79be4f373868c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671179179, "uuid": "e859f70d-5b9c-46e4-bce5-bfeb71b9e4a5", "comment": "Malware payload (Smoke Loader)", "value": "7cfd91624a0420a8799a4ebfdbb9eca5ad7e15a993ad08c59708dd87d1cf1510", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671179179, "uuid": "32984927-73db-48dd-ac00-4915fc4d0ca2", "comment": "Malware payload (Smoke Loader)", "value": "eb53ccf8f4911ea6d979e55b80b59d7ef840c043", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671179179, "uuid": "95d18f52-96ea-41ea-87d4-ac3e572df8eb", "comment": "Malware payload (Smoke Loader)", "value": "df4b710b5bbac6497fda64f36d1525bc49483f18e8672373898a9056d9f85b82f6c0903e8b527c48119734fe62cc58a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671179179, "uuid": "0b785485-6ec4-43a6-86d6-dc4b9c5c995e", "value": "T10E34DF2172B0E572C19F093088A5C7E06ABEFD314A719A47377576AF3E30B41667A34E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671179179, "uuid": "6dd5c701-0f6c-4373-9fbf-bfdd402bc93d", "value": "b35462da489bc13bae884e55b5227599", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671179179, "uuid": "d74fc6a3-e206-4c2d-a219-a5f0eb87b6fa", "value": "3072:HaqkCQtgLjmEThlcRs/jn9H/0IiCZr3FYSWmNUPZEGLQ2mppGT8J1qHtWqMPDcf2:6qkALjmEFFHc9CB1H+2Btx1g8qMrc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671179179, "uuid": "bd58c243-0124-4d3d-9da1-38d64973438a", "value": 232960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671179179, "uuid": "0ac09749-8247-4b56-adb6-38dc9982d10e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671179179, "uuid": "ba14dd77-e6af-4f0b-8259-8969fa47493c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5081fdbe-7d3d-11ed-9db1-42010a9c0080", "comment": "Malware payload (Amadey)", "timestamp": 1671193781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671193781, "uuid": "49920e4a-4422-479d-b5f0-98d47532efdc", "comment": "Malware payload (Amadey)", "value": "6a780800f35c265d56eb8baafc6bfd72", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671193781, "uuid": "11222fd4-a2a2-4439-a4ff-aed654ad9ccb", "comment": "Malware payload (Amadey)", "value": "7d2fd14c2d3a0429e7dc1dda025e88ab606e0797aa6e6224a8f2f5dc25590d24", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671193781, "uuid": "32152435-d852-43b2-898c-08909126722b", "comment": "Malware payload (Amadey)", "value": "08725b7773da71bb8f40798bb5b3902ca3dbb9d8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671193781, "uuid": "116ea64c-4f35-4b2f-8f54-b893f32294dd", "comment": "Malware payload (Amadey)", "value": "958e5230e9587c379520b3eafa409bb27d4c6237c0564cab73b9bc6213282cbe63ef007ed12ddbe26a7d77ae8075d4d6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671193781, "uuid": "f90be79c-bd59-4142-af62-b4b62f8f9923", "value": "T19B54F11137B0C871C21F0570ADA9C3E15A2EFDB15A709647367676DF6E30A81AA3F30A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671193781, "uuid": "048b7e78-5d74-4a49-a292-27cf5f139049", "value": "e21f10fb81de748812499eebaf8a1cc1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671193781, "uuid": "ca58d685-3db4-4006-91dc-ab6fe109297a", "value": "6144:Q6f6LwajiXSKmUfECUgBPMTaAl6wPst5G/IQ8qMrc:Q6f67WXSgfxUgBMTywPsbG/V8n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671193781, "uuid": "961971af-0904-43fe-9b22-88a22e87c5aa", "value": 280064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671193781, "uuid": "e75d0562-f43d-4b71-b50d-aa91300835b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671193781, "uuid": "5cf1d1bf-d470-4943-b1a4-2c84bc7fed9d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b186a828-7cfe-11ed-9db1-42010a9c0080", "comment": "Malware payload (GCleaner)", "timestamp": 1671166886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671166886, "uuid": "53bb2405-e171-448e-8e36-7edfce63178f", "comment": "Malware payload (GCleaner)", "value": "14bc53e6cfeac168d307623899513ac1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671166886, "uuid": "1cf5ac85-123f-493e-ac70-0faf8a24a5ca", "comment": "Malware payload (GCleaner)", "value": "7e366139126ec4d62c0bea3c2bff8fdded271f2b88e3b5cedf9ddd87ac92701b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671166886, "uuid": "5e0135a3-6e2f-4331-9897-4f0869af9c93", "comment": "Malware payload (GCleaner)", "value": "e8c7235ef5accfa3e951bc0beead0b77852517d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671166886, "uuid": "85b93e25-fa3a-4efb-9a0e-f88ea3388724", "comment": "Malware payload (GCleaner)", "value": "a49c1dc6b6176bf830d04a1b44fe18fb9c4ada1c9687193d8de1128d5ca143bed455778a219c9d61b965ff117446f249", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671166886, "uuid": "332e7c91-9f51-44bf-960b-dcf42807c7c9", "value": "T13BB523BFA98806B6C0B34AF834695D31C2E67D132924C94D77D8BE8F7BF65C1192A305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671166886, "uuid": "2114da38-d926-4445-8aca-4c081a8b2714", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671166886, "uuid": "cfdb1cc9-226f-4f37-96f7-49d92c4c90ba", "value": "49152:0pvV94tgVu4iN2ns2ygsylO4+QChBs35P5eOCgSY/img:0pv/4iVuTNHF4whW315cY/img", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671166886, "uuid": "5c13cc1a-8c22-493a-8e77-d7f47f8789a6", "value": 2415446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671166886, "uuid": "24437c33-8411-4969-a588-d355a73f02fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671166886, "uuid": "be93a588-fbad-4e14-812e-6f55f1bd4203", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6d8db17-7ce3-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671155405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671155405, "uuid": "6980a03e-5b5e-4202-bbde-c6fb5563d17f", "comment": "Malware payload", "value": "1ce869fc2ddbdd488d0b3ac7ced38438", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671155405, "uuid": "eb771970-226b-4f5f-84cc-4cbf8641e02a", "comment": "Malware payload", "value": "7f30376e6fbed9fcf06d06d96f0c98fe8efebb5d1a94e5e697d2a566cca082a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671155405, "uuid": "83b6cfd0-84d7-4fd9-8218-076f5bdf8e6a", "comment": "Malware payload", "value": "3ea830580542c9a716e9781fdc35a5efededaa14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671155405, "uuid": "f42cd4fe-d4fb-40a9-bbef-74886230212b", "comment": "Malware payload", "value": "553084b15de4d4edfd87bdf85034df39bd5efd521f83d66789bd8ae72ed113ce0cbf72ba4b18d377e2a392a8d0e386f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671155405, "uuid": "01403a60-38cc-4e99-90ea-468ec169e30a", "value": "T180037C20B9E2C473C842D571647895F2AF2E193222B5DD872F6967359F312C2A7BF342", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671155405, "uuid": "29fdd953-0afb-4996-8fd6-eabcafe2f082", "value": "768:GrFlFMxYD3dKVzqNzjmiwwO14uLRoTkZL:GLFiYQMzjDw8uLiQL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671155405, "uuid": "2b3d788a-8339-41ed-82e9-acfbec19fcab", "value": 40616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671155405, "uuid": "5772acc5-58da-4712-9ab8-f5a393481b4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671155405, "uuid": "06496cd3-c1c2-4f03-9c17-6cbf2c1f7d1c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66faaa74-7d91-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671229896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671229896, "uuid": "b34c5847-8b89-4f1e-9918-0b48e8668bbe", "comment": "Malware payload", "value": "a8d34b5d89bf3a49d4c201e704aaac1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671229896, "uuid": "393adcee-147b-4f24-a054-2b537a4e0fb7", "comment": "Malware payload", "value": "80945e53dbad9370ce555fe15b41531f0283bc5524161184911aa7dad175a95c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671229896, "uuid": "285e5bfe-fcd6-4368-80c5-04259c53e979", "comment": "Malware payload", "value": "288535ae3c0c47642d1b82f280ad744d32071190", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671229896, "uuid": "e8b66c5b-9209-4c12-9cee-aabc16b8207c", "comment": "Malware payload", "value": "c4525a54408f9b1561f1c1a6818749f0e88862f0bdd9c258b5f5699343f98831986517dba62f7c687914077e6aa6771d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671229896, "uuid": "254966c4-edbc-4cb1-b8d4-f6252349701a", "value": "T1A274E0F173A0D0BEC052DB304815E6D98A7AAD108E2155F33B146A1F2E712D19AFE77E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671229896, "uuid": "c1752734-8aa7-45c8-b031-a7923694e89c", "value": "aa9c378109186462717e17e657d0c833", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671229896, "uuid": "3793e7ca-d9e4-4a75-b7b7-53af609c203e", "value": "6144:3xHyLib7aQtReZRuzVuBd+SIyYFbLzgzCq0i40M2b:38Q+QDeZUYdwWOq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671229896, "uuid": "e8b805b6-1703-4548-aee1-b60699557603", "value": 342016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671229896, "uuid": "7d094c95-08cf-4c4f-98d9-bf93ff297367", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671229896, "uuid": "3c015592-066c-4b88-8945-94e15ebefa8c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57caa61d-7d7a-11ed-9db1-42010a9c0080", "comment": "Malware payload (AgentTesla)", "timestamp": 1671219993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671219993, "uuid": "33ef32c2-3b41-41e0-902f-79cd3a4369f5", "comment": "Malware payload (AgentTesla)", "value": "ce15b0662afa01dae569d0c1a2e4c877", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671219993, "uuid": "ee4059d9-787a-4adb-a080-abe29b42d5bb", "comment": "Malware payload (AgentTesla)", "value": "80cd7de2ee2091b6ca3f735925eb77eb0566f6f2089ea1a322de2233750bcc58", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671219993, "uuid": "ccbd0de3-cb3e-4adf-981e-14a190b57c9e", "comment": "Malware payload (AgentTesla)", "value": "b6471805895dac270c396f20c2e33942a0188a18", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671219993, "uuid": "ad6afbbe-08d4-482d-8ca3-9beb6505ec5f", "comment": "Malware payload (AgentTesla)", "value": "323bef4cf6244ae2f51bf84c747aa69c0af154c972fb613ebfb08effa19d0a63b9116d86f4dbfbaef91233e956bce63c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671219993, "uuid": "8103a800-e40c-4ec9-bb83-8c73ced9aa6d", "value": "T1BC74239C68A42FAFC803EC15A5E1B87A7F35BBA427E644102095EFE053C4B78955FB1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671219993, "uuid": "b302f7a1-e088-45c8-a49e-4c6cc2898cbd", "value": "6144:27HLS1TZZ+n11c/ezvvXNcXIMZsxwqjYauwXszOZwoIp1nAiiW4VSJlSFaal:2DL01JMvvXN6RGxw2YauwXGUg1nAii5l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671219993, "uuid": "6ab8ba1a-cd49-4f4d-888d-359a3186473a", "value": 343048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671219993, "uuid": "60a6704a-75b4-4b9d-b0b9-5788c31be751", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671219993, "uuid": "c8afe535-4598-4eef-aa70-6f5309083a02", "value": "SHIPMENT DOCUMENT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2313d1cf-7d3e-11ed-9db1-42010a9c0080", "comment": "Malware payload (Formbook)", "timestamp": 1671194134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671194134, "uuid": "23836c80-db65-4d72-83ba-5c98ee8cdf46", "comment": "Malware payload (Formbook)", "value": "4bf3e1f318f983457b8d379807183d69", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671194134, "uuid": "675ee902-5f1c-4bd8-9ea7-8f0bb26b72e2", "comment": "Malware payload (Formbook)", "value": "80e0a46fefd0ce3dc15a56966a8e6a87862939f3ecf7b3f46f13ca508dc9d84b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671194134, "uuid": "68c21300-f6da-4137-951c-a40750bfa977", "comment": "Malware payload (Formbook)", "value": "69617ac871d52272b3d0e3638e59fc364003f703", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671194134, "uuid": "0ca032db-6656-406d-b4f8-bd60faf7fbfe", "comment": "Malware payload (Formbook)", "value": "e89549f189299d4884e7b328ac5f0d90c3a509348c4e014668a1cb26a4563f158cecb74ee66d8035583c31cdbaf187c6", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671194134, "uuid": "22965712-1ff9-4992-bb67-6e40c7aea45a", "value": "T1D3D423E7E9DF878688F6CABBB4138F11791CA275901708851B8FB874210ED25D8DDFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671194134, "uuid": "a4bfd545-e2d5-4da2-9fe2-56d201c72c91", "value": "12288:pm92C6ONBbFXMVRCoxYdpi4ZLEoulx+dvTMC9ZqiSblHuuNqAz9kGngHr85c:pw2C6ONjXML7mdw42oMC7qi8lHuY9rnc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671194134, "uuid": "11ccdc2a-8836-4917-bb7e-0e0d09342d2f", "value": 605270, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671194134, "uuid": "8caebe19-a27a-4c2b-9b9b-41decb2c2665", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671194134, "uuid": "3c50b3b8-307a-4d13-b49e-d412aaf47399", "value": "Purchase order 781830171.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e095cb1-7d8d-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671228110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671228110, "uuid": "da063340-4055-4039-a252-602495cf8bd3", "comment": "Malware payload", "value": "9bbe6982972a682eddc0467220d0732d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671228110, "uuid": "501873b6-39a3-4a18-899b-178275c2331b", "comment": "Malware payload", "value": "812daf36eafdc85cd73642d12427d1ec1ac494ef502766b0c2d0717c3dedc415", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671228110, "uuid": "41f598c8-8650-4cdb-9db6-8f4400b0e055", "comment": "Malware payload", "value": "58ca5f14262fb02f5d485ec0532992d8bad9e707", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671228110, "uuid": "4f955d15-2a3c-4c13-9965-779cc3cd7e34", "comment": "Malware payload", "value": "ed398bf8e0b65826810a3bf9e319f5f1c83947a23e4b2d26673437eb60a990823e8a38dcb2acff0af25f7a74c05d2b4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671228110, "uuid": "c937a550-bd3a-493e-8b25-3dc6b8689833", "value": "T158B523BEBA910975C0B365FD38265C6292E76E2B1938D89E33C87F9773F6CD05801606", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671228110, "uuid": "d1f4860c-f8a0-4ad0-8cbd-4de6b0b2cf44", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671228110, "uuid": "b551afe4-5754-4c19-938a-a2b828c11468", "value": "49152:kpC9BmLCddd58zX+O9NPXAIuKLD4eiFVzf9QlXGpxVePNuWPeOCgSY/imh:kpC9nqXN9JLuFVOlaxkkKcY/imh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671228110, "uuid": "869c0845-9f30-4753-ae8f-5ea9d1a7ea77", "value": 2399090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671228110, "uuid": "2c327d3f-a2dd-4a63-a8e7-3f22fd8f099a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671228110, "uuid": "72b47bb5-c851-4ec9-86c5-34e44bf47ff9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1340a90c-7d7a-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671219878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671219878, "uuid": "a354c90d-9cba-4081-b998-385f849eda4f", "comment": "Malware payload", "value": "185bf36185cd8bb1ad463a70214ff84b", "object_relation": "md5", "Tag": [ { "name": "82-115-223-60", "colour": "#F7CF6B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeEvilHunters", "colour": "#9F827E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671219878, "uuid": "a829182b-cad8-4558-8705-663689f39cce", "comment": "Malware payload", "value": "8211ffa22a40ceb40b8aaa8102064550624b4d3977a6232c2b9bfaae4fdb071a", "object_relation": "sha256", "Tag": [ { "name": "82-115-223-60", "colour": "#F7CF6B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeEvilHunters", "colour": "#9F827E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671219878, "uuid": "daf876ce-aed6-424a-8577-fac67cd26b36", "comment": "Malware payload", "value": "7954ce0c541f4bc021d91c05235e8e22799a00a1", "object_relation": "sha1", "Tag": [ { "name": "82-115-223-60", "colour": "#F7CF6B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeEvilHunters", "colour": "#9F827E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671219878, "uuid": "74778955-34db-4ffd-98ac-28246b9bf083", "comment": "Malware payload", "value": "fd460944ad767a2bfbe365ee07d68dfa7f142cc038d961a96d06dbfa748bb37a8f1fae3e76da92c1b435b4b261fecebb", "object_relation": "sha3-384", "Tag": [ { "name": "82-115-223-60", "colour": "#F7CF6B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeEvilHunters", "colour": "#9F827E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671219878, "uuid": "99eaaeda-9af6-4df3-b5b3-3c7c17817e98", "value": "T18BF45B33354050B2F57E17F11BDAA6B659AE6DBB1FD044C723C832F995722E0987822B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671219878, "uuid": "42b1e459-bdc7-429c-97fb-13739980a17e", "value": "50fac56420301590bb5c790f6fb6225c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671219878, "uuid": "baf2af26-f6c3-419f-b9e8-4c31af2435a0", "value": "12288:beD12u7YVn46STyDzjusB9yzIrN263//T6zthC5:bhfn4lyDzj9B9yzw20s/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671219878, "uuid": "551a55a0-0e7f-4f2a-9cb8-566b9ef53648", "value": 758272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671219878, "uuid": "8d728dad-88f7-4b30-980b-eec7c4a25741", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671219878, "uuid": "439d1d41-088c-4687-89c3-b0cba44c1c60", "value": "Evil Hunters Launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e55a301-7d67-11ed-9db1-42010a9c0080", "comment": "Malware payload (BumbleBee)", "timestamp": 1671211816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671211816, "uuid": "9c5900f7-8c68-4db7-bc7a-941a6f15beeb", "comment": "Malware payload (BumbleBee)", "value": "b955bf20f8c1b01b9f1d12023183115d", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671211816, "uuid": "d097272e-4d62-4de3-852b-f928120fa4af", "comment": "Malware payload (BumbleBee)", "value": "84155dc50b0e963c16477793e5814b9feb9603b80924a047d7558a26228b6749", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671211816, "uuid": "4206275c-d054-4874-b0d3-d94c136c9958", "comment": "Malware payload (BumbleBee)", "value": "1649e261310a5cd12965bc7a6440c18adaeea6b9", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671211816, "uuid": "92045983-38e1-4805-9e06-c039328433f6", "comment": "Malware payload (BumbleBee)", "value": "0f5910b7ec37481ab2a942542c8fd69e3ada5059d2b1b5c9d19d6e253613696656c162259aea8ff6420ff3a5122d7735", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671211816, "uuid": "b0cceab1-909a-483a-929c-67c11dc6a369", "value": "T11D259E09DDD15F1BC821D4BF89A358A3E7ABD406B703876B934CD226768276847C7B2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671211816, "uuid": "30099375-dcc7-4f87-9921-f1a24983cecc", "value": "d57112040c2a95b44bf59b81899b2697", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671211816, "uuid": "f626ced7-5b55-47f2-ac2e-d2ff71a4ed0a", "value": "24576:YInlGCMQ33VI15YlmePz8nGQrUc9KLVy:j0CFyBn3rn9P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671211816, "uuid": "b9a89971-18a7-406d-b311-6e767cb38d6c", "value": 1029632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671211816, "uuid": "d3bc08de-2220-4237-bc83-3af1f17a34b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671211816, "uuid": "8029c33e-e89f-4e58-9ef3-35e4a173714d", "value": "SecuriteInfo.com.Variant.Lazy.276085.26689.31061", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79557327-7cfa-11ed-9db1-42010a9c0080", "comment": "Malware payload (GCleaner)", "timestamp": 1671165073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671165073, "uuid": "937adf7d-d619-4ba3-a29d-f69772e77830", "comment": "Malware payload (GCleaner)", "value": "d691da7b42e3b62bcaad40f977f074d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671165073, "uuid": "449646ab-40a3-4213-af4f-371236e8a9c1", "comment": "Malware payload (GCleaner)", "value": "867bf6803e12f01773dbb65b1d7b5c60110ffd0e74f13cdcd7454db16915e9bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671165073, "uuid": "4f5f8ee4-46a7-4559-b2a2-6ede2dd8023f", "comment": "Malware payload (GCleaner)", "value": "301c295887c34f8177e9851140fa868842e1ab30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671165073, "uuid": "229ca302-a265-4cf5-88e9-8204a62456fc", "comment": "Malware payload (GCleaner)", "value": "ded0224299af37710fb359a7533d0cb4ea1a816b813f41b62092290d540605eb4c6415dc2bb62dee190bf5315cd0f595", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671165073, "uuid": "c025a468-4606-4bc6-a807-f922f5518fdb", "value": "T1C8B533BFA85400B6C0B789F87821DDB196E1BD271968D50E3BC9BD4F36FBCC1852614A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671165073, "uuid": "656335e3-04b1-423f-b0ce-899dbd0bb5be", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671165073, "uuid": "0b52714d-ba90-45d2-8dfa-021ff5f70957", "value": "49152:kpFIF1Zc1mzd7m3i9uzS+YgJP+Ewu88Lg8esb7ce/zeOCgSY/imU:kp6dc8pDEzN10EHDg8Bn7cY/imU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671165073, "uuid": "a6981a67-0ed7-4db6-b2e2-3d374a7454cb", "value": 2435858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671165073, "uuid": "f8f5cfcc-9846-41c9-8346-f10442b7cc19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671165073, "uuid": "64d7a187-53d2-4a42-b7ca-b2d47fcdcac6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eba46a66-7d1b-11ed-9db1-42010a9c0080", "comment": "Malware payload (AsyncRAT)", "timestamp": 1671179438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671179438, "uuid": "68ef4e3c-cd5d-4590-bb47-63be7c0f045e", "comment": "Malware payload (AsyncRAT)", "value": "394e0cb5c8ccbb272d1a9654b5a31a9c", "object_relation": "md5", "Tag": [ { "name": "bz2", "colour": "#AC1CC3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671179438, "uuid": "9e8d0ed2-1b75-4f81-89f3-cdb86f652d8f", "comment": "Malware payload (AsyncRAT)", "value": "8799d0d9c137c801525b65cc148fa34997cb6bf7c352fa94736bdf5b7fd1ab80", "object_relation": "sha256", "Tag": [ { "name": "bz2", "colour": "#AC1CC3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671179438, "uuid": "81dc9923-ad16-4348-a4cb-8cb6aa0d1157", "comment": "Malware payload (AsyncRAT)", "value": "6b62bf8838754d11b8064885f1d333a05dd2dc5a", "object_relation": "sha1", "Tag": [ { "name": "bz2", "colour": "#AC1CC3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671179438, "uuid": "8a0a3f2c-33e9-4301-8630-45a760ba8893", "comment": "Malware payload (AsyncRAT)", "value": "8d235b2583a971346fba91aada213aff1c477c87fc19434d008400effd9cb5d7761194287d6c8e68820f947709b0c34c", "object_relation": "sha3-384", "Tag": [ { "name": "bz2", "colour": "#AC1CC3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671179438, "uuid": "7dd71aef-6e1c-41b9-9ec2-1c8ad2764ccb", "value": "T1BC2423DCB9E5C406EE9AF538C571D81C52F3FC8348E6A88B797E6413CBA935426C814B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671179438, "uuid": "25c556e0-9576-457d-b576-19b45d34653f", "value": "6144:kFhl6qr4vMTLU40Oe0xK6A/oSMMZhOWi52z6TcS7f10MY:k38qr4vMTL4OeOK/o6ZoWiMQcCy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671179438, "uuid": "2f08f5cf-6254-4fa2-af8b-06b32b1568d4", "value": 228565, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671179438, "uuid": "60df2370-2d48-43b2-9ba4-e4cd044e970a", "value": "application/x-bzip2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671179438, "uuid": "119e33bf-dd1d-41f2-abd8-411a554d3f14", "value": "PO87875620 2022 DEC.tar.bz2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e937f495-7d2f-11ed-9db1-42010a9c0080", "comment": "Malware payload (DarkCloud)", "timestamp": 1671188024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671188024, "uuid": "b032737d-5907-42ac-b750-9bdfb7fcb3d7", "comment": "Malware payload (DarkCloud)", "value": "71a6ab33f31b690fae0cc294301eb53f", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671188024, "uuid": "b6a6e3fb-9845-4f80-bae1-15cce1f797a8", "comment": "Malware payload (DarkCloud)", "value": "87df770774093167df16025aa4c0a745091671d48f1113212211f4a3d79afa7a", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671188024, "uuid": "8b9fcbc8-e753-4581-be16-2d95e0487c43", "comment": "Malware payload (DarkCloud)", "value": "eb5263efbc05bd7fd135086b4ee635e49119854a", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671188024, "uuid": "596336fd-1ed8-4b11-b480-2fe1507cd05e", "comment": "Malware payload (DarkCloud)", "value": "822a8cd2eccadf44a7ec5f8394a282787fe4a567a9b91b4db3b677eea07c376667620dfc14a804ddf9813dd779977d76", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671188024, "uuid": "1cadfaae-d524-4b25-909d-423284f39d3e", "value": "T1027523CA7AD02921CEB53BF5A8E15049163D2E423B36C19638B4735D0FB3783EC565AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671188024, "uuid": "97ae534a-25fb-45a8-be02-a4150459b15d", "value": "49152:f9fyrAY4xJKdHcr3f2JggQRZDMrTNRe0MGwOwtD:fRzJ88LKgrRo1dwnD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671188024, "uuid": "1550d388-9ebb-413f-b4fd-7cca24870d58", "value": 1663008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671188024, "uuid": "91d52be4-8d11-487d-9a11-c681176b654c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671188024, "uuid": "eaf821dc-674d-49c9-b49c-09e097986099", "value": "pierwsze zamo\u0301wienie nr 0015022012.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b2e1617-7d20-11ed-9db1-42010a9c0080", "comment": "Malware payload (RemcosRAT)", "timestamp": 1671181424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671181424, "uuid": "835ee32e-783f-4b3a-a0b7-fcbaa702d489", "comment": "Malware payload (RemcosRAT)", "value": "f0bf9a1017022eee8830874b817c208c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671181424, "uuid": "3def803a-c31d-475b-ac8d-c7da27c3817e", "comment": "Malware payload (RemcosRAT)", "value": "8805ca28e94bbac20828bd1fec5430481f724766240363c56d67041301021b08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671181424, "uuid": "3a0de1b7-360a-41d7-802c-dfaefd233f67", "comment": "Malware payload (RemcosRAT)", "value": "37351369b4a765a64051987eaf78bc982758b055", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671181424, "uuid": "fb1e6abb-a0fd-437d-bd72-d9da5b642861", "comment": "Malware payload (RemcosRAT)", "value": "85d1df4743d3eb7d0b8d00b991ce62090156dc31f46d58025b03628bd1d107c629db35530ed908ed78152a5895f1fcbf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671181424, "uuid": "b7f5bfed-f36d-4216-ae88-cef5105e87f8", "value": "T119021A26A39C5B37DDAF0F338D6323811328E3518D4FC75F2988410F9E97B1549E2A50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671181424, "uuid": "1605b0f1-62d8-4243-acb8-43be8a97b3ab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671181424, "uuid": "47f853da-78f2-4b75-810c-bfab8a346b78", "value": "96:FfU12QxserPPdL0MIHZjkP8oxSm5cHWnXQr4rC4pskML65P9PDxzNt:FfU12QxnFLCjexSm5c2Brv1l5dn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671181424, "uuid": "82c4f4c0-f6d5-42a1-b72c-7c039d976294", "value": 8704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671181424, "uuid": "c6fce0a6-3711-450e-93f9-53b7e8e05163", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671181424, "uuid": "38ebe025-d7b2-47f4-b993-de7382d1e4fa", "value": "Reftt121655888.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "582f4143-7d24-11ed-9db1-42010a9c0080", "comment": "Malware payload (GCleaner)", "timestamp": 1671183057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671183057, "uuid": "048d7889-4607-49a4-9449-85d3668fcabb", "comment": "Malware payload (GCleaner)", "value": "265cd61b1a837e50790d466d3daaaa24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671183057, "uuid": "f0d0af70-bf06-4eac-ab68-12469465f43e", "comment": "Malware payload (GCleaner)", "value": "88262f32e8816a03bbaa2410c720404c3ea069a4f51832fbd8ea47b383d2ff9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671183057, "uuid": "4026fb80-a665-4c11-bebe-1e40046732fe", "comment": "Malware payload (GCleaner)", "value": "768f00a316817abc02e18b507b1c2988bc2719b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671183057, "uuid": "1aadba01-0aa2-4152-86e2-acba354e4ed8", "comment": "Malware payload (GCleaner)", "value": "b83537d906aceb4264c2e209c0aec7283db7a6e1a3a6aaff64cc7cfcc3fca974def7ef97fcf43faf32f884166bffdc7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671183057, "uuid": "7a047394-7869-4135-ae8b-c0aef18aa372", "value": "T16DB523BFA1C00074D1F768F83C269D7262E66C1B2D64D85E3BD87E8B77F69C1590221A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671183057, "uuid": "326a878f-7c43-4b1f-bef2-7e2fc1604f4f", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671183057, "uuid": "c782c82d-f9e0-467c-a00c-24dff778931c", "value": "49152:IpSLMGwNph+LFqPvL9APLzZkhJW9jrkXZ7fk3bTpWJYeOCgSY/imY:IpS+NKLF8APv1kp7YgYcY/imY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671183057, "uuid": "9e417448-4fd3-4a14-9f72-c6482c6b0c66", "value": 2388401, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671183057, "uuid": "88caa23a-3e38-4bcb-923d-44a0145d58a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671183057, "uuid": "f353fe75-ade5-4c2e-afb0-ca16d996b520", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68d1e03e-7d11-11ed-9db1-42010a9c0080", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1671174924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671174924, "uuid": "3398487e-00c1-4c57-a4e5-4d783495fd23", "comment": "Malware payload (ArkeiStealer)", "value": "ebd8b67545fbee27480f2df5ef90dd80", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671174924, "uuid": "3350f395-4d37-401e-af0d-959534ccb62e", "comment": "Malware payload (ArkeiStealer)", "value": "891c35f3beb6475db578592af709f7738fd944b907d02aef8eaf17b55eb27ac3", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671174924, "uuid": "477b198c-f48b-4315-9d33-c3fedf0ccef8", "comment": "Malware payload (ArkeiStealer)", "value": "9073d1c85f6db65ca4ef366b7de94af9f0f4c7dd", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671174924, "uuid": "f2387047-4f2f-4fa4-b267-98c7e07a8217", "comment": "Malware payload (ArkeiStealer)", "value": "71b8c1c8da3a6dac11a8f056872f4898f87754a1ceb850bcdf8d06080ca538b8a16e33e6fa226c968943241dff734bfe", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671174924, "uuid": "f86982e4-62a6-4e9d-932a-f7e60e283bb1", "value": "T183B49E6EA1A316AAF0C815F45E946C6CA081BE74279840F731FD387F8F1B7A4CD56E06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671174924, "uuid": "6e136681-8635-45c1-b39f-1ec099b8dac0", "value": "74fc982415e631eca38250b28759b9cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671174924, "uuid": "cfd17944-4df9-484a-b8b3-43097bb6f498", "value": "12288:0ZqM+DLDfcPSlUWFmFsZDTepju/5bHCZjtio:0ZGDLjg1xuZDTR5bHCe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671174924, "uuid": "f8090c60-8e6f-40ea-93f2-f3c4ea7844c6", "value": 534528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671174924, "uuid": "af299841-55bb-4a87-8b68-f285f6aed45b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671174924, "uuid": "c3979d1c-3a2c-405a-8f5b-3d32376e6983", "value": "torbrowser.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55f87e9f-7ce3-11ed-9db1-42010a9c0080", "comment": "Malware payload (AsyncRAT)", "timestamp": 1671155136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671155136, "uuid": "20952851-a755-4dd8-b9c3-80b940438541", "comment": "Malware payload (AsyncRAT)", "value": "b2b2a161e7a05236ed58161fbfbcdc77", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671155136, "uuid": "eea79f63-349a-42a5-a4cd-2d3bfd04a8c9", "comment": "Malware payload (AsyncRAT)", "value": "89969afeca46512d82d5abd9f2fcdaac7bfcfcc9fded8072c49664414bdce90f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671155136, "uuid": "d3c7ecd0-24b5-4f72-ada1-07db7422d45c", "comment": "Malware payload (AsyncRAT)", "value": "f6d26ac8a35c90d5a0986280e19d1ec6f71f985a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671155136, "uuid": "eb29db72-efa2-4dbd-9ffc-52e9dbf6ed5d", "comment": "Malware payload (AsyncRAT)", "value": "4df14223d99ae3e37a8f85a46b62428bfcbd9e9d3726f845e43c38db830c6ea48d5a131059cdbf3a9d97257a18ad2264", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671155136, "uuid": "87026051-42e1-4fb5-bd14-4ee216952f9f", "value": "T149534D043FE9D129F1BD9FB4A9F2764449B4A15B6A02D64E1CE411CB0632BC39D436EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671155136, "uuid": "b3054782-bcc2-4998-bd16-f6f45975d67e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671155136, "uuid": "e65d3ce6-84ac-409a-b004-b47157eed9e3", "value": "1536:anKDtaNvPmM5O11/1goHpbRSxNquP4/sqPATaq7Mx:anKYNvOM5O1EoJbRS7iMaqIx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671155136, "uuid": "daf4877b-c9a7-4393-a45e-39d900d5e368", "value": 63488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671155136, "uuid": "1851603d-bbee-47bc-9a63-3b27dae7d540", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671155136, "uuid": "a18c920d-f939-4f8c-aafc-e0f8b03cc9d3", "value": "Stub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c76b151c-7d20-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671181525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671181525, "uuid": "50e3f2f0-102d-4206-8147-4a24b364fa63", "comment": "Malware payload", "value": "41e46a59c9b1f7f33c26c58fc6ad4a5a", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671181525, "uuid": "3587761d-577f-4197-89f2-34328b74cee8", "comment": "Malware payload", "value": "89bb089b93f771a0127e2b764d8741c95ead4f43f61043c51bb67ff3b20a8361", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671181525, "uuid": "5dd084f1-5444-450b-9c8c-467dce5bca9f", "comment": "Malware payload", "value": "b3c4a70e9d7e4bf0ed8dca951c2fac40ef8b2786", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671181525, "uuid": "d9d99ed3-2bff-4a07-9378-6128ad5e28ae", "comment": "Malware payload", "value": "ca8dba7c329f94fc6151d130bc0283c14298093cc9c444d9ed2513306faa4d6a889dddc522a3591709de81ac497bef96", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671181525, "uuid": "cb3d4aa7-84a9-4d62-b18a-70e28303cdf5", "value": "T1DF06337F7A269D73ED65F311727063C714A2232E11B1132F17AC87E60C8A6316AD9BD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671181525, "uuid": "01194276-9c71-46e3-883e-c4d9f944254f", "value": "98304:PQ4YQN87M47uNEWFLb1PlFA+mtiIQSJzcLj8f2S/QXuX:PQ4z8IAuNLLb1UtiCJzcLi/J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671181525, "uuid": "27873718-028b-453c-93d9-d321195fece4", "value": 3922744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671181525, "uuid": "62a02ad6-b524-42d3-92a4-df97c186c043", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671181525, "uuid": "aecd5dee-278e-4062-8943-3e593e155ee8", "value": "41e46a59c9b1f7f33c26c58fc6ad4a5a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97c9031f-7ce7-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671156964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671156964, "uuid": "00c35ab5-8b40-45f6-bac2-9132a58fd1d8", "comment": "Malware payload", "value": "793905bcf5f5c5b2509e5cea7504ab5f", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671156964, "uuid": "b25b7962-f2cd-49ed-8ab1-e103280bcd69", "comment": "Malware payload", "value": "89cfe73beec272d4af03d2d2cf3a37ac0cd44de347c9fe5e0f051e8869c87f52", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671156964, "uuid": "1d57fe48-247b-49a7-90a6-e19e2a8b60e4", "comment": "Malware payload", "value": "71a85374c50d62b52da51715e9eeb696a237e1a3", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671156964, "uuid": "eb30688e-7ca8-4c97-9532-ea48231d3666", "comment": "Malware payload", "value": "978347f86ec5acd90f423ace248713a77ea917e581ca026b31508aebb0d67dc423d1e3dc907219d00bd314b042326d5e", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671156964, "uuid": "344b899e-f618-41dd-9d43-7b88265e50f7", "value": "T1C686E0D6F7D6E92AC4332172CC5667B521998C268E42CFC765483B2E34B36E80F55EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671156964, "uuid": "ecf76144-4d2f-4244-aac0-1fe80f38ed85", "value": "98304:PSwfwQmsijbfak/TQ732dikg2d+OEc0Szw74NEsrCdvKiKEjH:P5IQcnfaD732dikpyc0SunvKe7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671156964, "uuid": "c4ec8456-3f27-478d-8515-af2682e75dcd", "value": 8153265, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671156964, "uuid": "bbc02dbb-262a-4921-bb88-3aeffae6c8fb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671156964, "uuid": "f1d09b68-c5b0-448e-b9ce-79b50c2f02bf", "value": "Cerberus.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a62f629a-7ce8-11ed-9db1-42010a9c0080", "comment": "Malware payload (AsyncRAT)", "timestamp": 1671157418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671157418, "uuid": "eeef91b4-556c-48ba-b6bb-0c743680467a", "comment": "Malware payload (AsyncRAT)", "value": "8d8ba183b96eaa5fe721060b7f37905c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671157418, "uuid": "e4c7efbf-fca6-4474-b9da-3ce6129d4c97", "comment": "Malware payload (AsyncRAT)", "value": "8af96920cc3565dea5bd923d276be018f1fd259943e99d1c5c7ed9abd61f13e5", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671157418, "uuid": "9a437e2b-ddd5-423e-b0d9-cc7931dd5e65", "comment": "Malware payload (AsyncRAT)", "value": "f67a05770055305a97fc559ad78a7360cd7d317c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671157418, "uuid": "15115735-a271-4b3a-b6b7-d7b6707cfee5", "comment": "Malware payload (AsyncRAT)", "value": "8f3ebfd9994626a360682f0ec797586a71f09e108c77a96847bfc27f0a5f9b717330885f2144b9c45533f005cf973566", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671157418, "uuid": "433e13dc-8225-4cce-afb1-a6c641514dcd", "value": "T1F4532B043BE58125F2BD8FB09AF2668446B9A6577A03D90D1CD441DA0723BC6DA43BFF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671157418, "uuid": "18ca4183-3cbd-4b09-9358-60bcf77f1571", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671157418, "uuid": "2d61e1a8-7916-48e0-8e39-73eaa752bc59", "value": "1536:l26UKVZnSSTAd6HozOqSsa9xb33TZumWUbbHx:l26UKVZSSTAEIzwsaHb33ccbjx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671157418, "uuid": "2ed72cd8-493d-40c6-912c-92dc9e1c2b3d", "value": 62464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671157418, "uuid": "07c50d3f-d7af-4ef1-9726-ba50987d3c92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671157418, "uuid": "b2bec595-2a6e-4506-b9da-5cc9040ccd18", "value": "Stub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a656853d-7d4e-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671201226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201226, "uuid": "c9bd14e7-a86a-4e3a-8f88-4854d86dc96b", "comment": "Malware payload", "value": "c3693a8422ab4b3af6f5fd93484c85c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201226, "uuid": "b3aa5f17-3a48-4660-81f6-d42b36260886", "comment": "Malware payload", "value": "8beb70d99ea56763a805fe4152ad7c1ad8237c67fa8c27bd4fad4d1ee265e46a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201226, "uuid": "62249273-3a7e-4ab3-b09f-a341897bc9c2", "comment": "Malware payload", "value": "ab0eea6087fe8fc324e65328ed8696917a590609", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201226, "uuid": "6e18e3f0-e1bc-4313-b060-fa8f87705c70", "comment": "Malware payload", "value": "47d73325f2a329dad7207870000d877a7dd324bafbffcce324fe5bbe70b5996f81e8e61b903116b3a309be918e997fd0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671201226, "uuid": "59a43bd5-ab73-4043-8947-abc6bbc5f4de", "value": "T10ED36C2471D0C272D915107647A6CF71493A7C382E129ECB6FC90AF50F79DE6DB2A38A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671201226, "uuid": "d48a2151-be51-4c9a-bfdb-cdd3e75a3827", "value": "e85508dfe798dc480467052fa273374d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671201226, "uuid": "00865a93-9b31-4aa3-a341-27248fa5c8c0", "value": "1536:LKxc4RtWJO//IFKnRkfJg29k0SBfc1XLqs8KMBC2iaCD2xenYT8Ji1dytJivnSqA:Ol/QHSBf6Lh8fU2zq5JinzcmU5GW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671201226, "uuid": "a0377b75-c3eb-4b69-9228-2c1ec3388b26", "value": 131072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671201226, "uuid": "eab100aa-17ae-4da7-97ce-e3fbe82511dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671201226, "uuid": "09ac041a-d6cc-42fb-8c82-c84058401883", "value": "SecuriteInfo.com.Win32.Evo-gen.2402.10965", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c94c3814-7d45-11ed-9db1-42010a9c0080", "comment": "Malware payload (RedLineStealer)", "timestamp": 1671197420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671197420, "uuid": "e45b7421-7aed-4c35-b61e-07a6d9f3cc6b", "comment": "Malware payload (RedLineStealer)", "value": "b62015eb4ec4077a7f9e866163050056", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671197420, "uuid": "3bd2c96e-8086-4856-8ab0-c5ad6f42ca58", "comment": "Malware payload (RedLineStealer)", "value": "8c4229f4b4eef457d86653b233e53d13456c20d612c83112d742887e29848163", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671197420, "uuid": "c28240f1-c73d-4b6f-98c6-303f764cc7ee", "comment": "Malware payload (RedLineStealer)", "value": "28bb240dc8a9107c8c7f64852ea863aead5c7179", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671197420, "uuid": "4825d311-76c4-416e-a2b0-096bd5a04d91", "comment": "Malware payload (RedLineStealer)", "value": "131bcd0e1d072f2133fe6a027e81306fb905449179092386cb8e8959a071a01ccb72dfd2454305d9ed32213577c6fc3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671197420, "uuid": "c94fa4ee-4326-40b2-9007-80da20f274dd", "value": "T10D74F110B7A1C0B2C66F413488AAE2E1556FED316D719A0337763BCF6D30742A97A74E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671197420, "uuid": "779a9e04-a0da-4b1e-aa5c-f7c911a96d48", "value": "2cc3e4b8a374ca30888470c0a531eceb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671197420, "uuid": "4c41addb-e577-4e1e-bf12-816a1aaa9460", "value": "6144:HQLc+VxTEIJ0MOQZdX3cdOALZ0shKh6C6scL89tfN8qMrc:HQ7VxgU0RQk0AFbg6C/dN8n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671197420, "uuid": "c29da3d1-a292-4789-8e08-1b3c3a3bbe52", "value": 342016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671197420, "uuid": "34428d33-1cd7-4f48-bde7-0b36c38ca509", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671197420, "uuid": "2aec57bd-c56d-4a56-83a9-298110a5e55f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "322a9af2-7d0f-11ed-9db1-42010a9c0080", "comment": "Malware payload (Amadey)", "timestamp": 1671173973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671173973, "uuid": "e131d3c1-da35-419e-ba05-6a9198c63b2c", "comment": "Malware payload (Amadey)", "value": "11c6cb4457e5519adfab3f1611799a62", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671173973, "uuid": "8d11dd78-8cc8-444b-b0a5-a8d398d722fe", "comment": "Malware payload (Amadey)", "value": "8c7429f299879081d88b42c483ed6859a6facbee8e257d6120d95513bc174e06", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671173973, "uuid": "64f0e5ec-8839-4ea4-a59b-c95e208a1ef8", "comment": "Malware payload (Amadey)", "value": "0b3cfb27d981dd816d206ef62cce8b71e3ec3002", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671173973, "uuid": "3ed40759-3c11-4103-990d-54dea8764433", "comment": "Malware payload (Amadey)", "value": "811d0f64e480dc28d4dda8373f23be89d4a132cc526434ca72b6d69f431bdcad9d1c0abcbcaabed5ed0918de455dba29", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671173973, "uuid": "522eb80d-93e3-4c98-b0ae-7db10457721c", "value": "T1FA54E022B2B0C472C19F15318855DBA5AA7FECF05971A60733763BAF5E30B50963A70E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671173973, "uuid": "da7d4b8b-8429-4227-959f-beac8e4761b7", "value": "b35462da489bc13bae884e55b5227599", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671173973, "uuid": "a0cb2da1-3ad1-442e-a6c4-5e6b02a2c69b", "value": "6144:FhkBdL3yEmP9PWfePiOdDV+XtEC8qMrc:FhkPGEmlPWfeq+DI6C8n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671173973, "uuid": "e19bf725-9d9f-460d-87f5-df59b13da06c", "value": 293888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671173973, "uuid": "7a641724-368c-4f55-bc36-38aa1e9485c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671173973, "uuid": "8622f103-619b-4a7c-b3e2-a5178cb8dccd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12ca2812-7d7e-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671221595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671221595, "uuid": "53f17f34-c108-42a8-9892-b1ef48450e66", "comment": "Malware payload", "value": "cc82a6b55d505f72d9b82cdf4d5488e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671221595, "uuid": "30d5a18c-99c6-4c7a-adbe-e65ab413b0fc", "comment": "Malware payload", "value": "8ccf80bbe78b4ba70fe6f95435ade58e30e29a61a6edd0909613a6e0b0ad1f66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671221595, "uuid": "16ad78f4-54a1-4661-93f6-01527f302caa", "comment": "Malware payload", "value": "ca6dd95ec89208e2c520ed2367c2688bcad9b86d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671221595, "uuid": "b93038da-13e6-4f0b-946f-0a470794fc76", "comment": "Malware payload", "value": "57664f1e3b4b2f2ed4f7d109c97e6d0b57d117231875d5ec2d3ca3a1cffbf0beedef83e2ecc12d68af7c3c7d9994415e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671221595, "uuid": "91e0eeee-ed9f-4674-bc03-f907295b0025", "value": "T1EC24BDF173A0D46FC152D7308819EAE8AA3AB8155E2195F33B14362F1D702D15AFE27E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671221595, "uuid": "69d30171-880f-442e-8563-ed8d7d5db88c", "value": "55ba8cd792699d5c43b351a2daef2eff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671221595, "uuid": "e6ddadcf-feef-4098-8599-180137d8a61b", "value": "3072:jOeS7DLZikI0RWOLgSGZElAfRk35UxNULszGmK6O40zwUzQRKF+:ybLskQNiCfO35UxmgzGFR40M2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671221595, "uuid": "784fde09-b312-486c-b02f-8a0228752c4b", "value": 219136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671221595, "uuid": "87df16a4-9930-48b6-8312-7242345b86d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671221595, "uuid": "7d8249cd-01da-418d-8fa1-cb8b19c58f0a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27a1e870-7d80-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671222489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671222489, "uuid": "b15dbbe2-33eb-4f1c-9a2d-3e2fed7e07d7", "comment": "Malware payload", "value": "abf16e420ef08d5d308181695160988c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671222489, "uuid": "5fd7a428-c6c7-46a0-b856-7f782b08b3d0", "comment": "Malware payload", "value": "8d5a455600426642f42fc17b99441f256d1be5adadff703a9239724c4c0359c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671222489, "uuid": "c260c2b9-50a7-484b-95df-b8194899399f", "comment": "Malware payload", "value": "2c3b3fb0bc11f47ce03b621f7e008b8fac1fb8ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671222489, "uuid": "997f2ba3-4e07-4a39-957a-9666300c771f", "comment": "Malware payload", "value": "f8ab2a619b66f88746784e3e81f0a077c96b960f2e9e5a6e2185faf1e771f55e3f84f17f3ba8aa2cca3bce301859f6cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671222489, "uuid": "b40a5717-f0d5-46de-b573-617cef8f291a", "value": "T18C74E0F07791E07ED191D7309C2696E09976AC108E3299F33B402A1F6E706D295FE27E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671222489, "uuid": "e8f1930a-4157-4b48-b8e1-28fca0b4f10a", "value": "aa9c378109186462717e17e657d0c833", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671222489, "uuid": "f3165e9c-41ca-4475-bc5d-60174a9aeac0", "value": "6144:2/P8LxAKv2S5a5ILsH5xXu8QBJfxCd7fWmixUtgzjw93M40M2b:2cOKv2S52as7u8QBCdbniL/G3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671222489, "uuid": "2a8c3a36-7db7-4239-8b3d-b477c48a3f87", "value": 342016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671222489, "uuid": "76f9b83f-e8c6-4126-9cde-baac7d292f2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671222489, "uuid": "9ef37010-acc6-41ad-b36d-e974a734d030", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0d54ca3-7d88-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671226262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671226262, "uuid": "b568cb40-b404-4956-911c-9f2f7e3de71e", "comment": "Malware payload", "value": "82b11fc540ed510e495841ae4219e2c2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671226262, "uuid": "52b903e2-a44f-4fee-956c-24138af3acce", "comment": "Malware payload", "value": "8d8ff14c15fb25687181bc0ad6d0cabecbdaf3167e970bd32588165daed0675e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671226262, "uuid": "119612a3-3c11-4d59-9619-537f66d6866e", "comment": "Malware payload", "value": "3a67efd4945e62dd3df91f78f4b194e7518f0193", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671226262, "uuid": "d6a55540-cac7-4c17-882d-6e7cd7b412b1", "comment": "Malware payload", "value": "fee34231613438f613e308109c2c281e022e213c7fef89fded9ead52e4fab12347438d57ef8e9348fb39e19b6df44d89", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671226262, "uuid": "ff71f245-0e2e-4b96-b03e-954a0608b351", "value": "T10752FA08B7D48372C9FE1B3919B6A2505331F6127862EF4F19DE54CE0C57BC855A2F62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671226262, "uuid": "6d02d293-0967-4ce4-a9e3-4d12b9ddd0eb", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671226262, "uuid": "123598e4-be16-4f8e-866d-5c3af0ea1d1c", "value": "192:KB1Oc49T3KoDx9oQDeayPOnnoSkY9cxpxHXrDv0BtevIg:KHOcQ1xeQaJ2Vkecp3rDMBEvl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671226262, "uuid": "d68555b5-a84b-4d79-acf5-c9466f5baeca", "value": 14001, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671226262, "uuid": "8d49e79d-ff12-499f-a8c2-4666fc4a1c56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671226262, "uuid": "5d087d57-b77d-495e-be00-b12aab5ce9b5", "value": "SecuriteInfo.com.Variant.MSILHeracles.55063.30083.14272", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e2f0ae0-7d42-11ed-9db1-42010a9c0080", "comment": "Malware payload (Mirai)", "timestamp": 1671195898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671195898, "uuid": "9657a89b-177b-4763-a3a7-237e62d60db2", "comment": "Malware payload (Mirai)", "value": "747dd9ef4192b187e829b11176312e93", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671195898, "uuid": "d824b35a-c844-4f6a-bebc-bf984f4689f4", "comment": "Malware payload (Mirai)", "value": "8e30bab836426bfb0b76d5258951913682761eb9d153d8adc285ce648b401d60", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671195898, "uuid": "b19628c8-f678-49ba-ad79-dcdfa1bc21d9", "comment": "Malware payload (Mirai)", "value": "70339a2cdb57fc7f1c5253f0a465ccfcd3dbe193", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671195898, "uuid": "0f1a67a0-1bbc-4a4c-a429-10dcd29e4321", "comment": "Malware payload (Mirai)", "value": "070234912e91d9bc32aa80d7b1b5b3d1bc650ea0695d2b496ac5e5174e927400e89af9f2a91fa55777477d5ef2383228", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671195898, "uuid": "30a41ade-950d-4e0b-9085-f0e8eca07bc9", "value": "T17F832A46BC918E15C5C9227AFA2E108E33036768E3DEB263DE145F2467CB92F0E7B455", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671195898, "uuid": "08351673-c70a-4c23-909b-f73e76af4da0", "value": "1536:ZAn7hpYeF0NMSjE95qEjQI7wnOtbrzU2izMXnuMYiEGtmEt4i/:wpYTMz0I2ozSGtmEt48", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671195898, "uuid": "eb131daf-e7d1-4dfa-aeab-b6736f2d7f02", "value": 83292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671195898, "uuid": "ab823fa2-5b63-400e-a923-c0b98aed445e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671195898, "uuid": "df521634-1410-4874-8a2d-c9fc83955c8a", "value": "747dd9ef4192b187e829b11176312e93", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4309c95-7d84-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671224443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671224443, "uuid": "a9a92f2a-e4c1-47a5-9385-623977eabf79", "comment": "Malware payload", "value": "37cbab63379a5aca6992262a3bb1e5df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671224443, "uuid": "246904f9-0b09-4fc0-81ce-8c5f55c6e21a", "comment": "Malware payload", "value": "8efa107248a3b53b6c39f855a1805e1afcc5a4769730aff1643262b9c8bcdef3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671224443, "uuid": "d11ebed7-4082-460b-a4d6-b290ac69abaa", "comment": "Malware payload", "value": "349e86fa92c64e2f3054956e069f1feba6a03411", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671224443, "uuid": "a3809337-8af5-448c-b23b-cd21a6e0c591", "comment": "Malware payload", "value": "b0aa3e3c612972c143c5f662f8affa0060c0c2c779982d87ac0f35a9ae177d391d713bfba1cba83ae10cb964d1332b96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671224443, "uuid": "b7cffecf-318a-4ce3-be0a-f6a7d2e4393c", "value": "T1EFB5233E7D9400B5C5F306F47C166C2115E36E2B2D72D50E3B8ABE5B7BF29D2290621A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671224443, "uuid": "a348e0e5-c74f-444c-b826-2678003f1ec6", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671224443, "uuid": "a9362dc4-c922-45fa-bb28-e426e2130ae8", "value": "49152:EpnNPAkWST0OyDot7Q9iSpdo7a2zo4sW9SctcINUDZAtfRHveOCgSY/imp:EptAJXqt2iQdoVzn/4cqINK+dcY/imp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671224443, "uuid": "bca5dbb6-813b-4744-bf30-4589e3cd5f3d", "value": 2411868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671224443, "uuid": "a49c6dc2-3988-40c3-9caf-043840cdcd30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671224443, "uuid": "92405868-14ef-4542-8037-c63346360305", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a62de627-7d9c-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671234727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671234727, "uuid": "67de2c09-03bd-483d-8716-1d589c8508e3", "comment": "Malware payload", "value": "daa3627527dc2f0a919cfef9295289b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671234727, "uuid": "93e9f1ab-55b1-4055-8b37-ef135b5f312a", "comment": "Malware payload", "value": "8f20d542d3fcee0659f96efee7849f6c43324b35434e447bc7faccee1f25a958", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671234727, "uuid": "ae6561b4-bad4-4d5a-b2cb-d951e21d84e1", "comment": "Malware payload", "value": "1ec86907076ad623eb0a7a66af64cebe1a681d07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671234727, "uuid": "6fb6bc17-8aad-44bf-b485-b1354adae2ac", "comment": "Malware payload", "value": "85dab5d899f68060629a73ec1844c1c14b7c4c3159eacc001d77645a2115729fdf80f16934b80b688bc0445482098707", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671234727, "uuid": "4ea750d5-8fd4-400c-ac90-27c04b2435e9", "value": "T14E24BEF07690E46ED152DB318D15A7E1AA3ABD104E6295F33B182A2F1E302D056FE37D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671234727, "uuid": "b364b2d6-e64f-4d43-9a8b-1b6cf48f03e1", "value": "e6bd3d9b5d23304bda5e80b81c28964e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671234727, "uuid": "0673b7a7-399e-43df-a6df-a2dbf84c291c", "value": "3072:oqj8GLg0XpaaTRuclRfPFAB9i4I1Hjv5LszfdEJ340zwUzQRKF+:JJLg0XflVi9i40gzfeJ340M2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671234727, "uuid": "cfcf412e-1543-4f94-bc6d-191c1f579538", "value": 219136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671234727, "uuid": "ae22df1a-b76b-4ff4-b34a-4a7c9fd3a177", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671234727, "uuid": "2aa174e1-8ab6-44dd-8b52-4899c33a2cf8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80edc6c1-7d2b-11ed-9db1-42010a9c0080", "comment": "Malware payload (AgentTesla)", "timestamp": 1671186131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671186131, "uuid": "bc1778a9-8b75-48ea-bee6-c9e8c85d63c4", "comment": "Malware payload (AgentTesla)", "value": "ed8ee645d9a67f9838ed7e397713d054", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671186131, "uuid": "e9ed459e-6028-49b5-a70d-4d7db3155f6e", "comment": "Malware payload (AgentTesla)", "value": "8f82f4d058d5e4ab9abd2ee67eb992bd15a238f80c3a73f932f9c7de309756b7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671186131, "uuid": "1c9ec9e7-4beb-456c-8a03-9207dc7572d3", "comment": "Malware payload (AgentTesla)", "value": "1991d2383846d51aa911b013119c30bf21ab6f40", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671186131, "uuid": "4ef59000-77df-4a34-8982-759427c6bf0e", "comment": "Malware payload (AgentTesla)", "value": "1a44f24e363da489b5bebd1a2b3cedc5502ba3bd8e15dcc0f0163b04947844cf9db7a09d0552f91f08ffe6dc7977d5cd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671186131, "uuid": "7576ab3c-6a43-4724-aca2-290bb482f4f7", "value": "T1DDD1C901E7E941BAE96E737964AE4700B3FBBB973441DF5D34582116CEE235045A1373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671186131, "uuid": "c938a76c-ae46-4365-8014-121eec7fc292", "value": "96:kwpLbq4KNc1Ryy40rPCWT9vNDoA9VFu3Sjsrh1zNt:kebqF4yDAVJNDnUCjsdP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671186131, "uuid": "82e2d9a7-cb53-4a01-938b-4b76814cfceb", "value": 6656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671186131, "uuid": "8bc9fe8c-cb3f-4482-9194-6f57847e4020", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671186131, "uuid": "cd6d165e-a44c-4282-82c9-01fc4ff56217", "value": "BL-SHIPPING DOCUMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50e81ecf-7d18-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671177890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177890, "uuid": "d306857f-4134-48b0-b11a-12e05ef22858", "comment": "Malware payload (Smoke Loader)", "value": "299882a6172d5e3ec9921b9094a07433", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177890, "uuid": "9cb83c43-c71e-41f0-8733-82674b7d4855", "comment": "Malware payload (Smoke Loader)", "value": "8fa02e8b18587459b79877bee12fb9f7915535fbd88d8ea2a94cf108f561478a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177890, "uuid": "db579ea3-5374-4a42-aa53-e8c7f0bac731", "comment": "Malware payload (Smoke Loader)", "value": "206c944e7be530a61bac8909c451ba87cbb3d37a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177890, "uuid": "af559f52-1402-44c8-b5b2-94a8e6068ef8", "comment": "Malware payload (Smoke Loader)", "value": "b7e5fca19e7e4c99da2c4091221991db0ec269497a0558acde9dde978e15ec64644c847f64d439adbcc8aa8b2ac1761f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177890, "uuid": "21a01a94-11e1-4d01-bc12-b7324d4845a0", "value": "T1A434CF1272B0C4B2C16F15308869D7E19A7EEC315A71994377753FAF6E30B91663A30E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177890, "uuid": "9a60ef04-df9e-4087-90f5-3f7c9872a25b", "value": "b35462da489bc13bae884e55b5227599", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177890, "uuid": "95c5e5c8-caea-424a-a9f6-f3964f218426", "value": "3072:7etkyOczxLoAF1GicRHe7F6gYmrbf3TguTLQ2mppGT8wwg0FHtWqMPDcfuh:atkZULoAFYe7kD+bfDItC0R8qMrc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671177890, "uuid": "26dac928-e5cc-4bea-906d-48617b1e8db4", "value": 232448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671177890, "uuid": "a998abc1-4b52-47b7-aef7-04d342aba44a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177890, "uuid": "dfb3fb6a-b8d1-4849-9a24-68ffad164f0d", "value": "299882a6172d5e3ec9921b9094a07433.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2440577d-7d37-11ed-9db1-42010a9c0080", "comment": "Malware payload (GCleaner)", "timestamp": 1671191130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671191130, "uuid": "94bc4053-f985-408b-a550-f727864e6bf9", "comment": "Malware payload (GCleaner)", "value": "df07621db18df8701728814a32f792c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671191130, "uuid": "d9835774-7797-4f1d-868c-8795206a5bce", "comment": "Malware payload (GCleaner)", "value": "90114d6008936886ea52d6ce36e4980e27aa05891b83f46adbd80233f1f47fb0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671191130, "uuid": "2a952d3a-7198-4816-8575-5cc568bc3d89", "comment": "Malware payload (GCleaner)", "value": "88fcbf1bd967a8082bb5beb8cf77e314d5cb655f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671191130, "uuid": "8c15683e-6dfd-4e31-b457-73702c602fe0", "comment": "Malware payload (GCleaner)", "value": "f79e600c545a4d7f4ea55cb25e301ab7e65447c687734e911192ee2494c642035e1f7f05353157eebfbe74d459964901", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671191130, "uuid": "feea8c8e-d654-4776-abc1-685930596fef", "value": "T1E7C5237FA9845475C0F314F538329D3141D3AC2B6C39D08E3B987DAA7BF6CD1192AA4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671191130, "uuid": "4f77219f-bb11-4af9-946e-24eaa12c8170", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671191130, "uuid": "a47605bf-e804-4a8a-879f-8380a959ef8e", "value": "49152:ApxzxxCA4X5u7aVMC6PSO3n7ItxLPwHl1UdQjT/qfDweOCgSY/imQ:ApvM3yPSg7It5IFAQjTyccY/imQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671191130, "uuid": "ed0d4b2d-6cb8-4c46-81f3-decb3a73edf0", "value": 2580476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671191130, "uuid": "a80bd041-1310-4ca2-8165-82da94922f4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671191130, "uuid": "5b7aed2a-cbbc-4eda-bf7e-5cd73a1bed38", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c148b679-7cd5-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671149303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671149303, "uuid": "c92b0fad-5b71-49b3-91b1-9f5a83434f68", "comment": "Malware payload (Smoke Loader)", "value": "e0d9f9d936eaf4b312d72cb40cd486e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671149303, "uuid": "330bbbcd-d259-4130-87ca-0bf9c82f5835", "comment": "Malware payload (Smoke Loader)", "value": "9053f58de6d3c3087028c862bee21859928bc33eb686679827ffc01561a95659", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671149303, "uuid": "8e11d624-04c1-4930-a8be-8451abd40257", "comment": "Malware payload (Smoke Loader)", "value": "e84560ba120df5ac5745022bb2197a859e9b0fdb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671149303, "uuid": "1be2158a-ed3c-4823-b29e-88d8b96767dd", "comment": "Malware payload (Smoke Loader)", "value": "72c1c153bbb796903300059a90d087c35c8391a3be62751961557ca6921c5a17e100cbc4d3abfcebf050ebb9ee9a7de5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671149303, "uuid": "f84ff65b-17fd-43da-81e3-c3ab511f4d4a", "value": "T1B274CF107EB3D4E1F931C5714826FBF4666DB820EAA1D633230AD71F9DF22938526B09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671149303, "uuid": "8591a023-925a-4d9e-b763-82ce80eb2696", "value": "2067eb05796787c0f2b3dc09403197ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671149303, "uuid": "b79b2da6-16bd-4cd2-9896-6365ebb2264c", "value": "6144:stYItL4iOln/Clx3FWCqH2+deYjFZV0iPvzpQ6ijLxQFiaI:Wt7OZ/Cl1F5q/dBtxnzpQ6ijqF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671149303, "uuid": "d72b32f7-0ac2-4505-bf8d-a601b0f87d50", "value": 342528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671149303, "uuid": "286e0f6e-e566-4021-90d3-f31c64cbea01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671149303, "uuid": "cbac716b-519a-4731-8d58-5ddbe2cce103", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a348870-7cfe-11ed-9db1-42010a9c0080", "comment": "Malware payload (Amadey)", "timestamp": 1671166685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671166685, "uuid": "163d4712-18d0-4b27-9d7f-8382b022d14f", "comment": "Malware payload (Amadey)", "value": "b53d5e1b34b3766b8d35dcc5cc067f6e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671166685, "uuid": "a9990c2a-fa5d-4ba6-972a-dca835a589fb", "comment": "Malware payload (Amadey)", "value": "906b6d347d54f34e76605ba55dbb41464fd392e09fbd3283da304a613a170294", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671166685, "uuid": "534a498a-7910-41ea-8135-a8bf0af688db", "comment": "Malware payload (Amadey)", "value": "ebb63954b257844c07b77bedd6c988f1c395afd2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671166685, "uuid": "c7f67398-7208-4b42-9207-52c463461a0f", "comment": "Malware payload (Amadey)", "value": "bfd4b6090b4a230c51c4c63d2d6c18304cc4d0fb120a80079084b3236eb43d95e4a8bcf41c41dacac89a353e0bf6b8ec", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671166685, "uuid": "ac6845e7-ad38-4ca3-bdd8-a84e224ac4bc", "value": "T1F984E0117A73D4E1FA32C5754826EBF4266DB860F9A1D2333709D31FAD702A3896E709", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671166685, "uuid": "571847f8-e76a-4ef8-a7c0-dcb9f892dd32", "value": "2067eb05796787c0f2b3dc09403197ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671166685, "uuid": "adadf8e8-717e-4ba5-a807-06d96c798c35", "value": "6144:R8YHiLf/Bsng7RHPcn96LFNA+nLgnGKq6J0iPvzpQ6ijLxQFiaI:ZiLBgg7VEnMG+MPTJxnzpQ6ijqF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671166685, "uuid": "d44fd276-f0cc-4d7a-9f7b-68f54a773b6a", "value": 381952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671166685, "uuid": "632fb450-6115-4d2a-b7a9-9a7c631bcb3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671166685, "uuid": "f6230d00-166d-452a-a2a1-83c9e7cb9261", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccf60007-7d38-11ed-9db1-42010a9c0080", "comment": "Malware payload (Formbook)", "timestamp": 1671191842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671191842, "uuid": "0fe200c4-896c-48d9-944e-a53e7459f61a", "comment": "Malware payload (Formbook)", "value": "f0e4c1267b74749baa333af7b79863e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671191842, "uuid": "1a99ff13-b156-4190-a33b-b2e2fc576564", "comment": "Malware payload (Formbook)", "value": "91218386ed25d62220408973a03c76b8c4fc44512a60eabd0e437b2bbd10e7d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671191842, "uuid": "9672511b-179d-404c-8f21-6c85c0006823", "comment": "Malware payload (Formbook)", "value": "8392408915040e7397d0c5ef8415748fd41ed51c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671191842, "uuid": "43f0dba2-4dbb-4dbb-a144-74ac54339564", "comment": "Malware payload (Formbook)", "value": "49005c46a9849a0c804b4bc2c9495cf1c6a293cafb8a44f87930b7f59ffdc200dff984bb0c123c32b313933e7203d98a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671191842, "uuid": "6ed1bee9-519f-432e-bae1-aadd7e7b0ece", "value": "T1DB54F122F3D3849AD9924B302B3BDD6D0AB6CDA949F1564B23B83D7DEC773C22445189", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671191842, "uuid": "ae67bbdf-d102-4c09-8f1e-9e017002726a", "value": "97318da386948415d08cef4a9006d669", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671191842, "uuid": "7b529326-8770-4abb-b394-e3dfd6645d36", "value": "6144:gkwn7X9cBmCuwC8XJDaXdihVmQzohW8ktHVKMZpWK4:NBmn8ZDAdKMQOW7VKIpWK4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671191842, "uuid": "3c4f60a4-8f22-403e-9bbd-263276a210af", "value": 292489, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671191842, "uuid": "c1136f81-a2f4-42de-a73f-abd6f5c61fa4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671191842, "uuid": "3dbb5833-2151-4801-a6ac-a59b9cd30f82", "value": "Inquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3cc7f1c-7d03-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671169091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671169091, "uuid": "30c48ff9-36ca-4ebe-a76e-dcd7ec52f4dd", "comment": "Malware payload (Smoke Loader)", "value": "96318cdf1347a465f57f2499031351f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671169091, "uuid": "706d8eb0-5cf6-4a72-ab49-a9131d6879eb", "comment": "Malware payload (Smoke Loader)", "value": "93ac8e56d86c07b47e7454e14d22edc02af35374d3880d8487c89234fc433e6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671169091, "uuid": "a63f0138-5dff-4efb-9b47-54df2b3c3299", "comment": "Malware payload (Smoke Loader)", "value": "c35507249d56a596b97cc44404874dbda4e4ee4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671169091, "uuid": "80748222-7499-4f17-b666-b4855d495a70", "comment": "Malware payload (Smoke Loader)", "value": "0273cda3ae679613dde88310c9d227830d8f54a11c999046a8345f1ed75c3e1b0553a820eba98fc2cbcb967cf477c673", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671169091, "uuid": "ecd7aa76-3a2b-47eb-a3b3-dc8e7ebe3268", "value": "T1FE34D011B370C071C19F26308825DBE55A3EED31DA725A4777753AAF6E30AC0667A34E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671169091, "uuid": "dc32d535-2bc7-4539-9f08-087014d53cc1", "value": "b35462da489bc13bae884e55b5227599", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671169091, "uuid": "82370e5e-7a77-45a0-8a2a-bd5fc816447a", "value": "6144:9NkUPLKtlEiiJn0SLrdQt1Y/tsQ48qMrc:9NkUPOtmzyr7o548n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671169091, "uuid": "f34351c5-8003-4733-a13b-c916e12b242c", "value": 232448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671169091, "uuid": "705bff23-11a0-4238-9a09-ba9bf98898a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671169091, "uuid": "1756f8c8-7467-4073-97c3-415c4cef33de", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78bffdea-7d9c-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671234651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671234651, "uuid": "ce3a3e8b-47eb-439f-b481-9f951de15fc2", "comment": "Malware payload", "value": "173a9d568b9ae3ce7ceaec87bb6a221d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671234651, "uuid": "a0891eb9-47e8-4e24-b6da-6accaf25ebc2", "comment": "Malware payload", "value": "93f90cb4e67fe5ddf3d92c84b276034174ceccef90cf3c2f938dbc792cbe2e57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671234651, "uuid": "88974778-8c16-4fa7-8b6a-95453736fb3d", "comment": "Malware payload", "value": "fdbc0ce504fb5d5fa875f3dd21bb166c24354349", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671234651, "uuid": "4ac897b7-893a-4a15-bbf0-0c911a100a5a", "comment": "Malware payload", "value": "fcb1c7514a1581acedf93ee2ee820acc859d379a41aae4c25e3f8ae5f0a032f36a99a8fea2362b5a2a361a54025a7713", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671234651, "uuid": "55d75c92-d54f-4c51-aa7f-0d3c1153382a", "value": "T1A324BEF137A0D46EC151DB32892597E4E56AB821DA3259F72B043A6F1E302C056FE37E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671234651, "uuid": "48e4675e-e4ef-4629-b5d5-cf30da4b8ced", "value": "e6bd3d9b5d23304bda5e80b81c28964e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671234651, "uuid": "24166c56-1a94-494e-87e2-621a02d4cadf", "value": "3072:yEFDBLZEUswaTRH+0SqQfDyKXCwDORLAKELszG3pDHe40zwUzQRKF+:pXLZEUoSqQfDVvy1EgzG3pre40M2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671234651, "uuid": "028bd870-32c2-44d8-a949-45d478ab0624", "value": 219136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671234651, "uuid": "52458e9a-d4b1-4f40-bf33-32c075a28b06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671234651, "uuid": "13f9ea1f-96f5-40c2-9102-0ae0aae6ad5e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8c37a63-7d42-11ed-9db1-42010a9c0080", "comment": "Malware payload (Zegost)", "timestamp": 1671196184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671196184, "uuid": "bd9b76ca-cccc-4b8e-a2f7-519f90531a2c", "comment": "Malware payload (Zegost)", "value": "5d32587e7d8a3e5079216e6e26796f62", "object_relation": "md5", "Tag": [ { "name": "45-153-241-207", "colour": "#86D11B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeGaliXCity", "colour": "#607CCC", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SpaceCity", "colour": "#5EBE6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671196184, "uuid": "8cf90956-82ad-43f9-93de-5ed32dbf6a5b", "comment": "Malware payload (Zegost)", "value": "94585f5b52e2d093240ccbd3ce8273784d5aa22302c04f56fd43b132fe30ea98", "object_relation": "sha256", "Tag": [ { "name": "45-153-241-207", "colour": "#86D11B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeGaliXCity", "colour": "#607CCC", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SpaceCity", "colour": "#5EBE6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671196184, "uuid": "49e395c0-a38e-4797-a6cb-5281d0b6bc84", "comment": "Malware payload (Zegost)", "value": "fa30a3f87931ee2eeadf8dfe0a612105e1392257", "object_relation": "sha1", "Tag": [ { "name": "45-153-241-207", "colour": "#86D11B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeGaliXCity", "colour": "#607CCC", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SpaceCity", "colour": "#5EBE6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671196184, "uuid": "c0904654-1e54-4436-a4f7-98f362ac3be6", "comment": "Malware payload (Zegost)", "value": "cc6dd60d45165decd8e67807d8f8fcc0c47658a9a3f27d180e8ee27bc47899735633b6efbebe4e6703d2f1221d8ce3ea", "object_relation": "sha3-384", "Tag": [ { "name": "45-153-241-207", "colour": "#86D11B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeGaliXCity", "colour": "#607CCC", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SpaceCity", "colour": "#5EBE6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671196184, "uuid": "f6ecb904-5823-427a-bb78-8cd7119be70c", "value": "T127D50127E3714BBEC056C13D81A28E09A76FB87D1737C0C745828659EB59AC02F3666F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671196184, "uuid": "c8ef68ab-6c24-41c3-803f-ff829ed363f9", "value": "d13d399db15c51a1337d692663151209", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671196184, "uuid": "9fb5228a-9e60-4ddc-b4a4-6494a1e0ce21", "value": "49152:mizYt16TjDqWDgwfi+gF6DXuAdAzAIkBHLOjcyMiKL5L9GLcvtl12KSJmB7x:Cu+WDgwfi+VDXuAitIOIBF7vtl1ZSJs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671196184, "uuid": "9b4dd43a-31c6-4034-bc0c-991a962bf077", "value": 3016127, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671196184, "uuid": "247a8d00-e193-448d-be31-a227721870a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671196184, "uuid": "38dd9402-7ad5-4719-9dba-2fab92315f07", "value": "Launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8ed8c4b-7d06-11ed-9db1-42010a9c0080", "comment": "Malware payload (GCleaner)", "timestamp": 1671170414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671170414, "uuid": "3d028d48-6cdf-4c66-bdbf-30ffdb1b8886", "comment": "Malware payload (GCleaner)", "value": "18b66a15d9a5c0069b10e45007907efa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671170414, "uuid": "f8e71ec6-8b5b-4473-bc01-636275161343", "comment": "Malware payload (GCleaner)", "value": "94dc6d42c112ea3b6e3ecf11a7761925b56e21c651eb8f8eb516599510cbd844", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671170414, "uuid": "c95530db-57b4-4297-9210-eede6825999b", "comment": "Malware payload (GCleaner)", "value": "cae242e52b55d68888aafd17242e51ee7878443e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671170414, "uuid": "c40b9fbc-14ea-4a70-ade9-5576d132665e", "comment": "Malware payload (GCleaner)", "value": "c372edcb15e1587af340ccd97247cfbca352bb7c986fb8251c591ac49f1c1c56d71c8ec1742ce71c16774725cb87cc87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671170414, "uuid": "00b63432-c3c2-4b58-a1a0-2ada2fd74a16", "value": "T1DCC5237EA99014ABC47725FE38364D3191F32E172C38D86E77883E97B7F9AC10426946", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671170414, "uuid": "b2cff6b4-3f59-4e78-a20c-abea0d642397", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671170414, "uuid": "d5105f9d-c729-40f6-8e5d-3628cbf98cd0", "value": "49152:0paSfGjWS3Oseh6uiRk5n0xuERPLZ0AeFQtF74rlINeOCgSY/imo:0paSfGjR+seh6RvLe4IlycY/imo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671170414, "uuid": "90d99b88-2c45-4b37-85a7-ed931f830ad5", "value": 2589397, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671170414, "uuid": "cbf4d43f-7ecc-444c-bc9c-df5c6bc40cf1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671170414, "uuid": "2614366f-8ab9-43de-8737-0cef1f2947b8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac19f2db-7d90-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671229583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671229583, "uuid": "0bb67a80-5dc0-45ea-b14b-324f405c10d5", "comment": "Malware payload", "value": "d99684c6d6374fc0496466b1f602a392", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671229583, "uuid": "b5b598aa-35b8-4256-8115-65e44bf141d6", "comment": "Malware payload", "value": "94e1b6b56ee86e2a627a1c3e59376c69660f8ab5d597d9ad873e1c7946a1a421", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671229583, "uuid": "016a3963-84ef-4524-b85a-ac180ab6c878", "comment": "Malware payload", "value": "ea5d562e9394b4a2d73cfe460220a32fd5927d3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671229583, "uuid": "4234a55d-9241-4039-b121-36678a6d02cf", "comment": "Malware payload", "value": "06b3c556954994040e86731640262125adbd6b1ea8963330cf520ff500a41431d65954aab71aa0bfa72a2da965432068", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671229583, "uuid": "82d42fb4-6fb8-4b30-8f13-b258e2ab30c0", "value": "T1A024AEF16690D46FC152D7308C19D6E4AA6ABC215E2196F33B18362F1D302D1A6FE37E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671229583, "uuid": "94c2898f-cdae-4061-9e12-d1f70f21af21", "value": "aa9c378109186462717e17e657d0c833", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671229583, "uuid": "8f53527e-de1e-43fd-a018-a7f95ebeb10b", "value": "3072:UqUeXDL/CQSbRpnLCL/ydTHQOpPk4dVcuW89ae+0azLszGEP/40zwUzQRKF+:fnDL/CjLIKNtcutav0kgz5340M2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671229583, "uuid": "9a2698e1-4ec8-4e8a-b162-ac18f3ba12e2", "value": 218624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671229583, "uuid": "3a365487-a1fb-4809-83c7-8cb9f860d1b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671229583, "uuid": "f32fcb19-c3d8-4941-8be1-2498e9d19043", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59de3837-7d18-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671177905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177905, "uuid": "4faf04a8-a2c6-4da8-b476-3f5c671e94c8", "comment": "Malware payload (Smoke Loader)", "value": "48b9fa0cc39ab3ee91aa4ed8c8ef61bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177905, "uuid": "4f4faa25-67be-4c45-be10-96a5b716a022", "comment": "Malware payload (Smoke Loader)", "value": "95147ab320f09786758083bb44e52ab1b6b951e5cc7ef8edd45cf7431e23e0ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177905, "uuid": "114c1493-e9dd-47ec-aecc-6ece24414e5b", "comment": "Malware payload (Smoke Loader)", "value": "3b620aff04f53869bb271dc97a416c91942a012a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177905, "uuid": "fabcc46e-7411-4cb4-8d79-57aae7d9ecd9", "comment": "Malware payload (Smoke Loader)", "value": "99383a4f3ced2d9d4bdb4a099ffe6adafdcf65a3d9ed61fb9524b38be3ce64e8248e675c6b5e1c1d04b6b7e8a96ec6cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177905, "uuid": "d9aa94d9-38a0-4546-a978-7ed3a9e833a9", "value": "T11764CF107AB3E4E1E932C5744826FBFC6659F810A9A1D637370AD70F9D707A3856A30E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177905, "uuid": "f2b17170-7c45-4616-a9c6-ea819e21bdb9", "value": "d134d10c41936619073a08bd546852f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177905, "uuid": "c57bffc0-89fb-4895-9bdb-ba4a3dcf8c43", "value": "6144:iYqzGLclqfiFjAIjEc6TMoov/poYm0iPvzpQ6ijLxQFiaI:lwlqfGEjcX/poNxnzpQ6ijqF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671177905, "uuid": "735103d3-7028-4a15-93db-a564ce25844c", "value": 335872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671177905, "uuid": "641a2c95-66b9-40ea-a422-5bfaf664b859", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177905, "uuid": "d58c7d27-46c7-4890-9f7c-08020a7ecb64", "value": "48b9fa0cc39ab3ee91aa4ed8c8ef61bb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92541de1-7cf8-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671164256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671164256, "uuid": "25d0e7b6-2af5-4828-bc01-ad57286c3778", "comment": "Malware payload (Smoke Loader)", "value": "c845c8f3cc37791144290f95b012859e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671164256, "uuid": "9472220a-fb99-4cb8-a143-1c3fae81aac7", "comment": "Malware payload (Smoke Loader)", "value": "95793682b61ec54aebb57919a694845023faf2281b43371ceadd86f5bc956dfb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671164256, "uuid": "08088b12-fe2b-464b-9c6a-eaa5e6832361", "comment": "Malware payload (Smoke Loader)", "value": "7efc81cb264cc7b678ddb7af091a993bcd04511f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671164256, "uuid": "bdf60609-e7ad-4edf-9707-416e127e42f7", "comment": "Malware payload (Smoke Loader)", "value": "2ab4993d2435a2e4038bf3348694f667bffa8e14e394dab906f8e3ba3a9e4564b641badad9d1e63f251552e800053d37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671164256, "uuid": "2bdbe65e-905c-4404-a3dd-bbae08fb0632", "value": "T12274CF10BA73F4E1E832C5750C66EBF46E69BC10EAE1D63B370AD71F9D302938526265", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671164256, "uuid": "2c89d30d-99bc-4e66-a255-130ea682b98c", "value": "2067eb05796787c0f2b3dc09403197ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671164256, "uuid": "0cfc9020-71cb-4f8d-80d5-532ce88b48f8", "value": "6144:2e/YewLkqtYXAz/rHtFXTCIujGyOmi0iPvzpQ6ijLxQFiaI:lRwDtMUzHrvujrjixnzpQ6ijqF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671164256, "uuid": "de1e582f-a9a8-4c8a-b6f5-1f40e45f2b22", "value": 342016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671164256, "uuid": "989c43ae-a2fe-4618-a2b5-566550d4b1ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671164256, "uuid": "1ba33ac2-2620-4a69-9d20-ea76194bba01", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f84bea15-7cd8-11ed-9db1-42010a9c0080", "comment": "Malware payload (GCleaner)", "timestamp": 1671150683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671150683, "uuid": "3955cc59-d78e-4f8f-9586-1775a422a10d", "comment": "Malware payload (GCleaner)", "value": "0f36c779267d949c802f755f5baf543d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671150683, "uuid": "650e64e2-f420-40ab-8acb-4554b78059f0", "comment": "Malware payload (GCleaner)", "value": "95e4f21d3c3b473526d7cb1bc499541c3da3bd3e52a5c052ae3dd9d204c8969e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671150683, "uuid": "6fc3a8bb-975e-4513-8293-da6031f37367", "comment": "Malware payload (GCleaner)", "value": "d8091ebeb7a9edd6c1712aac7be7f1748400fd0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671150683, "uuid": "5f918b4a-fb7c-4fe7-aa38-a7a06a40cdd6", "comment": "Malware payload (GCleaner)", "value": "900ed34dd26b00e75c556fa99852ec9c783c72e5ad23c99ec0bfa74d7a41bddab2add4cb5cd5097f64d947819f9a0ddd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671150683, "uuid": "b4e4197e-0342-42c1-94a7-d07e09b13f74", "value": "T131B523C3F5546CF8C8BACBB05A53BC0D065AFEB6E865D0BA71E473AE063B191C412587", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671150683, "uuid": "3e2e82a8-8f7e-41cd-9c3b-87db3bc4f71b", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671150683, "uuid": "e34d601e-afbe-4233-8d73-6d74a5f374d6", "value": "49152:4Nur/j382ymySgYowz7Z+fxYMsTMY4nAbDEGeQZdqa6hBeOCgSY/B:4Ny/jMGy1dwz76xhYMOrdqRBcY/B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671150683, "uuid": "b7f3a4e6-541b-4d0d-8e11-4b150c7f2e83", "value": 2394465, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671150683, "uuid": "1236661c-b141-4c00-ab4e-9493bf5a9b9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671150683, "uuid": "7d711e46-924d-43b8-88c0-3f95cb417b2e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "122ba45c-7d76-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671218158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671218158, "uuid": "3c9e321e-85d2-45cb-bbb8-be0967f672c9", "comment": "Malware payload", "value": "12bbe6198e41c650219e973d23799be8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671218158, "uuid": "1818aa6d-a7e9-47bb-8210-61013218fc0c", "comment": "Malware payload", "value": "964f752b394948f2a634077756274ec9f1c33db6f00d96709c59801fe7f29723", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671218158, "uuid": "be0b4285-fc48-4439-9147-fe4b7f41a38f", "comment": "Malware payload", "value": "213e1b071c7db38715466cf74b0ade5fa3f08430", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671218158, "uuid": "5248ed7d-b9cb-421a-b834-4e4c08de5da8", "comment": "Malware payload", "value": "d3b193320d07a6eaca6de7283ae9c53742b6ca5fe85384c1f48210a23b09a4b969132f73415104010788227426c9bb10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671218158, "uuid": "8052a674-84e9-4267-9d13-222b294af5c4", "value": "T199C523BFA18404B5C5B32AFAB8329D7156F2AC272D25D58C37987FAFB2F9CD04905214", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671218158, "uuid": "fa1a1cc3-d032-4bf6-8d6a-63ab5477f886", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671218158, "uuid": "8b86e0db-0796-4498-a093-3d5fe649d81f", "value": "49152:sph+FdwKAqWYFtSEH1jkbyWF04BhN1/bAgVWAHl6Vez90lNpeOCgSY/im7:sph+UqWstSEHWFlN1TAg8SRz90lXcY/R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671218158, "uuid": "b381d23d-16b7-4c95-98b5-298c2e30c0e4", "value": 2558617, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671218158, "uuid": "85b55dd8-4448-4045-8c06-147b984e1ad7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671218158, "uuid": "fbc0e558-eab9-4ad3-bd6f-4bb09907c001", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8d3ff51-7ceb-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671158737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671158737, "uuid": "c3c710da-336f-49c3-8523-dfddc51e7ae3", "comment": "Malware payload (Smoke Loader)", "value": "ea80729e98d897a6f8d90921fb16c17b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671158737, "uuid": "bdbccb55-f3bf-44dc-b28b-fa5c24fcf78e", "comment": "Malware payload (Smoke Loader)", "value": "968e06a1ab0cc26c76ed387adb056db210c049aef564a6255f5392a168de3b11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671158737, "uuid": "cbf8fa45-ea70-4e07-a9d2-4b4c589d6bd0", "comment": "Malware payload (Smoke Loader)", "value": "b1cf790587414a102115a4e3bef3bf0891e3eda5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671158737, "uuid": "7917226a-c329-4ab1-8599-5e10f216a4db", "comment": "Malware payload (Smoke Loader)", "value": "2107e3a17c7638cbf0ece34162606831e80bfc2b685b19fa549eaac382240c5a3ac6d517d72e8d74f123c038c77ac04d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671158737, "uuid": "76433738-b6ee-4fa6-ba98-3e008cabbd3e", "value": "T19774CF003A7BD7E2F8F2C571082EFBF46569B850E9A9D6336306E71F9D702A38526315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671158737, "uuid": "a9ced9ac-fdc2-41c7-b55e-3e4045d7bc22", "value": "2067eb05796787c0f2b3dc09403197ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671158737, "uuid": "920f3144-847e-4ed8-bdb5-f564987d731d", "value": "6144:69Yq2LkgAInFF2zZwvQXnV950iPvzpQ6ijLxQFiaI:S2ZAkFTvQ3V95xnzpQ6ijqF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671158737, "uuid": "a1e5eb03-a88f-4f5b-850c-b2f453dc003b", "value": 340992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671158737, "uuid": "322a4ca4-1349-4a84-b3b2-b1a733569a0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671158737, "uuid": "efeb5657-dddd-46a2-a514-be0443923361", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec3278db-7d75-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671218094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671218094, "uuid": "4764e6be-6d03-4039-8c30-8c6d0491a035", "comment": "Malware payload", "value": "d523da4dfaed24cbe096183de76b158f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671218094, "uuid": "002db685-33d0-4ce5-823c-188be56bc547", "comment": "Malware payload", "value": "9690e6debc1e6c45d178292fa0dcf2d606b0f29f0152a525dd3bd55a1eb63390", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671218094, "uuid": "0cb146f7-4cd7-4a49-8ca7-fe7131ccb0a2", "comment": "Malware payload", "value": "cdc751cf2f6467e23884272fd7d47eb6b4550383", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671218094, "uuid": "3b15164a-42ce-4cea-bbdb-b4a76a7ef45f", "comment": "Malware payload", "value": "37e49f03a923ea65624fb4e03f49ae17d0697777ca855f85d9521055d9a074c54e8bea2199fef8cf002f75c4482535d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671218094, "uuid": "0529885d-9e73-4e1a-8d64-e5d98c8ce868", "value": "T18974E0F12A60E42EC052D7704D26E6E5D93ABD114F2156F32B087A2F2E306D05AFE67D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671218094, "uuid": "9a6abf60-4f0f-43e0-a6ae-0502c84f6ea4", "value": "3670997c8c2669588bad5b8c178dedd4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671218094, "uuid": "5a2ceaf6-59aa-4214-ab7f-246f046598a5", "value": "6144:kWL/zxen14rgGZDV01OixvrhIIpLrw7W6fHmggzK340M2b:kWvxe/0V0ogzhIIRrw7TfHmtu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671218094, "uuid": "6c5ada9a-e051-4349-b210-128d70614b8e", "value": 342016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671218094, "uuid": "120c0923-6143-4dd2-99f0-177de59e5ba0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671218094, "uuid": "9f85df78-9fa4-4a53-8b7d-e9c45b470e04", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f8c44f6-7d63-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671210127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671210127, "uuid": "b328ea93-acf1-40cc-ab4c-ddb41500b5f3", "comment": "Malware payload (Smoke Loader)", "value": "37cf262a8bc9b43c6f595775111b46b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671210127, "uuid": "1edb766f-d3ff-4cef-b835-0c75b736aa67", "comment": "Malware payload (Smoke Loader)", "value": "96c2a3a0e2583ad14c071f164a611d3660cd8fe87bb7824fbc144ae1a3661d2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671210127, "uuid": "17716158-9795-4669-a655-05c3670a36df", "comment": "Malware payload (Smoke Loader)", "value": "3b87fdbdfaf33ed0ffd60aeb321916459c45b88d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671210127, "uuid": "1be70ee9-c2f0-4653-beb8-1273cd0cb244", "comment": "Malware payload (Smoke Loader)", "value": "127d0c4bde4b3548945b4b22c4a35c63d6a58fc908ff1f44de0d18321e9078c45dd548c2e229cbfa7cda063c435e4bb3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671210127, "uuid": "60ca00dc-cf97-42ea-9ddb-9a8e1e74d52e", "value": "T16D24BEF17690E46ED152D3308C19DBD4962AAC215F2255F32B842A1F1E712C1AAFE37D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671210127, "uuid": "ab9235e3-d40f-4395-b43a-e11d53617e36", "value": "3670997c8c2669588bad5b8c178dedd4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671210127, "uuid": "27d0e282-fccc-4db5-b563-06aa531f9892", "value": "3072:o4h2DLotZAy0RzYkNQuPPqtoPJmpfntQHQX6cPxLsz05x0e40zwUzQRKF+:LUL4AzYkTPy1ntQHQ5gz6b40M2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671210127, "uuid": "5681256a-051d-42a5-8876-91fa2e33f2e0", "value": 219648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671210127, "uuid": "7e4b975d-a90c-4340-9b3f-6bb482f4c9b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671210127, "uuid": "36e9bb4f-f340-402f-89b8-50d39c979b47", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ebc216b-7d18-11ed-9db1-42010a9c0080", "comment": "Malware payload (Formbook)", "timestamp": 1671178021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671178021, "uuid": "8baf4c32-8687-46e2-9df5-082c34824d82", "comment": "Malware payload (Formbook)", "value": "61a763f7b6cdb197a45e3331a627d2fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671178021, "uuid": "0da1d7a3-d573-4b47-9a32-4cf5b2e8b74b", "comment": "Malware payload (Formbook)", "value": "98bf2d56d6648be19d20e78cc7f006b4ef48c5627c2e9ce70539b5a51fc9e5ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671178021, "uuid": "14b69fbb-4689-4564-80f7-9efa011e8ad3", "comment": "Malware payload (Formbook)", "value": "99771a7dbb2a19bef7ee83efef76934fe7ed567d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671178021, "uuid": "e79c9a0f-1786-486a-b8fb-1e5f715d7e3c", "comment": "Malware payload (Formbook)", "value": "bd8801fd781c79f317577d4445753fb71c0983f3b4b72259d8e1b4378f9f76ec90d574e3e7f3ff9b6cdfe56f5e4fb192", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671178021, "uuid": "e8f630fc-0451-48b8-b75c-e4ad2e1898e0", "value": "T1FE158B0AB0D94D19EB45EAF00740B6B136977FED69DEAA3D4EE93F490432218DC241DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671178021, "uuid": "89c21a12-9b57-42f4-8d7e-2d733c4d4cda", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671178021, "uuid": "b87b6927-6045-4935-bddd-4b11e43da03b", "value": "12288:CzWmiVpvvvk96/cH+IC+tsRw0zF/1BROLsaW/cHsssx4TJZYkdsrgvkGnKaktmyu:sI0sRdFtu+ryTJfdsUMGnKawmVl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671178021, "uuid": "07ae4c0a-b5d1-41f8-9dce-8e8b9d470f46", "value": 947712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671178021, "uuid": "bc19d08c-7637-4641-b1b8-e83c5de87260", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671178021, "uuid": "ba903f86-e465-48c3-bae2-d00be4ec6d04", "value": "61a763f7b6cdb197a45e3331a627d2fd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db65b6c1-7cd8-11ed-9db1-42010a9c0080", "comment": "Malware payload (RedLineStealer)", "timestamp": 1671150635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671150635, "uuid": "b8f6f5e7-dad7-4577-b2ac-b15aaf26469d", "comment": "Malware payload (RedLineStealer)", "value": "ffc6de2e642b88ec909dbee4d8d5886a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671150635, "uuid": "923858b9-b6ff-4157-ae49-4cbbfd098c34", "comment": "Malware payload (RedLineStealer)", "value": "9a37d00dacc7982b2d28963b15877a301018bafe5203e9b4309ea19359abe9dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671150635, "uuid": "833ed7fd-9397-419d-8434-430cbe54797e", "comment": "Malware payload (RedLineStealer)", "value": "3f8988a64cbcbbaea0eac165aa78b5fa4796d17e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671150635, "uuid": "b8f68709-8799-4185-84e1-e9bb2d02b9e2", "comment": "Malware payload (RedLineStealer)", "value": "d40b43cebc56757c50d2397adf142a24fbaaf0a096209e662a87aed4554a8c58697a138133b1dcd7155041c54d64447c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671150635, "uuid": "07d0e16a-ad8e-4528-9325-f621da5b82ae", "value": "T10A94D0007AB3D4E1E971C5714916FBF46699B860BAE5DD332309E70FAD70393896A30B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671150635, "uuid": "9ef99afb-71c6-4d1d-890e-504447935296", "value": "2067eb05796787c0f2b3dc09403197ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671150635, "uuid": "369fc1b8-772e-43a8-aed1-178adc82bfb0", "value": "12288:6LmQduySB1w0/RckwDXdSdj6ollxnzpQ6ijqF:6Fdu3WDX4l6oBzK6Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671150635, "uuid": "7c99e977-7337-4b2d-bde6-30ca325ba0b8", "value": 443904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671150635, "uuid": "8d730fb7-9d23-4a93-b805-e8bd505487c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671150635, "uuid": "809143cf-3348-4aa4-bfa0-efe7cd6450a0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39960b10-7d95-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671231538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671231538, "uuid": "a5774cdd-e83b-45be-850d-1c64f03b43f6", "comment": "Malware payload", "value": "3fb1244ebcd61b895c741bb4cd4da7e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "pass-1515", "colour": "#23F7F3", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "tensoft", "colour": "#F39200", "exportable": true, "hide_tag": false }, { "name": "tensoft.store", "colour": "#D9E900", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671231538, "uuid": "181bd3ac-3592-4c8e-ac6d-1776fca5a347", "comment": "Malware payload", "value": "9a380ad3f2980cb91e04de3c91a405de0075bbe26b4c68f9e427b6abf1da26ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "pass-1515", "colour": "#23F7F3", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "tensoft", "colour": "#F39200", "exportable": true, "hide_tag": false }, { "name": "tensoft.store", "colour": "#D9E900", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671231538, "uuid": "e96e210b-794b-4e75-8fd8-2df6531f79b2", "comment": "Malware payload", "value": "b758dfc9ad9ff3c80fe6f62f068ff4408fddd788", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "pass-1515", "colour": "#23F7F3", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "tensoft", "colour": "#F39200", "exportable": true, "hide_tag": false }, { "name": "tensoft.store", "colour": "#D9E900", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671231538, "uuid": "be9abb11-f11b-436b-b6db-09483179853d", "comment": "Malware payload", "value": "1d6570ff145d0d772d3c9d010b3839adb2a55a4c1b42f9520ade9a29356c57e49b1eb1b9811dee105ccf50bd003e7f6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "pass-1515", "colour": "#23F7F3", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "tensoft", "colour": "#F39200", "exportable": true, "hide_tag": false }, { "name": "tensoft.store", "colour": "#D9E900", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671231538, "uuid": "c66f04a9-1fc3-4e32-a67e-4615afe7a462", "value": "T196761272B29C0011E2F54635C83BBC9836BEC53306B184B979EE54E979719B1DB0AFE1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671231538, "uuid": "1c5979b6-aa23-4a95-bc8a-f718dc39ff98", "value": "11ea24073ee65343ee563e3160c77fde", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671231538, "uuid": "0ddd5db7-3f53-4820-ad68-fc3720d042e8", "value": "98304:DyTGbdTI5PVeb0iw1eU+BwcXAmjkBWSjWCuJdrQEg5EyrNGv/5NbV4bIgior45:JpAV8getjkBWwWCuJdrXg5HBGv7ii", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671231538, "uuid": "2420b111-6b2f-4182-8f1f-3c3bb0abf9d5", "value": 7441408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671231538, "uuid": "f2929dae-fd83-44f7-86e2-0f165ee7a057", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671231538, "uuid": "51ba10c8-8615-4a4e-a15a-c64206941c0c", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99472633-7d6e-11ed-9db1-42010a9c0080", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1671214948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671214948, "uuid": "534840c3-980f-4843-a3c7-dd8440d75ba9", "comment": "Malware payload (SnakeKeylogger)", "value": "9c2c65e6334b976dc8afbf375da5c5a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671214948, "uuid": "a99a3233-4ef1-46e5-9c70-48c639bcb708", "comment": "Malware payload (SnakeKeylogger)", "value": "9ae533dd395882eef0df206750f1fff09e5eab9a4397515632d15fd248f72ca4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671214948, "uuid": "7cac7341-ee08-4c3f-b5cd-bc692dbc7404", "comment": "Malware payload (SnakeKeylogger)", "value": "708be8016b86884a52b07879b04a24fea16b4db0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671214948, "uuid": "3db9e261-cd2b-4349-87d0-60a29458e9f2", "comment": "Malware payload (SnakeKeylogger)", "value": "2b9e0d48d9932f37c8f075694560b5e95cd470239cd0593e68b4b3898b8e2c60d0ae376c4f2dc8afe1da2708d431628d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671214948, "uuid": "0f0b0d1a-3b79-4e36-9d80-9682018ebef1", "value": "T10E153625DEAB5942C1D70233E2F36D1F02A0BD0976A9D9EA3E483085373229DF957E74", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671214948, "uuid": "d91addd3-54d5-42a6-9808-eb90c00b09aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671214948, "uuid": "faee8a13-5525-4829-836d-83bc57a64f33", "value": "12288:JdOJtO2iNP0W9UYb1a9mI2V9btVOWXqhS7/5bFqiWW6e79FS8X4KfXlbMyS:zO7O1x0iU2E8lXdwKF4u88Xpf1bMh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671214948, "uuid": "2be15904-2626-444e-8931-4acbeeb9e064", "value": 909824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671214948, "uuid": "255c3734-d31b-4446-bbe1-1d6e022d1563", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671214948, "uuid": "b18b5fdf-4ca6-474f-9d30-b5b013360d2b", "value": "Shipping documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c89402b-7d18-11ed-9db1-42010a9c0080", "comment": "Malware payload (AgentTesla)", "timestamp": 1671178017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671178017, "uuid": "11df1c86-9eae-47cd-b0a0-961c5c47b5ed", "comment": "Malware payload (AgentTesla)", "value": "509c8e2d72bb96b00c1812f6b0b37a76", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671178017, "uuid": "03e00ada-d41e-498d-96f8-cb7d3aabb26e", "comment": "Malware payload (AgentTesla)", "value": "9baefe84948bb3043d255f7f7d583712d6cd36a2054f7471a55ac4f850a2d9fe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671178017, "uuid": "5a31e4c8-a323-42eb-8aff-680d236d0d10", "comment": "Malware payload (AgentTesla)", "value": "c266c93f008e1799af5d9f7902dba7bf758049e2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671178017, "uuid": "368e4473-b751-44ef-b3eb-0702b3007cf3", "comment": "Malware payload (AgentTesla)", "value": "094ed7bb6ac4dab3dc2ab3b3191fe8b1b442d52c8e6fc280a64dd7463c70a911eed765b4a44c045ce1c672f2bb6a90b3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671178017, "uuid": "b6a18c7d-3724-4045-9188-2b32ecb46fe9", "value": "T11EF4331F3CBFE2A5E941C0E25E921ED07FCA98895E111FD895BD8B634EC2091D0196FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671178017, "uuid": "29317609-bc07-4328-9db1-d87cfc077afe", "value": "12288:nF804U7a3iJm21Kvr81SEMFIifYKp3N7k9KR6WEMxy2THXV5NhsqBy5Y0r:nH4U7vJJ1MDH3Px/TFpsYy5Lr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671178017, "uuid": "27f98368-9edd-48f4-a572-e9090ea8e21b", "value": 785772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671178017, "uuid": "b99af7a9-66f8-44b3-b87c-920e9ab36d69", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671178017, "uuid": "ec93c988-1388-41e9-9c2f-4e62db5e4756", "value": "REMITTANCE COPY.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f4d5598-7cdb-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671151769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671151769, "uuid": "8af9091c-5c8b-46ac-8cdd-c33b52578d6d", "comment": "Malware payload (Smoke Loader)", "value": "69ccc6ae17b0a7c546d2c1cb564c231d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671151769, "uuid": "0cc5b2bc-c0bd-4ba4-8b04-d536d12129be", "comment": "Malware payload (Smoke Loader)", "value": "9bb2ffc01466951d94c95b19b6a178c316ef19e374d441099e5fd18bb144f00b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671151769, "uuid": "e2badf4b-a354-4f05-b04e-c5668d966c1f", "comment": "Malware payload (Smoke Loader)", "value": "179ef9740236e1b780b3be06ac1ab267c016e9dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671151769, "uuid": "0b73f18f-c1aa-4aa0-bc8d-10acd4723ecb", "comment": "Malware payload (Smoke Loader)", "value": "4b7f83afcb175a1251ee07d51b7be540801d0e3ec5b671bd5b408c0574c7aa03523a35df2d8084b64aa8fd988ebe0afe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671151769, "uuid": "89c4e1b2-401f-43e8-80a8-cdf0bd7f2c75", "value": "T14274CF917A73E4E1F933C5740C26EBF4666DB810E9E2D633B209D70FA97C2938566309", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671151769, "uuid": "6c7f892a-dd5f-486a-82ab-6a283c8609de", "value": "2067eb05796787c0f2b3dc09403197ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671151769, "uuid": "d5b34047-2a8b-468d-a221-a0822fb26504", "value": "6144:8OY1XLii70DVY3tEMtvmkUNDeG/oYM0iPvzpQ6ijLxQFiaI:kXR7823GkUN///MxnzpQ6ijqF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671151769, "uuid": "95392e8d-0972-402d-a743-1fdfd0c4c189", "value": 342016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671151769, "uuid": "0c57d61e-5e1b-47c0-bc64-3127a2eebca9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671151769, "uuid": "e53c4ad1-a15c-421e-b9b6-3e036bafe168", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eb3129d-7d85-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671224621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671224621, "uuid": "3d91bdd9-f40f-4bcb-8ff9-99c8d127efdc", "comment": "Malware payload", "value": "d79611c7de16ef7298e212b830811b07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671224621, "uuid": "1218c853-a6b4-4175-a4fb-b2795bbede24", "comment": "Malware payload", "value": "9c32486c2718f49bd19bfa1a6743db0ac207f5c36972777821b9e838b38eee67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671224621, "uuid": "dfcbc5a8-8534-46e4-8b06-e593b7a04b86", "comment": "Malware payload", "value": "489ef1df4f7cb0d5c294e87557958ada74a7c11b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671224621, "uuid": "eaa14169-c15a-4fe5-bf5a-d8004877a794", "comment": "Malware payload", "value": "1e62c0782560a49812457055064790442503f87906a3c9a73288aa543c8808ca2b165acedb9073e88023fd011900e7a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671224621, "uuid": "2eabb985-9cbc-4b58-b82e-51e730848464", "value": "T15524BEF172A0E46EC252C7308D29EAD9A66ABC105E2155F33B142A1F1D703D15AFE37E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671224621, "uuid": "f3541939-0dc0-45e7-b7cc-553d8872bb8e", "value": "aa9c378109186462717e17e657d0c833", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671224621, "uuid": "eae8a23d-06f6-4aad-bc26-598a644df053", "value": "3072:qFWH93mLsCwBNSbRm7MS2iYjIz84G6tATcaLsPyLszaivypp40zwUzQRKF+:qQJmLtwN92iIYmTcaLDgzS40M2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671224621, "uuid": "3ed774db-5bc3-4be0-8110-31c814bdd93b", "value": 218624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671224621, "uuid": "6a0992fd-573e-44e6-9999-386875c3c4c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671224621, "uuid": "1ca4b3ed-e179-4177-99fd-521a451691b5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76e986c7-7d96-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671232071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671232071, "uuid": "a72529a3-1f30-4750-a88e-4bf74b93fe0a", "comment": "Malware payload", "value": "2ac1468184da62b79a042453ba886783", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671232071, "uuid": "43f27305-1853-4714-96bb-e5527571ad5b", "comment": "Malware payload", "value": "9c7812d825974b02bb6ed49097d75c7f9e82f67bbe35f595f6d3df23cff07d38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671232071, "uuid": "c8f230e5-2e78-464f-9f65-fa52f1af8ecb", "comment": "Malware payload", "value": "ff899e91ff35e73ad05bb321ce01a77e6f1f00a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671232071, "uuid": "4f3589ed-cb17-4c49-8017-2f161f4ae0d6", "comment": "Malware payload", "value": "340801111e9c87fc27366a96cbaf44269ece031a64ad21b569f682ed247fb4b3dd5c2ba9e9e8ed6b7df43286c1139459", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671232071, "uuid": "8adb2a89-a36a-4307-8df9-9b1efd56fe5a", "value": "T17D24CFF17390E46FC151D7308D15D6E5A66ABC104E2A99F3AB142A2F1E706E106FE33E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671232071, "uuid": "430a8ad5-18d9-4df4-b5b5-91955c2e1ba4", "value": "aa9c378109186462717e17e657d0c833", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671232071, "uuid": "8bf29ef6-3355-445e-94b4-1a82247ff68b", "value": "3072:f2XcK/YLMAHSbRS00/InRJpBHRytfAJ0eTjJJfLszeAeHOu40zwUzQRKF+:ubYLMA100sgfcDXgzJju40M2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671232071, "uuid": "11314f97-9ee7-405b-bef3-4c20c75b9726", "value": 219136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671232071, "uuid": "c2f9ce7d-7090-444f-be92-c62f597ee9ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671232071, "uuid": "0701c1fb-93ff-4e5f-ba1f-3b7450f564bd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aad0a82-7ce8-11ed-9db1-42010a9c0080", "comment": "Malware payload (AgentTesla)", "timestamp": 1671157371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671157371, "uuid": "357b16ce-3131-4a37-9e70-f8cf86454484", "comment": "Malware payload (AgentTesla)", "value": "ce8596a447c95ef326de45896b573429", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671157371, "uuid": "cbfd30f6-f131-481a-9bb2-e63e7eefdb0f", "comment": "Malware payload (AgentTesla)", "value": "9e8ba27ef586c748cb8b88e0d3b304defb4b2ace7d7d79d24be689063cac6446", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671157371, "uuid": "aa9886cb-7d16-4fe1-87d8-6af76e2ea31a", "comment": "Malware payload (AgentTesla)", "value": "eaf0a98aa79aac4e3a65702d0065e52f8d43a2cd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671157371, "uuid": "1de53dcf-8e8a-4e07-a572-1dc358c582d1", "comment": "Malware payload (AgentTesla)", "value": "ca428f276f37de7f0d38ae2fb21f6657dcc9f758b586b8c70c39be85d23a3ebe1907c65a5e2821a038ae490b107737a7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671157371, "uuid": "6bed5076-aafa-4f3f-be9d-870ea492f7ab", "value": "T1FBF4013A77979E52C3B50675C0D6501023F2C7429333EA4B7FD016951B43BA2AEEB6CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671157371, "uuid": "57e50b51-1d4a-4ef1-9756-7948e7cb8511", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671157371, "uuid": "66ade133-cd0b-4481-9304-8fc4a3bfabbe", "value": "12288:sm4Yqa2VB2iNesnBKnG8aKq8AA8KG8RcxSh/2pKDgiVNNp+XDN1Bvc9f:V4YqaWB1osYncGwcx2QT/Np+zjBvc9f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671157371, "uuid": "9a6d4526-13f2-4bfe-acdd-56c9e6d0a96d", "value": 759808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671157371, "uuid": "bae854b2-771b-45d9-8797-fa7b157500d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671157371, "uuid": "48ac047c-97b2-478a-b8be-79c644fa190d", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbe75e99-7d14-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671176459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671176459, "uuid": "8b858b51-3b9e-41c2-a537-dfd16416dbb4", "comment": "Malware payload", "value": "64abd1baa5c4911e2bd21c1ad1d57e28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671176459, "uuid": "2a798693-d08d-438f-a06a-9123fbfcce94", "comment": "Malware payload", "value": "9f29109994932960f368925877a9beed7cd6e687686cc8131937e7bbe58384f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671176459, "uuid": "7c0f223f-10ec-4eec-a92a-5e545eb90e15", "comment": "Malware payload", "value": "1d36001b24b6ba10b194fe4a6f755a902ff210f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671176459, "uuid": "51cd8431-4de3-4158-8f9d-802e6a8af38c", "comment": "Malware payload", "value": "9075e6cac14640e6e352cefc5d492cae44ca2727e08b33c10f1c7a36b9a14a14184b9943de25f354fb960fd9471a1e28", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671176459, "uuid": "567dd22f-a4f0-4c31-ab03-aff0c0363b04", "value": "T1EB654E8893B46698D2D943F2E677E1034D11D03727DC43E9C2AE19A991F0DDBA73EA13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671176459, "uuid": "b977ef45-f993-460c-bc06-f49c7e7e093f", "value": "570fdcfa2a831ebd5acd8d7fcfef9531", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671176459, "uuid": "a465ff39-e9d6-495e-99b3-8689955405dc", "value": "24576:Y4jlFXzz+4usnFf/pPmxOkrd20EjkPjvImnkiTcxxbbF9FQhhRDxzWbdH1iDIX:bll+4usnpoAkrd200gjQpiTcxxbbF6Wx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671176459, "uuid": "8ca68220-58f6-4c78-aefc-fea81fa90c38", "value": 1429656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671176459, "uuid": "694d6238-c5e7-4be6-8759-638e3a03d654", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671176459, "uuid": "d725ee23-925b-491a-a890-6cc8ab2b890c", "value": "PO#20221215.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94124508-7d52-11ed-9db1-42010a9c0080", "comment": "Malware payload (GCleaner)", "timestamp": 1671202914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671202914, "uuid": "6a8a3832-9c48-4287-b969-53ab386393a0", "comment": "Malware payload (GCleaner)", "value": "2c0daf6e1198c96926977c19cefb78a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671202914, "uuid": "bcdb632e-4e5a-4b1e-bfbd-dd53ef8c383d", "comment": "Malware payload (GCleaner)", "value": "9f73fc87cb0aa83f97e160c92bbf1e3e542a756eb0a06082d6f1143e12a1e2d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671202914, "uuid": "dbe7cc03-5b4b-4ee8-a895-cfb8f5c1312e", "comment": "Malware payload (GCleaner)", "value": "d479fbdad3e8caea8973abc4fb6516736d077658", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671202914, "uuid": "4968404a-6535-4a3a-b0f6-15ccf462a68e", "comment": "Malware payload (GCleaner)", "value": "aaa820aa497d480b9fb2085dc5279ba774df54baea0514fe7c7612eec6c5bbf08486f7a80eda79e5daefe3a0513f8136", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671202914, "uuid": "133e1710-6818-4ab1-91d5-6d8144b9700a", "value": "T1C1B5233E84940179D5F38AFC3C322C254AA26DAB5E39E99D3358BE5B73F7DC05902249", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671202914, "uuid": "58813d84-2f95-43d9-9cfe-42e4b95ccb09", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671202914, "uuid": "7fad4545-713e-4f9b-a4ab-84bea3d98540", "value": "49152:0pm6yyzO6brXgn/ElJ4idCrSW3EVfpMBQ9TPyeoT6enxKBTlqeOCgSY/imN:0pm31L/s4iUSDh+qTPItxKlEcY/imN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671202914, "uuid": "70f4e639-2a29-4c17-9130-60c8a39f093e", "value": 2459691, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671202914, "uuid": "299ea717-9762-47d9-9b30-269235b1e365", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671202914, "uuid": "bf9496e6-100b-4c05-877c-845e671cff4f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c9cdd74-7d89-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671226336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671226336, "uuid": "a11c4f47-b918-4a9e-b550-f037bbd97d1b", "comment": "Malware payload", "value": "4c419818f064de2d65e8a334cdd89158", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671226336, "uuid": "0d12f89d-870c-423d-b7f1-4b77bedf0aea", "comment": "Malware payload", "value": "9f82025f2f371e543f972d255b56f95252fe5d3a6acf7726d12ce50c6eafe54e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671226336, "uuid": "11c3cee9-2902-4872-9536-45f28012b477", "comment": "Malware payload", "value": "f18a5de73d6f20afb6f4877376bd1a527b15c4e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671226336, "uuid": "beb4f76b-2817-4d8c-b239-6b99ff104bf3", "comment": "Malware payload", "value": "81e31c9f740e2af5bd2fc9fcf942a715ceb07d1d3863ebc26abcab05f1653dc6e6791731055080ace81648d1331b3257", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671226336, "uuid": "eb934ff3-644a-4248-8e1c-df12e67338d9", "value": "T1E7B523BEB58065B8C5B74AFCB8254C6195D2BD6B1A38D60D738C3D8777F78C2480A247", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671226336, "uuid": "3eeb4723-ab42-413d-9888-2dcaf38a7d72", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671226336, "uuid": "8502e7fe-f31c-4e82-85d9-30c1238adbcf", "value": "49152:kpw7al13AMZFvNEMZ3afJnUcSojjD0r534MMUx8kHHvExi5GRmwzR2p6UeOCgSYo:kpw7cVAyBO/fJUsjP0lMu8kHHsxiWZMa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671226336, "uuid": "15f57793-ba41-4dc1-a3dc-9db531948529", "value": 2399098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671226336, "uuid": "98657d53-41c6-41a9-860b-8772eb9bbcba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671226336, "uuid": "080da4ee-830d-423c-b105-05a5fba997fa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8b12d18-7d28-11ed-9db1-42010a9c0080", "comment": "Malware payload (GCleaner)", "timestamp": 1671184936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671184936, "uuid": "78fecb5d-09c3-4fa8-bc7d-4bd2584de64c", "comment": "Malware payload (GCleaner)", "value": "0fef323eced331f2de2e9b0827559e9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671184936, "uuid": "16cc84ed-31c1-4600-babf-b1ce50bfce41", "comment": "Malware payload (GCleaner)", "value": "a125e8b85127523fa7d097ce8bb3c6627938ffaf03eb82cacb4f2bb86461ec60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671184936, "uuid": "d48c6275-e2ef-4dbf-98bc-ea917e1c4053", "comment": "Malware payload (GCleaner)", "value": "6e7e26fd8b094a2ec9efa7f8b0e387300be7f78b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671184936, "uuid": "cfb3efbe-bbac-466f-9208-c85b97ec8f31", "comment": "Malware payload (GCleaner)", "value": "1a63eda1c40dff2ee47229d74c120fcfd45ee07211d3090ad6a53ecc80bebf393f2ff124dbb08930e7184c973789d056", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671184936, "uuid": "1fce9e22-3944-464b-bae9-2e80a83d1d2a", "value": "T148B5237EA90451B1C4B789FD38298C2145E2BD6B6A90D88F33D83F9F77F79D20906216", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671184936, "uuid": "e811e1b9-dc03-4d0f-8e9d-51c6f3e597ec", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671184936, "uuid": "a24297e8-e49b-451f-a3d6-82d6602ff9ad", "value": "49152:kpP5VqwBlYeveEEKP017y1Gun4WsnkAQ/wELwerCK+d0c8eOCgSY/imj:kpP5/BlYML8F6G8gnJQIOfQ8cY/imj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671184936, "uuid": "e0905835-071e-4880-8a85-5a07842bf213", "value": 2437198, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671184936, "uuid": "36d18612-0e1e-4c82-9310-c1c9b7f35ea8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671184936, "uuid": "63824e60-b188-461c-8199-58c6772695db", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a58eebdf-7d7f-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671222271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671222271, "uuid": "bf79e41f-e27a-477b-8f8f-4aba75f827c4", "comment": "Malware payload", "value": "9e9438b2952c23275b4b82ab39d7bebd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671222271, "uuid": "e9aa5772-3d30-4ba4-b1df-0fc6b52c07fa", "comment": "Malware payload", "value": "a149c3aca2c60facdece5ab8078c67b916aeac80bf8dd789b3e8e9e032bc1fcc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671222271, "uuid": "66e96963-db39-4029-abc2-d1e7989d5841", "comment": "Malware payload", "value": "6a4cdc3bdde57dc47547d9a67e3692b1435f7847", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671222271, "uuid": "f4c93869-5a04-4564-b5de-32e68e0104ed", "comment": "Malware payload", "value": "deb6ba64f282ad2a41cf237eb2d08334f13104329fbcc1fdff5348aa1e24c5c27cad386b1a47e2cfb28390afd4f1adac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671222271, "uuid": "108fb3e8-d9f4-4161-9a29-840bdaafbb50", "value": "T1F524BEF162A1E47DD151D7308C17A7E5AA6ABC205F2299F32B14262F1D306C096FE37E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671222271, "uuid": "c3219c5e-e5bc-4cc6-b84c-d535b3c2fffa", "value": "aa9c378109186462717e17e657d0c833", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671222271, "uuid": "145fe56c-c8f1-470d-a9a9-549e7fca4d4c", "value": "3072:YF2UiPxLWOWqSbR2b5IpYecDzOIfVjisE/u4cWbgfMicLszF+2dJtWB40zwUzQRj:RfxLWOWGb5KYqIfVOz/rIMdgzu40M2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671222271, "uuid": "a08ebdf5-24c1-4e25-a97f-8f16a95cf810", "value": 219136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671222271, "uuid": "7b1b36b8-6e38-439b-9187-2c7b21d02f9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671222271, "uuid": "9477ebbd-5501-4848-a1da-aa4d9f6da9e2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac5ec094-7cf1-11ed-9db1-42010a9c0080", "comment": "Malware payload (AgentTesla)", "timestamp": 1671161293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671161293, "uuid": "874823ed-d9b2-46ba-8606-5243b6d9e1cf", "comment": "Malware payload (AgentTesla)", "value": "04485a74eba1081d40e66867d9caa3c2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671161293, "uuid": "1ba76f92-e022-4f57-8f57-cd0ed79f2e43", "comment": "Malware payload (AgentTesla)", "value": "a35b36ce845e94ffdc55c885576befdaebe87409de141d3128815d65b7701b28", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671161293, "uuid": "ef8d4b32-aba9-469a-bf10-96f59034dde1", "comment": "Malware payload (AgentTesla)", "value": "5002035a0035b68e87f2209640f54fe37856524f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671161293, "uuid": "8dbfdb05-0883-4071-bb88-61da9167cb1d", "comment": "Malware payload (AgentTesla)", "value": "ecefedee0a0325a0a78348807b6d80bf3830cc753de567887ef2ada822c239948e038f1b1fb5dd2e590c5ee4b325d930", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671161293, "uuid": "b0daeabe-5621-4be0-91c1-39627558bb29", "value": "T1E935389C31907D9EC953CEF28A507CB0A95333AE538FD6368D670EDC890D65ADE041EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671161293, "uuid": "a9d24bb9-12d6-48a6-b565-96ec6a465a99", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671161293, "uuid": "be8b1db1-5cb1-4f4f-a826-65a4eb9bb528", "value": "12288:5wMrl+IYQqtDAGbQOK6KPPzwCUKstHv4lT5bstx9TZE99dY8prtffMJZxUjtkaIa:e8q+47KzotHglT5QPgrlF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671161293, "uuid": "74428f2e-57d7-4486-8e8a-4ceb1d2e6ab5", "value": 1162752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671161293, "uuid": "a9da807b-7ec8-48e4-b646-f274606840f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671161293, "uuid": "02fe029b-ec0e-4805-b9fa-fc2b0f36eb5c", "value": "SecuriteInfo.com.Win32.PWSX-gen.991.8244", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3965dd4-7d34-11ed-9db1-42010a9c0080", "comment": "Malware payload (Amadey)", "timestamp": 1671190135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671190135, "uuid": "54fb5b38-501e-4a85-a0e1-eeac2a2749f8", "comment": "Malware payload (Amadey)", "value": "accccb0c8db2dd96ff32e0da59f80691", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671190135, "uuid": "3bb14784-caef-4c02-9c57-ae9e201528f1", "comment": "Malware payload (Amadey)", "value": "a3b693f85dc7cca12fa3708fa4fc87ea2dda634ee5e3b07c03ab471d493aa30d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671190135, "uuid": "37ecf979-df7a-47b5-88d8-503e6e0c23ae", "comment": "Malware payload (Amadey)", "value": "b04df9a967f18a24374775c38ddebd97802c5fc1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671190135, "uuid": "1d1cf2fb-3816-4c41-be3c-8e93ff496339", "comment": "Malware payload (Amadey)", "value": "96307f8218b5bcc83f0be0bf6f0ab8d8ea49d6dcce5e6ae63a8c264a92d2e054f3548235d29e0af5eb7df1a15592e27c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671190135, "uuid": "52ed526a-4473-44e8-836d-aa439c5ad33f", "value": "T1F254E001B360D432C15F45719A5AC7E4AA2EFC311EB0954377363BAF6F70AD1A62A34E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671190135, "uuid": "36896e0f-6b0b-4508-9b10-8316af5f1422", "value": "875e7ce4bbed8fa04d22755473fc97c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671190135, "uuid": "e9fb0992-67b2-4642-8f49-e3aa9b544a21", "value": "6144:Pbf8LjMt1RCTcS3QDjKjlny7lLtsl8qMrc:Pbf8cHY3SjKdyZ+l8n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671190135, "uuid": "eccb2a4d-0eb1-499d-a04a-7965a672f5b1", "value": 287744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671190135, "uuid": "01d4fe75-9fd1-40b3-9dbc-1a7d2285d7a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671190135, "uuid": "af487cae-2652-4a05-a20a-263baf79bb8f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c42a43d6-7d26-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671184097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671184097, "uuid": "0bcc2b46-3580-46bb-b37c-e0ae955183f9", "comment": "Malware payload (Smoke Loader)", "value": "faf772c0ba606d0d526410b351bbdd8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671184097, "uuid": "c067a2a6-1a89-4529-96de-4c1279314d6f", "comment": "Malware payload (Smoke Loader)", "value": "a44787e5ecb975a9e2d9944d9d79ed0d59366f361fe270d2cb0ebcebd8a94530", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671184097, "uuid": "d0899c7d-faff-4cc6-82a1-944712ea5d4c", "comment": "Malware payload (Smoke Loader)", "value": "40beb1f34bdd2a6bde0be1ef439c30c3dbc67037", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671184097, "uuid": "f0fa67a6-dd29-4e39-8f6a-db72478c4036", "comment": "Malware payload (Smoke Loader)", "value": "1b32a1060c62bd59672325dc926f5eb86fb737898ddc2185d7f135d0464086e65bb930f9418e810cfc82d224ba87ed18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671184097, "uuid": "317a54e2-bc59-4883-ad91-554d98c311d3", "value": "T10634D011B271D0B2C15F05318866D7E15A7EFC314972EA0777753BAF6E30A90A63AB0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671184097, "uuid": "67c9b4bb-72a8-4d2a-955b-483312f00312", "value": "b35462da489bc13bae884e55b5227599", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671184097, "uuid": "4dc61174-2edb-433a-abc6-fcc21b55ab90", "value": "3072:2O1nkQXYDLXmnsHnYocRqiN3PNFK98BvLQ2mppGT819nHtWqMPDcfuh:TnkDLXosHYLZ1A2Ot99H8qMrc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671184097, "uuid": "5cfd1346-48fb-40f2-9f50-c20c77363c7d", "value": 232960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671184097, "uuid": "9b8d138e-e916-487a-bc91-e557deb5932a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671184097, "uuid": "13c8c9c6-5042-45f8-9e33-8eafe0594e9e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0424aeb-7d18-11ed-9db1-42010a9c0080", "comment": "Malware payload (Formbook)", "timestamp": 1671178023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671178023, "uuid": "9b0bb9a8-5abe-4d55-afe0-884ff07a51c0", "comment": "Malware payload (Formbook)", "value": "79844bb6ea7bc783b678e3693c2403d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671178023, "uuid": "f391c441-ce4a-46ee-9b8b-a3537ca57f86", "comment": "Malware payload (Formbook)", "value": "a4faadc7e9c3befad66d0e11a0365d0cb642ffdd11fc9170b02b096f658c354e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671178023, "uuid": "8d8755e3-a5a0-4bd5-9885-71711e2d0108", "comment": "Malware payload (Formbook)", "value": "afa571cd71362cafbd74a845ca8976e9980fe580", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671178023, "uuid": "61e8e302-91d6-4b10-a3c2-567f10270432", "comment": "Malware payload (Formbook)", "value": "26a1587c1f496d221c4615c29037060ef7f27e5f365700681de785375a6a4f159ec03e0428c170c676c14aa541c957ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671178023, "uuid": "c5df449c-adb5-4924-945b-e71216971415", "value": "T145258C0A70C98D19EB45EAF00640B5B13A977FED65DEAA3C8EE83F4D4532618DC241DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671178023, "uuid": "1096d6bd-85d6-4871-b519-966cf2e721e3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671178023, "uuid": "1855fadd-8f61-4c6c-b580-063d15350391", "value": "12288:UvxRVdvvvkS6/cU+ICxo7xALP9Zfu9/xufx1m/TskyRdinpo139rISJVIR9uF:8lzP9Wpr/QkyRdiICYKfi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671178023, "uuid": "93037c89-3def-4807-a7b8-60428a3752dd", "value": 963072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671178023, "uuid": "b7ecc76e-e840-433d-967c-b6c2f47873e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671178023, "uuid": "15eaa088-4bc3-49ce-8137-b1176239f833", "value": "79844bb6ea7bc783b678e3693c2403d0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c905b4ae-7d02-11ed-9db1-42010a9c0080", "comment": "Malware payload (Formbook)", "timestamp": 1671168643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671168643, "uuid": "5d6b2240-0bb7-4580-9130-bba7df7d5faf", "comment": "Malware payload (Formbook)", "value": "60502f71ddf14dbaec8968208d1c5c6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671168643, "uuid": "31ae4926-8c63-457e-b9bc-3c4a46cf8cf5", "comment": "Malware payload (Formbook)", "value": "a62a7ce5320d7ab508589c61754106b3bb030066c8d2a1811f9f31297378d38e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671168643, "uuid": "5bb9ca34-156a-4a46-a5ef-cd621d42e82e", "comment": "Malware payload (Formbook)", "value": "dbcc9ed053e4d0454fed969ef85660b5667e42e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671168643, "uuid": "cdd94df2-65bb-43d0-8cdd-ecd751b9b3b4", "comment": "Malware payload (Formbook)", "value": "a0e17316b851e4880146c9e219442de776252834cd240eaa922e2a4a0899db2c37720be533ab675d2c1604f911137dda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671168643, "uuid": "ac86bead-bf14-44ca-a51d-a192b051b994", "value": "T196E41294B3671980CD399B3158E7C6550131BF81B9B3D358309833AC0A737DBBD6AAA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671168643, "uuid": "063e4613-0c90-4541-8b72-d96759895b1a", "value": "12288:35RPFasO+Eh4Lk+Kpiy5Al66P7yMZjGr5XdST3iFeJgnJdrIjB7IC++gHpycFm34:p3asOxhXR5ABPD8NtST7JovrIjB7IC+1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671168643, "uuid": "5f16b565-f637-455d-9ac5-9deb8d0998aa", "value": 687648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671168643, "uuid": "24a09ac3-49f6-4e03-b20b-faeb33d87d93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671168643, "uuid": "fa5d4654-41c0-4cba-b192-1450f3e7ee52", "value": "SecuriteInfo.com.Variant.MSILHeracles.56007.6117.11308", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e72be875-7d08-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671171270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671171270, "uuid": "adaa8721-8d1c-4856-bd32-7d818a119012", "comment": "Malware payload (Smoke Loader)", "value": "e7943bc8518dc17c7b8ecf4038d9e532", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671171270, "uuid": "e553f370-acc1-4ec6-87f8-955f4fbecc6c", "comment": "Malware payload (Smoke Loader)", "value": "a6ae453ef2252b375da7f1f566d38d9157ab7e66f939a2e6e92ef043355a432e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671171270, "uuid": "7b44aa8a-6f5c-426a-b4e4-d3f57e1e2d76", "comment": "Malware payload (Smoke Loader)", "value": "2480d9ed0377a6b2049279fbcb29ca3ce7ccb6ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671171270, "uuid": "6cff4a97-6d13-4020-adaa-938a26639f0f", "comment": "Malware payload (Smoke Loader)", "value": "06c0f2610c5273275bdabfff487d8a50a7f657c79b8fc740b520c3de484af074043e0bf0ee96148a876cded32ad122aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671171270, "uuid": "1ff169b3-3f04-449d-a4dc-e06570e41e8e", "value": "T1FF34CF21B2B0C071C56F05358861DBE55A6EFC314A716A4B37763A9F7E30A90A63B34E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671171270, "uuid": "5be81785-c8ee-480e-8508-2395fa890d8b", "value": "b35462da489bc13bae884e55b5227599", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671171270, "uuid": "7baf77dc-4961-49cb-8bb4-12eb0a1e21e6", "value": "3072:WSNk/UH8mWLotVvcicRY0i4NwDILy/kr0+dLQ2mppGT8QcIzGOHtWqMPDcfuh:PNk/GELotVUfNuCmtKzJ8qMrc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671171270, "uuid": "7f3eca9f-6e94-466a-8089-dd8390c240bd", "value": 232448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671171270, "uuid": "3db1ef88-54b5-4ef3-9ab9-1736efe19aef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671171270, "uuid": "67c96286-7ae3-4dc4-a33b-eab2ca7bcb83", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3814960-7d14-11ed-9db1-42010a9c0080", "comment": "Malware payload (Mirai)", "timestamp": 1671176338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671176338, "uuid": "31b6ec64-9a23-4a72-ba7b-f216d174877f", "comment": "Malware payload (Mirai)", "value": "72419786f9c6fb16fc3cd5d124d6c720", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671176338, "uuid": "984ade87-6d42-4270-b765-0dc6d19656da", "comment": "Malware payload (Mirai)", "value": "a7247654d15df69028934481347da8da2a760bb161a37e1c3fb604a46b78963f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671176338, "uuid": "9fab918c-8c98-4fde-9b9a-1f79a2d50e96", "comment": "Malware payload (Mirai)", "value": "13f65e44f0d7e86a2091fd2a99c61340c7808a96", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671176338, "uuid": "e50651c5-99f9-4beb-b487-5bb521a1d402", "comment": "Malware payload (Mirai)", "value": "2ce9c9c0b7e7db5c404049d0875346318a389d66359d7c297e3ee226c9fdf1e205cf5e4bc1bde62eacc9f516cf2f646e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671176338, "uuid": "62214d7e-f004-40f0-81fd-29e73087f11f", "value": "T1CF73F819BF610F77EC6BCC370AA92B0529CC954B22E57B367934C528B60B61B19E3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671176338, "uuid": "979f8c98-5c9c-4a1c-b811-04569d629f57", "value": "1536:7J5dbFB4x92nKoIxa98M26ofWU+UZ9CYXzdJa10N:7J5dxBu9uKoIIUXd4u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671176338, "uuid": "4c6a0205-7530-40bd-a6df-00fee52babc1", "value": 77320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671176338, "uuid": "f86d59ef-a91a-4f17-976c-25800dc1da7f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671176338, "uuid": "bbc31e6b-c1f7-42f9-a5f9-a07e73578529", "value": "72419786f9c6fb16fc3cd5d124d6c720", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0816e153-7d2b-11ed-9db1-42010a9c0080", "comment": "Malware payload (NetSupport)", "timestamp": 1671185929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671185929, "uuid": "d0738208-affb-400f-8d7f-f9bb08a90ea5", "comment": "Malware payload (NetSupport)", "value": "8a1db8d15bc15aa3379012893762d13f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671185929, "uuid": "ac9e7852-ce33-43d6-9ffd-87421611baca", "comment": "Malware payload (NetSupport)", "value": "a73b008a3c12e5a63ff2f2881fc7ba39c32da5c46bc2fc9e31e95acc5537d1f8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671185929, "uuid": "425507f8-0a92-4158-a626-326d557b0d1b", "comment": "Malware payload (NetSupport)", "value": "1a2c260982eafa1e5a977d840c329327be2c532c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671185929, "uuid": "babfd331-082b-45c3-9223-5798e3c79e73", "comment": "Malware payload (NetSupport)", "value": "75561911837534762f6f9f23a8d9acfc5ea738361ae2b6890f5c0f584b4792df68ba5f1feeb781be05db6bc29857d2bd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671185929, "uuid": "68b14eb8-0bd5-41eb-8e56-929a64155ea2", "value": "T1D8E268C82696B0608737F77EA67ACC50E6B51E7381952647BC3D7054EFB341CCAA0DA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671185929, "uuid": "bc4c42cd-228c-40e3-a843-dfa898501081", "value": "768:y0YHHh+KjHCg9kcRfsHskjL2EMy8956kMjwh:HYHHoOiekgkZRMye8jwh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671185929, "uuid": "8f7de316-dc06-4cae-983a-44a51490881a", "value": 31499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671185929, "uuid": "a46f8d2b-bea1-40ba-b1d0-33c73a0e0682", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671185929, "uuid": "e1a4c6d0-86db-4de2-a31d-08ee0248679d", "value": "1612_R.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "702228a9-7d46-11ed-9db1-42010a9c0080", "comment": "Malware payload (Zegost)", "timestamp": 1671197700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671197700, "uuid": "537cdc6e-0834-4a68-bb21-a863ef150edc", "comment": "Malware payload (Zegost)", "value": "51a049b0392d813227d3093db8d71c0b", "object_relation": "md5", "Tag": [ { "name": "23-106-215-217", "colour": "#1B858A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeGaliXCity", "colour": "#607CCC", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SpaceCity", "colour": "#5EBE6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671197700, "uuid": "b2fe976f-8d1c-4c02-adf2-2c74333a9541", "comment": "Malware payload (Zegost)", "value": "a803b45c52fc4db19e364eddfad59a4b131e7552053217d547916bcbfdf8589b", "object_relation": "sha256", "Tag": [ { "name": "23-106-215-217", "colour": "#1B858A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeGaliXCity", "colour": "#607CCC", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SpaceCity", "colour": "#5EBE6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671197700, "uuid": "17b97bab-0a89-4dee-a0a0-06d0f1b6038a", "comment": "Malware payload (Zegost)", "value": "ea689a474e33438d7ee3f312aa9506837b069958", "object_relation": "sha1", "Tag": [ { "name": "23-106-215-217", "colour": "#1B858A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeGaliXCity", "colour": "#607CCC", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SpaceCity", "colour": "#5EBE6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671197700, "uuid": "0b916d4c-879e-4204-b5ac-ae636ab49fcd", "comment": "Malware payload (Zegost)", "value": "4319a12b6d700d9bcf92d652c8beef03d77dd3e554c5b03d8a26289287510ca9526e458aec52593cd76183ea5ae60c98", "object_relation": "sha3-384", "Tag": [ { "name": "23-106-215-217", "colour": "#1B858A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeGaliXCity", "colour": "#607CCC", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SpaceCity", "colour": "#5EBE6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671197700, "uuid": "210d60ff-57ac-4be1-9642-9d2cf1566e3d", "value": "T1B3D50127E3714BBEC056C13D81A28E09A76FB87D1737C0C745828659EB59AC02F3666F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671197700, "uuid": "b15db930-e7cc-4677-a3e1-1f3b5211fa09", "value": "d13d399db15c51a1337d692663151209", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671197700, "uuid": "2f3e50e5-6ba1-48bc-8be6-ad27b28e1ba1", "value": "49152:mizYt16TjDqWDgwfi+gC6DXuAdAzAIkBHLOjcyMiKL5L9GLcvtl12KSJmB7x:Cu+WDgwfi+gDXuAitIOIBF7vtl1ZSJs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671197700, "uuid": "02218108-9934-49c0-b91d-5391482e45b7", "value": 3016127, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671197700, "uuid": "aff7aab5-4f2c-4459-bed9-d194f7fa8cbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671197700, "uuid": "1d6884c8-6616-46c7-82d3-3c438e57b180", "value": "LauncherV2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "687498d0-7d78-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671219162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671219162, "uuid": "6a04be41-83a7-43ba-931c-d6c907bf4a80", "comment": "Malware payload", "value": "88b2a8c2f089d50431da4f4f2fdbdab4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671219162, "uuid": "5fe30831-e96f-44eb-ac4d-e454bd105dc3", "comment": "Malware payload", "value": "a9aee7a33f709ee7b97a6d6f2ad3f0cf8e251f1ede2496502aefc1221c2367d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671219162, "uuid": "74d2402f-83ec-4003-a983-3f6cbf7975a9", "comment": "Malware payload", "value": "7767a263d95b66a0adef9bffdaca15b141b8a0ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671219162, "uuid": "c470ceef-6910-4eb7-ae70-3337b7199916", "comment": "Malware payload", "value": "e8041382eb799c4c8d7f8f1cf96ce48e5cd22afdc3bc2d4e04fed517a01e3e8ce5943dfe1526e80004b5e1009ecf4f22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671219162, "uuid": "005078e5-4a53-45c8-84b3-3639bdcc98cb", "value": "T1CF24BFF1A690D46EC152D7308D19AAE59A2ABC209E6299F33F04361F5D302D056FE37E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671219162, "uuid": "ec2e83c8-7775-41b8-ae9d-7a088a48cf23", "value": "3670997c8c2669588bad5b8c178dedd4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671219162, "uuid": "31b6a070-81c5-4573-8af6-14eacd2e8abc", "value": "3072:9bIze/1LIP0s90RQmLH2hOgkEuAYilY5aLszq3S40zwUzQRKF+:RJLE0hhp5agz+S40M2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671219162, "uuid": "b47019dd-7838-4648-8711-7b6e1c22f639", "value": 219136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671219162, "uuid": "0ea737d1-04fc-4b10-9c8a-2674e3162591", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671219162, "uuid": "87015512-738c-4d9d-aea6-1ec61f6d73df", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aba93a56-7cf1-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671161292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671161292, "uuid": "a32744f7-1bfc-44dc-aef2-d7fcea191e61", "comment": "Malware payload", "value": "5243a480986483cc95232fb55e0b88ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671161292, "uuid": "04559d0e-6b69-4511-8eca-d7098c37b748", "comment": "Malware payload", "value": "a9dc361f5933942780cffbc0143cbddce7533683de60dd9eb338b67d8da8fbc0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671161292, "uuid": "11197ea0-e0a1-4ff4-a555-c32e311169c9", "comment": "Malware payload", "value": "05fcc27faab707cff8a46b7dca8db9ec46259eaa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671161292, "uuid": "db9edd0d-abcc-43d0-8a39-46971fd084fd", "comment": "Malware payload", "value": "e663b2d69652180bb225384f8ce27333e9df4ff95233fb3c83adc93009735a49dba2d3026002a6b775cc9f8c9f4aac7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671161292, "uuid": "c657ebff-1b42-4a34-a1a7-4f2ffa1eed6d", "value": "T1BDE1E81157898733FD7A8B769CF3A3811338E7516A57CB9E3CC8520B8D06B9859A2F20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671161292, "uuid": "180c0ee5-733a-4abd-aadf-04ea67ac7d3a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671161292, "uuid": "4e8ca226-00ec-4f8c-89fb-215f8e8f0c2f", "value": "96:fjPp7pKvCvhFkNU+U8rbG9AvLF5rOmKJ8LVzskl+VPTxzNt:rFvh6/W9AvLymKMz1wdTT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671161292, "uuid": "270d188b-5ab7-4ae9-8b68-b6d31c5bea9c", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671161292, "uuid": "47a72669-2f61-4a22-bcf9-e5a2275851bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671161292, "uuid": "c2f6fce9-04d6-4e4d-aed1-f8a4111b0492", "value": "SecuriteInfo.com.Trojan-Downloader.MSIL.Agent.16339.13667", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9523f501-7cf8-11ed-9db1-42010a9c0080", "comment": "Malware payload (Amadey)", "timestamp": 1671164261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671164261, "uuid": "0081cbf2-f761-457a-922c-95ace840f16c", "comment": "Malware payload (Amadey)", "value": "1d84ca1a5d5ca757652395896319083d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671164261, "uuid": "5e2c8029-6617-47d4-b0c0-0458a9ba1a86", "comment": "Malware payload (Amadey)", "value": "aa0e1d36a0c0eff28907aae4050f38e576228a67bba7c313c507d78f664d8215", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671164261, "uuid": "21fa7e45-e089-4073-b302-3a709869a497", "comment": "Malware payload (Amadey)", "value": "34febc62038b10a59ac6e83fa30d74d331f75900", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671164261, "uuid": "909aa3ab-bd4b-449b-ae1c-ea6ddcd4c4a6", "comment": "Malware payload (Amadey)", "value": "874354f1f55ce7d3d2de4f9fd00192ce2ee04e1a48fedfde12c829c369710056b1455a0ed21799207bd537ade3d11a1f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671164261, "uuid": "ab58a127-2015-43ce-86d6-6b2edb62552d", "value": "T18E84CF05FA73D4E1F871C5768C26EFF46669B910E9A1D533231EF74F99302E3892620A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671164261, "uuid": "2e1645d1-91d7-44dc-a7e1-76c24730255a", "value": "2067eb05796787c0f2b3dc09403197ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671164261, "uuid": "961bf740-f30e-4637-8b22-cca067624482", "value": "6144:DaYG5LWOGgMH1DFeiQt3Sv04eptfz0iPvzpQ6ijLxQFiaI:I5PGgA9DQUCp5zxnzpQ6ijqF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671164261, "uuid": "8455166f-1e68-4a6f-aa76-de9b916c47c4", "value": 382464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671164261, "uuid": "641bbf62-43d7-4e00-876c-8dd3cd800fb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671164261, "uuid": "b8c70496-1f17-4175-9786-054c335615d6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d51be90-7d20-11ed-9db1-42010a9c0080", "comment": "Malware payload (GCleaner)", "timestamp": 1671181213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671181213, "uuid": "ce96eb9a-fd1e-4b4d-ac7b-0162d1bb9366", "comment": "Malware payload (GCleaner)", "value": "cfe941282993825218388ea651f0b182", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671181213, "uuid": "5e949c98-bd81-485a-bddf-9495de81753d", "comment": "Malware payload (GCleaner)", "value": "ab3692ad16a28737cac033456a88ecddb840e4dd0e842b724eb926f0e4fdbe27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671181213, "uuid": "a907885e-6945-4e96-88e0-bf407c5577b7", "comment": "Malware payload (GCleaner)", "value": "2251b0fc06b33b46c8e244a93a906cc86fd0f4e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671181213, "uuid": "2f3c1e8d-67e3-48a5-8867-bac32024e7f7", "comment": "Malware payload (GCleaner)", "value": "c6215afb1707cb227ce75c1aad418b06d0d065de09ddd35004c5b0d5759a276c066b7ce05bbfec336c383742234d9880", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671181213, "uuid": "8f382854-2971-4189-a928-262a17594010", "value": "T18FB523BEEA808575D2B74AFC78262D2249B23D2B2864D54F33843E57B7FADD1041361D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671181213, "uuid": "5978c7da-a01f-4a1b-b6ee-76fc73cdf518", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671181213, "uuid": "052d36bb-bf02-49a4-9301-8df4b1059654", "value": "49152:kpdaiOWG7iKL9UGxtihKseUajX/iHFtGveRgwNW0kB9vheOCgSY/im3:kpU17FdeKrUajOGve6wCcY/im3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671181213, "uuid": "c9b91a2e-7019-46be-9fd4-baddb2f910a8", "value": 2407808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671181213, "uuid": "31073890-72b1-4bee-ae47-bbfeb2c83272", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671181213, "uuid": "1a5cf3c1-f133-4333-abd0-0088f55fe854", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03f59330-7d31-11ed-9db1-42010a9c0080", "comment": "Malware payload (RedLineStealer)", "timestamp": 1671188499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671188499, "uuid": "8708836d-51ab-4cd2-b756-907978370885", "comment": "Malware payload (RedLineStealer)", "value": "cb8682b8431c9cc9f1acd74a5f49ae3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671188499, "uuid": "f77b1d10-96bb-435b-bb9d-e759cc5ccce4", "comment": "Malware payload (RedLineStealer)", "value": "ad41c323995f06f5923947c2ee971284622e9cb3629819e2617c0463cddadfb7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671188499, "uuid": "dc56f4d8-ea77-4aa8-b20f-e3f43e822ca4", "comment": "Malware payload (RedLineStealer)", "value": "aa8976e95cc106b7d07ca2681db4b5beac448bde", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671188499, "uuid": "7d987d95-e20f-47ea-b9c8-b746fc046914", "comment": "Malware payload (RedLineStealer)", "value": "f4b5993d092a200e19f1157929f159cc5c5b9f93d12e69d938781891cac64423c5efabb72a1564e31c868614909a1ec4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671188499, "uuid": "3bfddce9-ae12-4958-9154-246e7198f3b7", "value": "T103740221B231D033C15F66708A16C7E48A7EFD305A716657F3346BAF6E70AC1626A30B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671188499, "uuid": "e6605f83-1989-4a0e-b392-4dd63d795d72", "value": "807baf2431f1bb1a8bddbe264b439a93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671188499, "uuid": "0ad39a38-4ae9-43b4-9aa8-535cc5293ee2", "value": "6144:/NhQLK2OfJrOYwsXlzQJkEN3mrd+BZ0dLxH3mfIFAPRr4tV8qMrc:/NhQ9oJrOYZzUZwd+30PHwIGPZ4H8n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671188499, "uuid": "b11f6da1-d8ec-4db7-9b51-855c337a5b57", "value": 363008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671188499, "uuid": "8399b86f-7f53-4547-b97f-0c66eda982d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671188499, "uuid": "7ecab9cd-4c4d-4789-8b5d-8628e49188d2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3833a1b-7d4e-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671201249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201249, "uuid": "417092ba-807a-4d3d-b7a1-72c4b3edddb0", "comment": "Malware payload", "value": "c2d157d99942dc12dfe9dcaad5304866", "object_relation": "md5", "Tag": [ { "name": "45-153-241-207", "colour": "#86D11B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeGaliXCity", "colour": "#607CCC", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SpaceCity", "colour": "#5EBE6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201249, "uuid": "cae149c0-2251-49c1-9c5d-cb300ceed1fc", "comment": "Malware payload", "value": "ae0c2b4ed2f3beac01a8997f8ac0cfa78d01e9b55e5cc70b490441e756fee039", "object_relation": "sha256", "Tag": [ { "name": "45-153-241-207", "colour": "#86D11B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeGaliXCity", "colour": "#607CCC", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SpaceCity", "colour": "#5EBE6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201249, "uuid": "8740713e-1728-481b-993d-43f7ef24522c", "comment": "Malware payload", "value": "8ac27e167ba9459f3434bf055ce90a0c3681e13b", "object_relation": "sha1", "Tag": [ { "name": "45-153-241-207", "colour": "#86D11B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeGaliXCity", "colour": "#607CCC", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SpaceCity", "colour": "#5EBE6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201249, "uuid": "a9a31387-4aa4-41da-9c72-3f07935ddfb1", "comment": "Malware payload", "value": "671cba12e29358e4047532de27ee505099b01e067baebe0abaec72d85302cbe82af289ccd0140d97a0e6a47e89ad6a36", "object_relation": "sha3-384", "Tag": [ { "name": "45-153-241-207", "colour": "#86D11B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeGaliXCity", "colour": "#607CCC", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SpaceCity", "colour": "#5EBE6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671201249, "uuid": "e409943b-0ac6-4f23-94a1-42a144781f55", "value": "T1C5F45A27E3B18BBDC156C13E81A28E09A73FB87D0733C1D745928619EB59AC01F3566E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671201249, "uuid": "44a7d2f2-22c4-4945-a4b7-0b414b842505", "value": "d13d399db15c51a1337d692663151209", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671201249, "uuid": "62494292-71f8-4171-9eb0-657666b4badb", "value": "12288:jaia+of8EJE4zszA+MkJPSS7lWo/TzzDqsZDD9OItfD5HgHq/lLg2z:jaizYtsM6THDqWDgwfZ8YLg2z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671201249, "uuid": "5a2b1987-c85e-4b30-aa7a-fc802f962d07", "value": 793600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671201249, "uuid": "53c702db-2ee6-4d95-bdfc-b996ee08cc9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671201249, "uuid": "655a4d0b-0b48-47d8-acdd-e148add04112", "value": "SpaceCityV2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cf8fdf3-7d3d-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671193775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671193775, "uuid": "c9ab185b-43fc-4a5c-8ae0-f351aefcd140", "comment": "Malware payload (Smoke Loader)", "value": "c2bed532443416cec0a70cbf88e8c0d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671193775, "uuid": "8269d53f-fa48-4287-ae47-1d6447aef790", "comment": "Malware payload (Smoke Loader)", "value": "af1ce34bd5d6ee83cfb2e0621614aea1804a72559ff5c3487a8fd83c64644289", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671193775, "uuid": "4fa1f7de-1d40-42f3-9f95-e05abff851e1", "comment": "Malware payload (Smoke Loader)", "value": "12a5c501183d77c7a9d780adf05d8660d7ba9fb5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671193775, "uuid": "de5d8329-3ba2-49d6-a522-ee02c7863054", "comment": "Malware payload (Smoke Loader)", "value": "167b22ae2bb3cb35808584057d9c3b474c87f082e573c53a9054244d2d780095634bc7da9dd06d1b7e01cbfb0d7329e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671193775, "uuid": "8bf409eb-5c32-48f4-81bf-17298fa32c6e", "value": "T1D924CF117271C472C21F09708859C7E06A2EFD318E739A47777E3B9F6E70A90A93A64D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671193775, "uuid": "d66f873b-5077-49d8-ac12-bdf64d85b618", "value": "e21f10fb81de748812499eebaf8a1cc1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671193775, "uuid": "62c8d79d-714b-4558-9506-2553adadf95b", "value": "3072:E4efvUV0L7hb7/vRwfIqS9m/hBpdNZX9+FLQ2mppGT8zAcAdK/QHtWqMPDcfuf:hef/LVXGBBZX0StLAtZ8qMrc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671193775, "uuid": "5a614d5c-7e0f-43ec-9eaf-bd39a6bc004f", "value": 218624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671193775, "uuid": "8d1d8b56-3c08-472f-a87f-e818d9dad07a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671193775, "uuid": "7b779241-c286-4269-8195-89a58cc011c3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "893b555f-7d18-11ed-9db1-42010a9c0080", "comment": "Malware payload (AgentTesla)", "timestamp": 1671177985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177985, "uuid": "507cfb5b-3e3d-4496-abf2-0cb1a68ef8d1", "comment": "Malware payload (AgentTesla)", "value": "997bb0139b7271880d1b5e841dc41baa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177985, "uuid": "48f52063-2ac1-41ff-bdba-26593b10d086", "comment": "Malware payload (AgentTesla)", "value": "af1e6ca25c063960be38376bd7890411acd5e9ea7589fba181909bf7b7fd0144", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177985, "uuid": "3c1c0f6c-be38-4e65-81ed-7c1d7da28cb6", "comment": "Malware payload (AgentTesla)", "value": "ec20f0ae79f2bff892edf6fcb70cb0922b9447a2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177985, "uuid": "d6270dd8-d5d1-450b-b997-d32aa826e3ce", "comment": "Malware payload (AgentTesla)", "value": "44675c45dd2c28051e647a479ee360a63fade6c52c0a400cb20f3d339b31ae26e5eb8abb1db4a7ad38906cf59571f1aa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177985, "uuid": "588eafa8-d877-4c5a-82fb-248859628f7b", "value": "T12EF4331F3CBFE2A5E941C0E25E921ED07FCA98895E111FD895BD8B634EC2091D0196FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177985, "uuid": "d4385c1a-fcdc-40ba-b84d-545a75fb35c1", "value": "12288:cF804U7a3iJm21Kvr81SEMFIifYKp3N7k9KR6WEMxy2THXV5NhsqBy5Y0y:cH4U7vJJ1MDH3Px/TFpsYy5Ly", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671177985, "uuid": "77bf74b4-c4c2-4100-9ff7-ef35c3bd7906", "value": 785768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671177985, "uuid": "938f0514-ff17-4f3f-9662-2cd6fb8e32de", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177985, "uuid": "161350c1-fa50-4619-8fcf-a2427b8bd89b", "value": "TT SWIFT COPY.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ee16ad3-7d1e-11ed-9db1-42010a9c0080", "comment": "Malware payload (AgentTesla)", "timestamp": 1671180598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671180598, "uuid": "570f24ec-b3a1-4081-b891-2f3129e91394", "comment": "Malware payload (AgentTesla)", "value": "32e4e195c6f857f1d83679751cf7cb23", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671180598, "uuid": "7ab71e74-63da-424d-867e-231ef5c0095c", "comment": "Malware payload (AgentTesla)", "value": "af38df85943c10a7900141adb9d9d370e732b504dbe2dca1a654375dcd3fc55a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671180598, "uuid": "05ad7f32-7ba1-4711-86bd-ce3a4e89837f", "comment": "Malware payload (AgentTesla)", "value": "35712d8d167986c868d1c7017a2ac8356e4b3633", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671180598, "uuid": "0715797a-bb21-405a-a122-861e83a5b8b8", "comment": "Malware payload (AgentTesla)", "value": "6b42e2e942854edb326910a27d71c70f2c179f9d6b0c8917429a320af9f941b24c7717b4660071066b8a24f3151168fc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671180598, "uuid": "d2dc032d-c9a4-4ac6-9cc0-61cb8e43e49d", "value": "T196E423BCF49BC4F8D047CD36BADC6EDCA1052F9061E61D2949FA7F84A5061D262F221B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671180598, "uuid": "b0fe7e07-f106-4af4-9dc2-27cc4177cb08", "value": "12288:RR//nxTPPCs7ftHvGX5xBDBtfcuLyLB14TOdHirAOs:Hnpys7E5xPtfcu0BqTOdHBd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671180598, "uuid": "99eee2f1-247f-4d78-9ef7-12b04d7b37bd", "value": 691861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671180598, "uuid": "b7045147-23b0-41eb-9fd2-9e7ba34740d8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671180598, "uuid": "0f15cb74-9c7c-4c5f-9415-65bb278683c7", "value": "Purchase Order (2).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fe90ce2-7d8e-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671228516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671228516, "uuid": "53d12625-4c96-4df6-aa5b-5626ce61a2bf", "comment": "Malware payload", "value": "a11ba3e9a909e7835f3b3b90162f0981", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671228516, "uuid": "9741300c-92b0-4764-8b51-b24e3b46ca3a", "comment": "Malware payload", "value": "af486b622b72d3e10ba04fac48af78e03b670b2e3b3264f076bb89df11dbf9d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671228516, "uuid": "85aa7b65-74f3-4a76-ba7a-6e9544c42f61", "comment": "Malware payload", "value": "1da2f49196d08eb3bdc8dbf99a8530113fd9329e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671228516, "uuid": "7576f999-e1f7-45c8-b368-1e7a015dbc67", "comment": "Malware payload", "value": "d8c1de1d1a695c430f334adbb7681184c6071d615c34d269b9cc70bfc679a45c6f447bd0f5728347c8c275254374cfc1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671228516, "uuid": "ada69c89-03a6-4ac1-ae72-5ef0b3405f28", "value": "T14B24CEF123A0E42EC151C7308C15DAE46A7AAC105F259AF33B582A2F5D326D159FE37E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671228516, "uuid": "dee159a2-0366-4f35-85ca-f80ef00d8c91", "value": "aa9c378109186462717e17e657d0c833", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671228516, "uuid": "9ff24de7-57d2-4115-973f-ae5cf543670b", "value": "6144:+hHyLiXk1o2fz3x2QV7mQ2gzGAa40M2b:+8skagz39NTKA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671228516, "uuid": "ffb92b2e-2372-4e4e-aa1f-a2e93e57a506", "value": 219648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671228516, "uuid": "f9a65a0a-37e3-4414-ad7a-987c5ecc013b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671228516, "uuid": "f742e1f3-545d-4310-a9da-73dfaa5e1408", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d87ad742-7d5c-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671207324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671207324, "uuid": "66e2ee01-4a44-4acf-98ea-e274b93caa44", "comment": "Malware payload", "value": "9f5d0ec4e2536aa3afa53a6403af6807", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671207324, "uuid": "1b89558b-f823-476c-ab4a-5d678efd5a44", "comment": "Malware payload", "value": "af7b4e3e2063ff59ca2a269c53e540ba073c68fa717c729c2cd16e500b4ad3ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671207324, "uuid": "2f522860-2578-4b6f-8d57-c46d5e94081a", "comment": "Malware payload", "value": "6edd7300719741a6a11c942458f209ec465ab913", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671207324, "uuid": "fa0fc7b0-892d-4aab-b075-b8e4f5ddd5dc", "comment": "Malware payload", "value": "f927399139af3b5648e0445047d5d5911383703c59ce14f7687abaa874c2659b8d00df676564376c07434fc1b7d5ee3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671207324, "uuid": "8c7fb9d8-8b94-4c82-a89d-4f3950c1ff28", "value": "T17454DFF0B7A0E47EC122C7314925E6D4A9BAA810DE2255F77B44262F2D306D056FE37E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671207324, "uuid": "b9aac725-8bd3-40cd-93b1-19812f9ebdc0", "value": "3670997c8c2669588bad5b8c178dedd4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671207324, "uuid": "bfddadbf-6126-4bc9-838f-f89e69841945", "value": "6144:QyL54NozUa3cnciiUOJusP+CHIQdOgzdT40M2b:QyaNoz9cncrziCoQ5x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671207324, "uuid": "491f0ed6-c0cc-48c3-a74d-c417291daad3", "value": 280576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671207324, "uuid": "3a071df9-9748-4c4d-9431-c4f15676847c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671207324, "uuid": "747a3b87-d74e-4181-be6d-77e8ab12f0c1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd97a357-7d8a-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671227062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671227062, "uuid": "c8b9a37c-d8cf-4005-a6c4-4f3185688e8d", "comment": "Malware payload", "value": "11c56ab2c1e8bb61d0f06854fc93acaa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671227062, "uuid": "49899f56-22dc-4617-aa23-bf473d7f53f6", "comment": "Malware payload", "value": "b0e02797c5a11f9ac9f7fd2dbc9a47ec6f0fe444ef53d18afa44bce390eed9d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671227062, "uuid": "3e05b322-e7a3-4ff4-827a-5e4f51ca8935", "comment": "Malware payload", "value": "185d8f901a491c77dc7011782fa0250273db56ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671227062, "uuid": "bc9160c9-5fa9-4ebb-8a81-dfea320d7ab0", "comment": "Malware payload", "value": "c5d548f83e1c80e3e57ff3b7afb8c5c4e62754c7392c58282b2ed38adb2b217db59e34aedf0c2beef104b36a92589b5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671227062, "uuid": "6b5e2077-a3f0-459b-a82f-def99e089f1d", "value": "T1EB24BEF037A1E46ED151D7309C2AE6D4AA2ABC104E2199F33B14262F1D712D166FE37E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671227062, "uuid": "45880d17-d9f5-401e-a6f2-0755192d7094", "value": "aa9c378109186462717e17e657d0c833", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671227062, "uuid": "7676ffb5-b56b-4c31-ad2a-5611a1d4cb79", "value": "3072:VSiYW/oLzZmSbRc0H78a/bEs2YFr1Wf0i2LC2HLszZFwyaB840zwUzQRKF+:A6oLzZTb84V2q80iB6gzLwyB40M2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671227062, "uuid": "d47e23f3-aa51-4723-b523-ae3fdc5d8dd0", "value": 219136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671227062, "uuid": "f3879f04-20d1-4f60-8c05-ecc33a5a122a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671227062, "uuid": "08b24edf-b338-487e-a739-33522c9632d1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc7c1250-7d2c-11ed-9db1-42010a9c0080", "comment": "Malware payload (GCleaner)", "timestamp": 1671186714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671186714, "uuid": "bc9924e3-480e-4eaf-a03e-0342619b2bd2", "comment": "Malware payload (GCleaner)", "value": "3234539da113724f7bf4767db481a378", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671186714, "uuid": "aca18391-acd3-49bc-b080-878860241a72", "comment": "Malware payload (GCleaner)", "value": "b140df206769ecad36a1bcaa0eb8005e79234959cb4fd3e86c68bc04aaa1bc46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671186714, "uuid": "c8d429ce-a4b0-4709-87b8-8ec8163f6b13", "comment": "Malware payload (GCleaner)", "value": "9266766493887fc66bfb02612ab817d83bd0a6e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671186714, "uuid": "d6339350-92f7-4642-a68d-d880feb78c88", "comment": "Malware payload (GCleaner)", "value": "65edc261c5a973da374cf138be701c7e4dca9d9a64585fefaa6e2fde56098d91b05ebc7a70439332c994184a07a5ae84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671186714, "uuid": "69a1b3cb-ba8d-4923-a01e-8e1beb60e5eb", "value": "T15FB523BB96E414B5C0BB49F838269C30D8B16D1B1974D98F37D93FAB77FA5C1190A202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671186714, "uuid": "785b11eb-27ee-44b0-b2da-bd8800d7b343", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671186714, "uuid": "dc4b9f35-5d12-4924-ba47-5da0ac24c02c", "value": "49152:kpgQp5xdq6FVMylfmnrgM9pinb5VuOHeOCgSY/imG:kpnvfFrud9gVuOHcY/imG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671186714, "uuid": "6dc44cb2-50cf-45bb-b51f-5969fc883ea3", "value": 2417980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671186714, "uuid": "6ae42a4b-2c08-4581-a727-55195cd5ff57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671186714, "uuid": "b5aa6b67-fc1c-44d7-b0a3-82593dfde2bb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27097ac2-7ce8-11ed-9db1-42010a9c0080", "comment": "Malware payload (AsyncRAT)", "timestamp": 1671157204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671157204, "uuid": "8c19984c-eb04-4d18-b76a-a9b337acee35", "comment": "Malware payload (AsyncRAT)", "value": "5ac2d245025afdd32eb83ee07c5eac2c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671157204, "uuid": "654d2218-36d3-4576-935e-cd17ffc55c81", "comment": "Malware payload (AsyncRAT)", "value": "b1b279e81410d415a097e9cab59aa3a04728adf62095c99d1aee345b124d4b49", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671157204, "uuid": "4b7ae8d7-4be8-4c66-be9f-e23e428249ae", "comment": "Malware payload (AsyncRAT)", "value": "2d7afe2482c8b00f64a3c06f1991e9d31e5e4992", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671157204, "uuid": "3e55ec44-334f-460f-a8a4-d55083905032", "comment": "Malware payload (AsyncRAT)", "value": "0d697d5d5efd5b75e3d82a26f30a8166614ca29d790336decac26358336314d032ca638c4caeb2a308de956d99549233", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671157204, "uuid": "472769fe-40bb-4bba-a3ff-64cc1cc69e90", "value": "T1E2F4986D01AEB97DEE7046E045BCBEEFD9F279D641C184F4EA211048C333F6A768911A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671157204, "uuid": "c268dacd-d2e8-4770-945f-bfefe7068abe", "value": "3072:DWYU4444d444444444444444g44444444444444444K44444444444444449444a:D1/QImq4sn+kdnuzDT03ApT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671157204, "uuid": "f0fbecd2-5bcf-4057-94e1-27fdf9d52a77", "value": 790361, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671157204, "uuid": "98110951-dbae-4d50-8152-004a16ee9682", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671157204, "uuid": "f60b0813-d934-4f81-a97d-acaf884fb4ec", "value": "img.jpg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "122bb29a-7d09-11ed-9db1-42010a9c0080", "comment": "Malware payload (Amadey)", "timestamp": 1671171343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671171343, "uuid": "9019c35d-7ded-4810-b8e2-f30f0e2debe6", "comment": "Malware payload (Amadey)", "value": "ce4e35729267ac108799b6d026aa5223", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671171343, "uuid": "f4b84a58-a853-4eef-9d3a-a32f9fa055d6", "comment": "Malware payload (Amadey)", "value": "b28e6758b344d350ef7545f734a4304af519d6439e0162b2e6c3509bff352d50", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671171343, "uuid": "1177b20b-97d5-44e7-9fd8-985cb46ae6d0", "comment": "Malware payload (Amadey)", "value": "393d05633276b24888e9b740269f17cfc80cdfe8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671171343, "uuid": "d8f31f7d-8268-4ba6-abe3-ce5d1d0f20c8", "comment": "Malware payload (Amadey)", "value": "cd18559c04b8bd758aba82650fdca31fece4367a07ea0b379745ed3c9f89255bf36684078a4dc929ca15ffb930597bf3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671171343, "uuid": "402e1b9e-9991-4159-ae8a-40b50468b379", "value": "T1BD54E011B2B0C4B1C54F86308C65C7F15ABEE9319E709A4777367BBF6E30A40627A74A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671171343, "uuid": "3bf9bd08-23b3-49cf-a884-dee0bb486a69", "value": "b35462da489bc13bae884e55b5227599", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671171343, "uuid": "efcbd052-2784-4ad4-ba22-141082372295", "value": "6144:O0kHLw6Y5ugB1mrBkf3wf1JZqK7z2taQlN8qMrc:O0kHs68uYisAFqA2oI8n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671171343, "uuid": "d7501f13-ae19-490b-af94-61599fdfc09f", "value": 293888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671171343, "uuid": "b1a58b7a-cda3-45bb-bf44-ee5041106fe3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671171343, "uuid": "c168fb3f-9bc3-42c8-b043-40d0e7024224", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42478eaf-7d99-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671233271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671233271, "uuid": "b60536bc-dcbb-4763-90ad-a64bd5230d2d", "comment": "Malware payload", "value": "890b71c6b49a6bcac6144fdc31a15d7a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671233271, "uuid": "9aa69a05-1a6e-4971-a291-20966dee7448", "comment": "Malware payload", "value": "b2bce4be2813b37672f15bc214ad7bfc703b84007c5981191dec6a13f5056878", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671233271, "uuid": "ad8af19f-8350-4f88-a0a7-a48a560e08f8", "comment": "Malware payload", "value": "c546ea3b039269cc4b9fd1d5579818c1927af29e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671233271, "uuid": "c2e6d976-77b8-404d-8c7e-17e029dd0976", "comment": "Malware payload", "value": "992881380d403529ebf209c5f9d6a36a1dea5d2f7bfd6f9a62d881b5eb2e344767b1b025322b39df14092d9ff4887008", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671233271, "uuid": "c0293fb4-3cad-4b33-b178-7a2bb942f109", "value": "T16243F2059F14ED46DF000C73298D9BAC9D7BFB4A46ABB0B598A1EC4F97E21D66C5B300", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671233271, "uuid": "afb07af3-9943-4b1c-ab2b-99ed409a9af6", "value": "1536:pxpJNlEYvXndUt/afLuZmVelu9eoCtcCCzNbCw:phNlHuBafLeBtfCzpR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671233271, "uuid": "2ddbefef-3f03-44f8-8183-9f5337cc026a", "value": 59684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671233271, "uuid": "dbdc11f8-5dc1-4be7-a7f1-501dcf1933a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671233271, "uuid": "1bd03299-ece6-46f5-b691-ff623c81aa66", "value": "SecuriteInfo.com.Trojan.Linux.GenericKD.50294160.4204.31717", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdd1c107-7cf1-11ed-9db1-42010a9c0080", "comment": "Malware payload (GCleaner)", "timestamp": 1671161430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671161430, "uuid": "44a25c05-b7c4-4c73-9a04-c5bea27ca95e", "comment": "Malware payload (GCleaner)", "value": "d0d8367178759176a21e72dd085e8c6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671161430, "uuid": "1a6e0bf0-a31c-48f8-b7b3-6fe9e53439b6", "comment": "Malware payload (GCleaner)", "value": "b3d6dae504af6b5fe4d96e770da762b68b106657114be82f28422966a54362be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671161430, "uuid": "75fba043-db19-4cae-a5b8-9920601d825e", "comment": "Malware payload (GCleaner)", "value": "527197ed4ca2c9a5be5c6f4fa55c8299d63b2a43", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671161430, "uuid": "1048cb9f-8bef-495b-9382-e43fcab23121", "comment": "Malware payload (GCleaner)", "value": "5a9630b8d6cee5ce9f6744a0b325c59fcc4a05184fd18bb348659db8b3269d981bf1b582781c249f47d7d6f6544db9c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671161430, "uuid": "93278ddc-3ca7-41cc-8fcc-d95f684f1e02", "value": "T175C523BFA4440075C1F305FC7C3A9C215AE67E876A24E54D3BA87F4A77F6AD38602216", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671161430, "uuid": "fac4eaa8-41bd-4821-8c28-29e00671f0f2", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671161430, "uuid": "66d7d89f-3b24-4829-9123-f2147419b760", "value": "49152:MpKmX2RuFaD62ho5+Vqcf2NqQSOrOtqCEIUYMSeOCgSY/imn:MpK3MYDw5+VqjNqkyjEGcY/imn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671161430, "uuid": "285c0863-f1e5-44d0-91e1-d36b2995faed", "value": 2572943, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671161430, "uuid": "9b94d443-e7cb-4193-8090-e1084f194e05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671161430, "uuid": "a287fb12-503e-405a-a5f6-cc5525665502", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e1a31af-7d2e-11ed-9db1-42010a9c0080", "comment": "Malware payload (CoinMiner)", "timestamp": 1671187335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671187335, "uuid": "7bf8e9f6-abe7-41e7-9707-779d52eec105", "comment": "Malware payload (CoinMiner)", "value": "d92c8338c6ee639c847b2b48a6a309db", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671187335, "uuid": "7ed575da-7ad3-4655-85ba-1f148e5bee27", "comment": "Malware payload (CoinMiner)", "value": "b3e90cc7ab8a0216ccd9ca97bff05f88c7d70686604490a458a2aabf72a52bfb", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671187335, "uuid": "3a98239d-627d-42c7-aacb-715fe8a4ffe4", "comment": "Malware payload (CoinMiner)", "value": "56904ff6cf7197cde361743c6c26508cd4534ceb", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671187335, "uuid": "e2b04f8d-ad19-4b14-b4b3-c7ca12c06108", "comment": "Malware payload (CoinMiner)", "value": "46726f9f166bbacdadea13e58e92d76ddc7d7ef743b90312e0c025af49d3ed71ae5c26a4e31ac0f1761d6a66fadd7a1d", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671187335, "uuid": "54e298e7-e497-4271-8040-6a92afc8031e", "value": "T1EDC53A2291713716C8ECC632A1F90955FA70ED959D3E129E3C4F3E8ADF7D0824D67A82", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671187335, "uuid": "8c679edc-ab3c-4b57-82f5-a4da956baab0", "value": "88153abbd2d202bd5dffcb8707c03dbe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671187335, "uuid": "1cb67dde-b8bf-48a7-96b0-795278bb9022", "value": "49152:kOjmMTy0iErFGnVpVYK/nmO+ZNAk93cmNtR:9pK/nmO+ZNAk9smbR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671187335, "uuid": "ba1a5cbd-2e25-403a-9836-b730cca0272d", "value": 2557952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671187335, "uuid": "bc3edb32-0cdf-40f2-b598-82c5784872a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671187335, "uuid": "6a9fc9bd-ca56-41c8-a7f4-699349f1cbbb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72ba7fc0-7d7b-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671220467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671220467, "uuid": "3510a189-1da2-43ef-aeea-334d7544c21f", "comment": "Malware payload", "value": "8366564137b32134700f94e1c68c6077", "object_relation": "md5", "Tag": [ { "name": "82-115-223-60", "colour": "#F7CF6B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeEvilHunters", "colour": "#9F827E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671220467, "uuid": "dbc9b5d5-5a33-4b2a-bc35-7af4b73688a9", "comment": "Malware payload", "value": "b44ef76e040991b1dbd2f40c9a4aebb8cb3288f1ef744b92ee8090acad6ff629", "object_relation": "sha256", "Tag": [ { "name": "82-115-223-60", "colour": "#F7CF6B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeEvilHunters", "colour": "#9F827E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671220467, "uuid": "971a05b2-4f74-4849-bc06-f1409c2c846f", "comment": "Malware payload", "value": "8930d8aabd942c03040954e88835391f85bb28f6", "object_relation": "sha1", "Tag": [ { "name": "82-115-223-60", "colour": "#F7CF6B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeEvilHunters", "colour": "#9F827E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671220467, "uuid": "467c6d6e-fd75-4f6c-89a7-3b3bd97a4003", "comment": "Malware payload", "value": "b8db4a8a898848a6fa05b741cf6c055f8f79b4e2d4934ad2ae96b92b27eec313d05fc1a35d13d924bac1f4c986591165", "object_relation": "sha3-384", "Tag": [ { "name": "82-115-223-60", "colour": "#F7CF6B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeEvilHunters", "colour": "#9F827E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671220467, "uuid": "7b13d5e7-de12-45d4-b289-ecf5b36f60e8", "value": "T10AF633D2D0AF8C6DCC97B770D48D9B01B760490808E2EDFB1A52A2D74F63E5A5B93790", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671220467, "uuid": "a7d5772d-f61f-45ce-889c-3e36cf1a4885", "value": "393216:7efvLe5t6hRdr8k2LU1kVyhNHw372Ry5t6hRdL5t6hRdr:M6WhrrMY15CWhrLWhrr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671220467, "uuid": "5b7d9313-9b75-424d-87d8-ba6684128691", "value": 15656537, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671220467, "uuid": "b8546f93-1540-42da-a559-bae5feb4044b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671220467, "uuid": "ec492115-baa5-483c-86d3-c044dad27592", "value": "Evil_Launcher_Beta-win_x64.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4104b4d4-7cf6-11ed-9db1-42010a9c0080", "comment": "Malware payload (GCleaner)", "timestamp": 1671163261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671163261, "uuid": "1d012909-833a-43ee-94b0-0ec850672ddb", "comment": "Malware payload (GCleaner)", "value": "580c10cd9f7bc36d812ddde39a80c890", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671163261, "uuid": "024dd8af-b348-4f02-b9ac-e49f891b8a2a", "comment": "Malware payload (GCleaner)", "value": "b4b8fae3c02b18b864bbb7997301c9e6e2d3c203e56012a520a0205ea0c3cce3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671163261, "uuid": "a15ffd8a-4e61-4871-8f3e-dee580065d0c", "comment": "Malware payload (GCleaner)", "value": "2169241b56e8e325254b80a01516bf455f075cc1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671163261, "uuid": "701883ad-ad8a-46e3-82cd-c658f5fe553f", "comment": "Malware payload (GCleaner)", "value": "43ed4b78c88b8d0a0b06be38db88d5ef3a147a706ab7d09a287343fbbf9721f18b8ee6f9164f514673cd873bd9b8ba17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671163261, "uuid": "56885414-8e0f-47bb-9c5d-9fe6ee6d9fb9", "value": "T1DFB523BFA4440832C5F759F938755D718AEAAD136D29D98C3BC87F0F72FA8C18906219", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671163261, "uuid": "ab3e1cf8-46dc-42aa-8769-291b465abb6f", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671163261, "uuid": "124ebeb4-41d4-4414-b232-2e78cf1b55c3", "value": "49152:kpZTrNxi7KNLjodXPfx3e13K1Bj8RbRtK0+nOLeOCgSY/imu:kpZTrNxaR3aKPqbX/rcY/imu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671163261, "uuid": "85b1946a-9ab6-4d4b-b638-4ff27573ff5a", "value": 2399326, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671163261, "uuid": "2f9790a5-a7b2-4d72-9104-fe171961454c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671163261, "uuid": "fe006672-ad86-42b6-bf0e-6dfacf7df9d4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10e32c6f-7d79-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671219444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671219444, "uuid": "1f46f95d-c8c8-4155-bfcc-6d2b3c874bab", "comment": "Malware payload", "value": "380450f7a7f42b562a1a30d586e7730f", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671219444, "uuid": "6cda5b22-7807-41ef-b1d4-503f75cf808a", "comment": "Malware payload", "value": "b4d4f81eb7efc6aec8a7eb05c21da69e61ab1fe0e5a518e201bcfee48a87a416", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671219444, "uuid": "065a4ae5-0d41-4e1d-8235-900d27061d05", "comment": "Malware payload", "value": "5dba596dd89f2910d24633d286eb118db91a89ff", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671219444, "uuid": "5d863a1b-e451-4e80-b48a-675348ad76be", "comment": "Malware payload", "value": "4ce2ec227884c448d223b1f07c22915f0db48d6b777a240c5cf6e078e20b607dba4fcc8481896284dfc758e1ab649610", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671219444, "uuid": "b2e5b64d-4477-4b98-a633-bdde6a46df91", "value": "T1AA64238AE91951050DBB027B8315CF73DDFAB15B22A0FF3B32442FCEA54B4511AEB499", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671219444, "uuid": "786bbcf1-2e52-47a4-9497-86db69976526", "value": "6144:QJvjWjk/CmIurGiNptngjPUUgErQTZvX6or87fwBhxhebs7F8W6cc:QJvjWjkXNlY8tEcTZfmLwRBF8WPc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671219444, "uuid": "695500b4-4f03-41a2-86ff-e7f5973aa11e", "value": 324193, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671219444, "uuid": "05d871e8-6e97-467f-a9bf-43a7275e503b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671219444, "uuid": "d9e9680e-6089-4057-980d-4fbb9772e7d1", "value": "Amended Purchase Order 7109513.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ce0fd6d-7cfa-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671164891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671164891, "uuid": "3ac1d0c6-5648-46a3-9ef3-680e7e271c99", "comment": "Malware payload", "value": "d91043bbba4af6e9602be11e8e3e87c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671164891, "uuid": "73feab6f-cc5b-4ad1-8363-3e7fd4fc7d58", "comment": "Malware payload", "value": "b5214d23ec443417a30e1bcf9f9972e1745113cbca2996e88b112c4b46df6c91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671164891, "uuid": "e517485a-3a5d-478f-902a-7655d21a3dd0", "comment": "Malware payload", "value": "01b5f382b6b7c155e03d0a9d7a59caea000650dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671164891, "uuid": "389f2a7c-1653-4ee9-82c0-73d5f436e051", "comment": "Malware payload", "value": "17024c5467162be663099cc7322da28c0289f2a4a0a4008ccb32db0b78e8742af0e600e1ad0357ef3c38974a55a163af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671164891, "uuid": "e695683a-cc0f-46e0-8e43-91e0cc8cbce3", "value": "T1EAD1C701D2F955BAE96DB739A8BE4B0073FEBB533842DB8D349821169DE235008916B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671164891, "uuid": "2923f498-2c5c-4ffe-bc20-628f3ad4348a", "value": "96:FLO4KNcxenbLzNN+XoCST+Ev6SKVFu3SjsLh1zNt:dOFhbNBViI6SuUCjs9P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671164891, "uuid": "4acc0a8b-8d3c-413d-a686-4ad9da17e39d", "value": 6656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671164891, "uuid": "75aabd05-9a14-4dd6-bd56-a70c69d1072e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671164891, "uuid": "087bcdc2-4d4b-4830-be60-4fc3dfc10504", "value": "SecuriteInfo.com.Win64.PWSX-gen.2865.24466", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c6f9689-7d5f-11ed-9db1-42010a9c0080", "comment": "Malware payload (RedLineStealer)", "timestamp": 1671208270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671208270, "uuid": "56a2281a-b88d-4c62-beb1-15f1447e3a49", "comment": "Malware payload (RedLineStealer)", "value": "9b651d9c70716a654e19987859390322", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671208270, "uuid": "eb5bdfd5-db5c-4de2-b97b-7e710ee5af5a", "comment": "Malware payload (RedLineStealer)", "value": "b5afd5b75da2202b1f4700b8c5ef56db1ae4008ff8eb0813c8a588b4f0e26319", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671208270, "uuid": "0253d363-0a4e-4438-b677-3520f7e254c8", "comment": "Malware payload (RedLineStealer)", "value": "6728c5c22a8ddc52ba1cca27f7c6da70ddb3f785", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671208270, "uuid": "b69e8796-869c-4aa3-9d94-d12577a917c1", "comment": "Malware payload (RedLineStealer)", "value": "0f7f7b7035305d0bf936c43d2502b954ada15a3890302df4cd694b9bb69e1525824ffd682283e693ce0e88696a9e9f9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671208270, "uuid": "46776780-07cb-4385-aa5e-55336b9e4554", "value": "T10F74E0F07290E43DD111D7318D169BD4A92ABC105E6296F33A582B2F5E312C059FE77E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671208270, "uuid": "f4ff60d6-b8a6-4bba-9026-7ade5142a172", "value": "3670997c8c2669588bad5b8c178dedd4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671208270, "uuid": "8ec91928-b499-4082-9a78-0fc4a5574893", "value": "6144:S9CzLVXuNHb5es7UakfFkjRjCvg4ZRmHgz4J40M2b:SEz5uN75eivyFkxOg4ZRlk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671208270, "uuid": "91a54b5c-f98e-4b51-b910-b68473c4dc40", "value": 342528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671208270, "uuid": "43fc8d04-d305-4cec-a9ce-efe9460e3006", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671208270, "uuid": "90e0e75d-c473-4682-8f8f-42e3103223d2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4307934a-7d1d-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671180015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671180015, "uuid": "ca9f102e-156f-42d5-b969-ad784e4b2c8f", "comment": "Malware payload", "value": "df3703a1753f9a4f0ca5415f420a73ee", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671180015, "uuid": "c4d8c107-0a74-417f-849e-b1215fd7b407", "comment": "Malware payload", "value": "b5da9dcd073fd8815e3861af130c77120c16ed764d4dfe9e06f3f2fe0db3fff2", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671180015, "uuid": "7db0380a-c9d7-49a7-a93e-3d40247b3bb3", "comment": "Malware payload", "value": "46d83d31bf88e4f30228fee5cd479df0816d6c76", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671180015, "uuid": "c9c41579-cb6f-4edc-9c4f-6652f5c9810a", "comment": "Malware payload", "value": "858c55b198d746d06f06213471943622939f3e88d86482ab135817d49456d9ab071f9a86abfa09917747890e5516d8d1", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671180015, "uuid": "9ea51bcc-bcdf-45a9-ac68-7be8e7620a35", "value": "T1CA43F17DE150F134C067127DEADA15ABA006828653BC5A37FA11FF6C1A88E4F671F8D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671180015, "uuid": "2e6bfbef-a9c7-4199-9d69-2a8dca483937", "value": "1536:j50ocSNc3SNtrO4vRLi54fCE9+nASBLZqK6IW0o:jqooYtrvi54fN+nfBLwKTW0o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671180015, "uuid": "c9f17ef4-429e-4465-a76b-ecd613e48fa8", "value": 59806, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671180015, "uuid": "3d0f5d17-1037-4cc2-a454-adf49b8a854b", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671180015, "uuid": "74d17071-8b73-43b9-96a0-07d47f99acfe", "value": "Programm Mitgliederreise 2023.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfd39013-7d55-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671204329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671204329, "uuid": "279c2d92-4bb6-4e80-a115-cb48c5231df6", "comment": "Malware payload (Smoke Loader)", "value": "5b7a550c6c4249434fca40799eb0f6d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671204329, "uuid": "a0951456-55b7-4ee2-bd30-d41e57e53db2", "comment": "Malware payload (Smoke Loader)", "value": "b5dd443c6355b3402eaed51e99ec160c5c81e55d28657d0f05b1d321ce9ec2ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671204329, "uuid": "44593374-2405-4127-b7a3-058fec236d3b", "comment": "Malware payload (Smoke Loader)", "value": "a4103f3e2ce06384b7db7d1f36605b2a640874af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671204329, "uuid": "c7650d97-5e32-4fbf-b22a-618f09ffa3c9", "comment": "Malware payload (Smoke Loader)", "value": "a01b137a7e970e8e49cf3f654107f04e102bb5b565811d21d72f35407e641578a128b2f637a6f6a70617e25a56620464", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671204329, "uuid": "c913b5ff-41d6-41b2-b6e0-2b8c8eb94cb7", "value": "T17324BEF03690E06ED182D7308D15DAD8966BBC159E2269F32B14266F39702C196FE37F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671204329, "uuid": "3807f2d3-ff1a-494f-a2e0-b9fdcb82469e", "value": "2cc3e4b8a374ca30888470c0a531eceb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671204329, "uuid": "131fd242-eac7-4ba0-9a89-3f3ca9cc7fb8", "value": "3072:Y1GKdL2ir/6BuyKGlTCSSRFWtCbBnCFhV7qC90EOLszRDWZ40zwUzQRKF+:SvLt6EWU9C7VmVgzRDG40M2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671204329, "uuid": "00e0b6e3-a4f2-4161-b25f-40dce4371b78", "value": 219648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671204329, "uuid": "b1c49a03-fe0b-4327-807e-5eb6535259e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671204329, "uuid": "8f7bd690-07f5-44fc-a3bc-89a6bc5948c6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd71c578-7d15-11ed-9db1-42010a9c0080", "comment": "Malware payload (PrivateLoader)", "timestamp": 1671176811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671176811, "uuid": "e518bbf7-6dda-4da6-9d7d-9a3493f5b5ae", "comment": "Malware payload (PrivateLoader)", "value": "5debae710acc279440b0fb96ad7ba5ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671176811, "uuid": "94bdf3c7-081a-4fd5-ba8c-7d1185d3487b", "comment": "Malware payload (PrivateLoader)", "value": "b60004cf3b319182c85d8feeae4d3fc9d9f7cec8dd7740b1f7731f1d21cb11a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671176811, "uuid": "9fbb121e-3ab7-4534-afe5-999182028215", "comment": "Malware payload (PrivateLoader)", "value": "90d849a4c61b183b13dcce6a7622c0c9d569e96b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671176811, "uuid": "12fe7556-6224-4eaf-a20e-67d45083a809", "comment": "Malware payload (PrivateLoader)", "value": "c01c3e0fca544b071284dc60b45059e0d33468cca15711fad0d91b5984bfb60119c70cec5110aa431def49ab360a1f11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671176811, "uuid": "5318aab0-8fbb-4cbb-a01c-e6cd9879fec5", "value": "T19BB55B22E340F015FCA210FAE5BB15FAA8745E30A38444FBD3C47995ABB66E2F535913", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671176811, "uuid": "a13df55e-de42-43f3-ab91-9ea6a3955a03", "value": "02951e73b23a430852958a5fac567566", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671176811, "uuid": "1710d8f4-0525-47b3-9b1e-38f2309a0182", "value": "49152:ojOcnDWdf0c37oGtkJ/5Hb4bd/nG78GDeYDCThetBdDdMJoTdtqhpP:mOcDaf0mkddod/nbGEadM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671176811, "uuid": "35536e15-2c53-477f-9bff-2396a277500c", "value": 2422784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671176811, "uuid": "bc676ebd-2338-44e2-9fbf-f58a83f89715", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671176811, "uuid": "b2edbf12-0a08-46c7-be4b-03ee5a8e7d8b", "value": "5debae710acc279440b0fb96ad7ba5ef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31689b6e-7d1c-11ed-9db1-42010a9c0080", "comment": "Malware payload (RedLineStealer)", "timestamp": 1671179555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671179555, "uuid": "30451189-d0ef-4985-a4e9-4024aed6ac7f", "comment": "Malware payload (RedLineStealer)", "value": "348a741b798b34cc70bb34dca27dc1fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671179555, "uuid": "2564287d-638c-4f9a-bcdd-7204215e8a5e", "comment": "Malware payload (RedLineStealer)", "value": "b7638ecf44b6308671d872bb50c7d7001a42be9d2c021f86c2afd7710b47077b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671179555, "uuid": "4f946745-2333-41c5-a943-505e0c3379ee", "comment": "Malware payload (RedLineStealer)", "value": "3e9cfa3afe80320ac87344669b8722da12702761", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671179555, "uuid": "7af7816a-fe54-4c32-9389-36efe3fcca65", "comment": "Malware payload (RedLineStealer)", "value": "d860a5f79ecf72f225289091b0254baa93e1aa568b1ac943bb2d55309e3c614cf020b544af3486f8a22aef131552d3a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671179555, "uuid": "5e1beae0-cd45-435d-a020-4741877c4e4a", "value": "T14B74021176B1D432C36F09308945C6E4AABEFC3159B15A47773A32AF2E30B81663B74E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671179555, "uuid": "25a929fa-4145-409d-860f-e3be4a4bb4ec", "value": "b35462da489bc13bae884e55b5227599", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671179555, "uuid": "5aac7df6-cf68-41bb-b69d-c3877865e321", "value": "6144:m+Hko3LKdka/G+iXJOENOjoSW82sw4z0KYRVNY5hHtwR38qMrc:m+HkcWdjKRNOje8TwFRVN6G8n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671179555, "uuid": "653c93e0-3c54-4fc9-aefe-4753c39b08fe", "value": 355328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671179555, "uuid": "48bfaf18-0f05-40a8-af10-8c7d8ff70079", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671179555, "uuid": "8b239e8c-e282-4eb7-8e33-0b5130e546f8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14f36f7d-7d87-11ed-9db1-42010a9c0080", "comment": "Malware payload (AgentTesla)", "timestamp": 1671225464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671225464, "uuid": "6f038be1-3302-4307-9cd3-126f7342dfe1", "comment": "Malware payload (AgentTesla)", "value": "80565de512bf243ed8c6e05b97947e6e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671225464, "uuid": "2798da58-a5af-4f29-9059-fb4beb773da6", "comment": "Malware payload (AgentTesla)", "value": "b8549fd83dc62872515f5257a64cd681fe92ac324cc5f012e07adc08d00c2b75", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671225464, "uuid": "507315d8-a860-42f1-8e5d-6383babb9508", "comment": "Malware payload (AgentTesla)", "value": "a9c70570a3d44503a209fb6fcb9cfe4738c2b317", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671225464, "uuid": "13423cda-0c9e-4121-8bce-3711259ce30c", "comment": "Malware payload (AgentTesla)", "value": "f478f9d7f317ae40124309a1048580e7c2742772b9aafee24138ee05154920c4e11f91fb2b3e027dcbd3551baea1dd17", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671225464, "uuid": "5dd5bb13-973a-4cd6-b7d7-23fe1ec79644", "value": "T19D25012267839A82F37B0631C0C3964453F0EE864627D74F7FC43E5ABA73755698728A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671225464, "uuid": "2d379605-bd42-41ee-95b7-4ceb709064e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671225464, "uuid": "d78ed353-e98e-47e6-b749-71789e75cdad", "value": "24576:Wsaie1Rci2t/VHAJgYC/1afAVQWloWql4nCxkKXvO:abcDt/BA4Y1Gcl4kJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671225464, "uuid": "14145252-f1c5-4afa-b055-dd4b35311cf4", "value": 966144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671225464, "uuid": "bcea2c26-ff76-476f-b515-4b064f5280c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671225464, "uuid": "f9411455-2da4-4f44-b00b-e0219f78761a", "value": "PAYMENT ADVICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "794e863d-7d22-11ed-9db1-42010a9c0080", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1671182253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671182253, "uuid": "0ae3289d-2ace-4d2d-9ffe-7f74aa64f80c", "comment": "Malware payload (SnakeKeylogger)", "value": "9c137c919b3d6fa0e9c727d2cd8e176b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671182253, "uuid": "65e62739-9975-45cc-87ea-8874d8a4c5b5", "comment": "Malware payload (SnakeKeylogger)", "value": "b85aa63d88b84be274b0b6017a96d45c00e92ca0fbd3e00adbe7105f5997ec37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671182253, "uuid": "9652e93d-b3d5-4ebf-aee2-ebfa47c597e4", "comment": "Malware payload (SnakeKeylogger)", "value": "df5701f9f8d09c804e75e9d96d81dbdfc667c106", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671182253, "uuid": "0e255b90-8eaa-4912-b537-04705b685ff6", "comment": "Malware payload (SnakeKeylogger)", "value": "96c2dffd4d89c71d4dfd219132e7318e8f6d4dc70d319c9ae0b539bb396709cb2b36535aca46dfdca3b6f1ee1d37abed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671182253, "uuid": "b5a8069f-3175-422a-977d-01638b2f860f", "value": "T16C15123C8AE81E3AE1B1C1F4DBD08A57B41A9C1A71855C6952D337EA03BAD52718F03F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671182253, "uuid": "2d67d6d4-335e-4788-81f9-7e90f3777265", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671182253, "uuid": "c26dcebe-aeef-464a-9ba3-2e523e9fe743", "value": "12288:Rw2iNdgh/9aMsQmbDRCmhu7Xy0H2I/WjG+:O1Pgh/QMsbEmhYXtH2I/Wi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671182253, "uuid": "acb7a27b-032c-4c85-96f2-ca3521dc10f4", "value": 902144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671182253, "uuid": "07b27667-1e00-43c0-9db2-a250e682dc0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671182253, "uuid": "4823c1f2-38f7-444f-a67f-31a5d8bf25d5", "value": "payment receipt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23d503f9-7cf2-11ed-9db1-42010a9c0080", "comment": "Malware payload (RedLineStealer)", "timestamp": 1671161494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671161494, "uuid": "bbedb57b-5c15-4235-af94-1f23a0d1e9ad", "comment": "Malware payload (RedLineStealer)", "value": "1f9f631dd0465684b40f6d5f83e6489c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671161494, "uuid": "fcef40fc-3a3f-4bca-97c1-8b699aa27707", "comment": "Malware payload (RedLineStealer)", "value": "b88d2e637d74c4c2a0fc103a8972adb5a937e3d5f00bdff914e2cf627d74bef4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671161494, "uuid": "035f6245-edfb-42a5-b091-22260317c5d6", "comment": "Malware payload (RedLineStealer)", "value": "358dd2275b690faf036e636af7748f06cefb9199", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671161494, "uuid": "295398e0-ea2f-4fcf-a337-7df716acde47", "comment": "Malware payload (RedLineStealer)", "value": "f345fec33827abade2e5fd02b75e88a763ece464cdce4df272a7fcdfe891711ca047efcf58d2c40fceb9b281cdebc0cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671161494, "uuid": "7f5b7dc9-4903-4390-acef-fe42a75433f6", "value": "T11794E0217AB3D4E1F832CA314816EFF465E9B860E5A1D53337DAD71F9D702938A26309", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671161494, "uuid": "f638a556-ad52-4573-9ab7-6c237764f491", "value": "2067eb05796787c0f2b3dc09403197ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671161494, "uuid": "9c176462-6970-48e1-acd4-54a55b1c7960", "value": "12288:BytTdAnSN3lKwBLsfG/9uYxnzpQ6ijqF:B6dQSN8qYO1uMzK6Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671161494, "uuid": "5bc46674-bc6e-4f80-b2a9-7de69ee21d05", "value": 443904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671161494, "uuid": "c157eab6-800e-4efc-82e3-c448853ce7aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671161494, "uuid": "ac9dd116-9e4f-437b-8c9d-e08935617dd1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaa69861-7cef-11ed-9db1-42010a9c0080", "comment": "Malware payload (GCleaner)", "timestamp": 1671160539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671160539, "uuid": "ccc40935-312c-4aee-b8c3-ca84cf8b0f94", "comment": "Malware payload (GCleaner)", "value": "0c2e8d74a5db0d180de6c674035dd020", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671160539, "uuid": "656e61e2-3267-4191-87d9-85d71877c520", "comment": "Malware payload (GCleaner)", "value": "b8dae8f3a780f035fce473a31937dc556e95bbeb1055b2d02a09c0dd893fe0f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671160539, "uuid": "a56a6b81-f73b-4578-9311-9c0e4c4424cf", "comment": "Malware payload (GCleaner)", "value": "2c5ee63431e5ed06096617bdc57faf2202bdd733", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671160539, "uuid": "746c42ec-116f-4753-b5c1-6f741fc83171", "comment": "Malware payload (GCleaner)", "value": "48984c5127d68ac082a7a5b5b3feba656694c833428be7ca89ebf6fe6d03b351c7e8a71639e89c255e6a35ec0a4a1377", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671160539, "uuid": "bc8ddebc-4744-412e-8705-fe667c76eb23", "value": "T149B523BFA4880976D1F756F878A69C7145F3AEA33821D50E23A47FAF77F28C00812556", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671160539, "uuid": "b668babd-9738-47e1-bd5e-630c604a2173", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671160539, "uuid": "5c81313d-6042-4084-8897-71562af87df5", "value": "49152:Epj/5gE953wNpKlExRt1mLvGzfmQaM9eOCgSY/imj:EpKE/AfKaxRuTGrmPM9cY/imj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671160539, "uuid": "1c412c02-b4b0-4616-b1ef-fcf8d8729109", "value": 2389103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671160539, "uuid": "5cc6e22a-888f-4925-93aa-146946e48963", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671160539, "uuid": "bca1f874-2f55-4854-a851-749d16bfcad0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ff86181-7d0f-11ed-9db1-42010a9c0080", "comment": "Malware payload (RedLineStealer)", "timestamp": 1671174104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671174104, "uuid": "89052ca9-8e9e-43d2-85a6-bd64911a6c6a", "comment": "Malware payload (RedLineStealer)", "value": "901a9f3a1d7f4b55613068c817f6b05e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671174104, "uuid": "780c72a6-81e6-448c-b6d2-b39022bd9ca1", "comment": "Malware payload (RedLineStealer)", "value": "b8eadf4a68dbc68f2c2d811450e11443fa9766e9305ff37bdbc143c8ed8900b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671174104, "uuid": "64cb1ee1-5116-47cf-896e-c338c7b009a9", "comment": "Malware payload (RedLineStealer)", "value": "763d7d2487cdcf36855ddf3403fe3c3aaf352f0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671174104, "uuid": "c1edf1c9-7c16-424e-b9f3-2855accf3968", "comment": "Malware payload (RedLineStealer)", "value": "4b2808b4dc89682ec0692c656dc8e2206d1602091cc4b544b46ef9319dee734470a5c5e5cc3d8dc7c0a6de653702a125", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671174104, "uuid": "2e4dda48-686c-49b3-a00f-fe0a5df9239e", "value": "T11274F1117271C0B2C19F1534DDADD7E05ABEF9308971560773752FAF2E30AA0A97A34A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671174104, "uuid": "42d26d54-91cf-442b-a6e7-b41ed4d6e386", "value": "b35462da489bc13bae884e55b5227599", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671174104, "uuid": "5aecbb80-68eb-4b33-ac62-ebddad5e2093", "value": "6144:FHkpLN9dknqRnr1e4cc22jE0IKhhtCOmytZFzDfjPwa7D0GnTts9N8qMrc:FHkpHd6onr1e4cctjbj2OmytZFzPYakC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671174104, "uuid": "ad9ec343-3441-4aee-a470-0924e23aea91", "value": 355328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671174104, "uuid": "18c11b20-c9f0-40a0-9ed6-3a0b993e9adf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671174104, "uuid": "8d2b8134-05df-4c8b-aa7a-3297ea0b452b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4a45fc8-7d47-11ed-9db1-42010a9c0080", "comment": "Malware payload (Amadey)", "timestamp": 1671198244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671198244, "uuid": "2efb5073-3347-4a3d-947e-288af1e753c7", "comment": "Malware payload (Amadey)", "value": "a9d276321bd4c7c7960bc9eb0142ff71", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671198244, "uuid": "a985c5fc-a035-4317-858f-e62a79a5c403", "comment": "Malware payload (Amadey)", "value": "b9876958a1a59f4089fb41782ea64478aae57d1adc00e0f9d2c34434a14ba606", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671198244, "uuid": "e7d5fcaa-623e-4dd7-8757-a0597f9cd1af", "comment": "Malware payload (Amadey)", "value": "07389f1ac787f87c42b6b0baba819898df8929e9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671198244, "uuid": "cdb875f4-dec0-4c4b-b84f-dbb07dcb4e40", "comment": "Malware payload (Amadey)", "value": "dc3ca9314d2a6ba724fc35f543ad45b1ff5850930dabf94606ab2075835877d5cc5543116f7319a2b5a5a3bc3ef8aa89", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671198244, "uuid": "87681864-0a0d-4821-8627-906f5ebb6a87", "value": "T17954D0F072B0E03ED1A2C730491896E4A66ABC145E6296F32F44BA5F1E702D165FE37D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671198244, "uuid": "0d1483a4-592e-4927-a693-09a745272310", "value": "2cc3e4b8a374ca30888470c0a531eceb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671198244, "uuid": "6dfdaf6a-14f8-4cb6-bef3-ae5f4b3c4488", "value": "6144:jeLi6IJG5nWGm2CgsmlWc1Lgztr40M2b:jehIQnWgjZ0c2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671198244, "uuid": "58fed1db-d712-434c-80d6-34e9d1df4630", "value": 280576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671198244, "uuid": "c7463c78-adc5-44c6-af2c-b5c4c8019733", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671198244, "uuid": "011201bc-dd74-4aae-8284-59af0c97482a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94e05cca-7d6d-11ed-9db1-42010a9c0080", "comment": "Malware payload (GCleaner)", "timestamp": 1671214512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671214512, "uuid": "08fd23dc-69af-4f35-9af1-5632b7c40455", "comment": "Malware payload (GCleaner)", "value": "614bdbc6cec5309f074a1422af55165c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671214512, "uuid": "0be33ac2-63f0-4084-bf23-257e0eee34a0", "comment": "Malware payload (GCleaner)", "value": "ba2e58606a2d26657642cf0c91f3dfa07e93b2b0e9f7e6fca684effa0de5db2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671214512, "uuid": "3093c8af-2032-4049-93b9-0ff932b8486f", "comment": "Malware payload (GCleaner)", "value": "ce7f0ca17d29f53893351b1440b733890c127b29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671214512, "uuid": "a0637606-573d-43a4-b559-3fc25ace568f", "comment": "Malware payload (GCleaner)", "value": "6049e91d2cc59cf099ddae9ce77b4a2d25b6cd1c92bf45cf45b74774aa316a6fe0abf87a844e6ad49c19e5fccb5808f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671214512, "uuid": "bf167b4e-a7be-4ab5-8281-087e05e3872c", "value": "T119C523BEE85450A5C4B70AF43832DC2181E67D1B2A28D5DEBF987F4B37F69C09913216", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671214512, "uuid": "66b191a5-c69e-4920-b9cd-d99b9fa8b5d6", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671214512, "uuid": "2c2ecb17-dc24-442b-bb86-775f7b459364", "value": "49152:0p35q8eQ3iX/AE1K9tSKPDUXTXYzhBo5o05yg8hI8ez1ArtwNSeeOCgSY/imR:0p35om6debPyzcP0Ojezut/ecY/imR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671214512, "uuid": "51ad8aba-46e9-4b11-a018-d57221cba4f1", "value": 2548456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671214512, "uuid": "f433b10f-107d-44f9-9368-4e66a1284a45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671214512, "uuid": "b01dc23c-fbb7-4bdd-9bc0-2b90bb5ba489", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7153a37a-7d65-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671211016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671211016, "uuid": "44e85472-93f3-4890-a04b-6379b1085d45", "comment": "Malware payload", "value": "0875b50d2f4f73f1bbe4449ab3ea050c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671211016, "uuid": "b79c7fef-c9b8-43f5-bb8c-6f1a68a48a2f", "comment": "Malware payload", "value": "bb4271ea8a221a6b5fcdb1106cac0c14cd0b7e9942b8ed738489b1ce73fdb38c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671211016, "uuid": "d3ed8811-30c4-4d2c-bc3f-db5a5200bce8", "comment": "Malware payload", "value": "d7d41ecee22a439a73145fc6b798d00a27f0688c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671211016, "uuid": "da89a4ee-3e62-41af-b3f9-98807bea2585", "comment": "Malware payload", "value": "f5ddc472b65993e1789fc4f40a196efb3973fdc06c2f68297ce8f09f8933f3e506e4c9e68b9449f2aae781af9062239a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671211016, "uuid": "1ca4cc91-adfa-4411-a81e-0bd6770fe51c", "value": "T106B5237EA19015B1D0F746F53C328D204AD6BE6F6A24C88E37987E9BB3F74C1490B51A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671211016, "uuid": "6ff510e6-97ac-458b-897f-788368dd6d68", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671211016, "uuid": "a4622c25-274a-41fb-b21a-9d93e01f5162", "value": "49152:kp+eFNX7Xlpi8wzUVoo4UzhY6+R15nUiiG+5klhOq6U9PeOCgSY/imd:kphx6zoN97un4G+5k96gcY/imd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671211016, "uuid": "79599e23-7baa-4d52-bfa1-1c4b42bd9aeb", "value": 2391252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671211016, "uuid": "aad6567a-6eff-44e7-a415-b820e752eec3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671211016, "uuid": "27da2956-d5c5-4928-aa80-9bb01a915c52", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c56e909d-7d1b-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671179374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671179374, "uuid": "4856f1d1-bac1-4fba-9234-b9a0371a641a", "comment": "Malware payload", "value": "9adf784f7e2611827a25381bc3bbd8e5", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671179374, "uuid": "81c8e916-78c8-4eed-9ed7-3145bc2d7aaf", "comment": "Malware payload", "value": "bbb1e3b7d7ece2fdbe31ea96cdfd10169f4836f9719d8997a1feaa9268772f00", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671179374, "uuid": "7af16230-26c3-43eb-a4c8-b599896f5d97", "comment": "Malware payload", "value": "3e1e929ff41533f4f3a6b08ed3907904418362f2", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671179374, "uuid": "b5e51f57-1fa5-4063-bba6-bd3751bef185", "comment": "Malware payload", "value": "1588ac9d6f6fc2db307ccbbead21aaf4ae5628a49ab195e8026256a683b68210797003c48a08ccda51d64cca5491f0f3", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671179374, "uuid": "c25074ce-b075-4de3-96ac-0180a5a333ea", "value": "T1B5F533A9DE009341E64CBC7B2833AA29E9214F7EFD46962D57E039D221BDCF159360C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671179374, "uuid": "0eafddaf-3656-48e0-9efe-37b14f243dc5", "value": "98304:Ar5jfGjBQ/3ko2E/mUS6IsTytcwHHbvai:ArRee/EEeUS6PT2jN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671179374, "uuid": "a41f5f3a-8c97-432b-b517-47634d4cde89", "value": 3512146, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671179374, "uuid": "0692ef41-6043-4cc7-a043-5cc2b655551e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671179374, "uuid": "759147bb-1f6a-410c-a044-fa2cab42bd11", "value": "Intimac\u0327a\u0303o_Judicial.P88kyvLsuX3OVN.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a682470-7ce1-11ed-9db1-42010a9c0080", "comment": "Malware payload (RedLineStealer)", "timestamp": 1671154311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671154311, "uuid": "b05c7154-8406-42f7-8145-d61acbebfbb6", "comment": "Malware payload (RedLineStealer)", "value": "c8a9c7fbbe7a9aa2585f9870b24c83fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671154311, "uuid": "eb2f383e-08a0-4824-8735-2f16747cff68", "comment": "Malware payload (RedLineStealer)", "value": "bd7537adfa99f79d22a08cb7e1b5cc4c2d4583e353ae09e23b7f1325c99f7847", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671154311, "uuid": "2c312783-0070-445d-b03f-68404693c7d5", "comment": "Malware payload (RedLineStealer)", "value": "6a87af8246dbaf17732d4247ed20d47c883e1424", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671154311, "uuid": "a80bbc79-5713-4d56-b88b-c99fce5f6b0d", "comment": "Malware payload (RedLineStealer)", "value": "40800f9b302abd777fdafc4afe680b2744a56d4674a76b3141b2dc891e7fa5567199ea57530302ea8fc121ee1857622d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671154311, "uuid": "697bd2c6-1165-4904-ab63-9c28d15e8406", "value": "T14594E1107AB3D4E1F972C5304916E7F4E969B861BAE1E5333319EF0FEA70253896A305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671154311, "uuid": "0cbd60a7-80b1-4cca-8728-887a248ae8bc", "value": "2067eb05796787c0f2b3dc09403197ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671154311, "uuid": "30de7606-cfc4-407b-880b-28803419893d", "value": "12288:JTkUw/jz92FxiDQ7MUgyM1/sxnzpQ6ijqF:Jrw/jz9QAvUgrozK6Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671154311, "uuid": "488656ea-8c72-4fc7-abd5-81212a1eb754", "value": 443392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671154311, "uuid": "3295ce46-a4b2-4b4a-bb1d-f8164b139e85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671154311, "uuid": "bd08e3e7-cea3-4f96-b833-354445a30963", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5255df7-7d41-11ed-9db1-42010a9c0080", "comment": "Malware payload (Formbook)", "timestamp": 1671195748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671195748, "uuid": "32b1a5ed-f34f-411e-980f-b5d47f8f2792", "comment": "Malware payload (Formbook)", "value": "110f69d363cea079d6d0bdeff1bb838f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671195748, "uuid": "81fa63c5-6ddf-4fd5-bb69-fd2e8c1ee30e", "comment": "Malware payload (Formbook)", "value": "bdee6d7a7e7cc141bdb3fc0997cbb07b1a85016e23fd74eec044a5ca52ae5052", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671195748, "uuid": "cca370f1-6566-4924-8738-8dd0ff57d403", "comment": "Malware payload (Formbook)", "value": "324be5674ea782a4eaf68b51b87fc61b0f894044", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671195748, "uuid": "cc08d7b3-5b2a-452f-8fac-b78ba3ddf783", "comment": "Malware payload (Formbook)", "value": "9c79420ac100be812e756df65d731908e25bbf97add84b069349ebf44dace799b99a3ca0d4215cc4fdb44be4ce157987", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671195748, "uuid": "08413311-d1dc-4744-9c84-631247425d1e", "value": "T1755412A935D2E4EBE8816A3685372A3D53F3F6114866154FFF481F360E524CE886D2F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671195748, "uuid": "d9a05729-c046-4030-8608-2386ffe4b839", "value": "97318da386948415d08cef4a9006d669", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671195748, "uuid": "156dc9bf-b4f2-438c-8f44-a1d1a1d36686", "value": "6144:9kw24wUoB7N3lbNKRmqdtK1jdACBqE5ObP8l5i:S4wU6N3xZq/2pAiqE5OkQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671195748, "uuid": "3d3b028b-0ac9-43ed-afe8-dcff87f6e29e", "value": 278939, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671195748, "uuid": "6a45aed7-d294-4d63-ba67-1bb2be6ec8ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671195748, "uuid": "bf5fc7b5-87b5-415c-89bb-292acd5f3552", "value": "Outstanding SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51beba04-7cec-11ed-9db1-42010a9c0080", "comment": "Malware payload (Amadey)", "timestamp": 1671158994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671158994, "uuid": "8de6ea1e-82c6-4e78-be20-999049bafc9d", "comment": "Malware payload (Amadey)", "value": "1bba5002e7ccd280dcb62cf532c28665", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671158994, "uuid": "0f8fa146-a729-4500-82f4-aac24c123539", "comment": "Malware payload (Amadey)", "value": "bdfbe35dc850b536e93577067a6e79f2148691d81d41096f999584f450c24e58", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671158994, "uuid": "ce5fe564-a894-4426-9e5d-ea6e9b845b52", "comment": "Malware payload (Amadey)", "value": "69b8d2d4c9508e983785157c5dcc4b2c74b7633c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671158994, "uuid": "64b0d8bf-366a-4821-9eb0-312d1530fd59", "comment": "Malware payload (Amadey)", "value": "e9ec92817bfecda828318ae96ce11b36b675047b99392069314610d264771b7ae387ace8c56a1c825087104e9c7c674e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671158994, "uuid": "7dd71afa-7e76-47ed-8678-0b90517f666a", "value": "T19984D0107A7394E1F832C6754A26FBF4266DB811F9A1D637330AD71FED702938A66305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671158994, "uuid": "c3eca812-e955-4eec-ac01-362635f2eb17", "value": "2067eb05796787c0f2b3dc09403197ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671158994, "uuid": "5e2f8a1a-a60e-47f8-a408-3b496408fc80", "value": "6144:aOYFvvLb3GTIHXxSJhUFPZSSf5OrpJ4QGKmI55py0iPvzpQ6ijLxQFiaI:iXnGTkX8qPZ5l7Kmq5sxnzpQ6ijqF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671158994, "uuid": "055268f4-ef37-4355-b3fe-92fe735a2aef", "value": 382464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671158994, "uuid": "8c7b7f96-e74c-4a31-8947-314cb31cb5e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671158994, "uuid": "d9e35d34-17b1-4a02-ab6f-95f9c21f922e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7fef4ea-7d25-11ed-9db1-42010a9c0080", "comment": "Malware payload (Amadey)", "timestamp": 1671183754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671183754, "uuid": "b2456671-68e0-4ca3-8dcb-b9f33f60249c", "comment": "Malware payload (Amadey)", "value": "140906919562dd8fd953798145d6dbd6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671183754, "uuid": "749cbc58-3846-47d6-98d3-d58a6d2148e8", "comment": "Malware payload (Amadey)", "value": "be3d6933a41ef79dde37fc41546cabf8ecea067a2f19ba62f79586234bc23750", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671183754, "uuid": "c28e5f41-d2d3-4560-a1c4-61e09324b40f", "comment": "Malware payload (Amadey)", "value": "e11024c1a2e9f5c742f79e3d4596109963e52ba5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671183754, "uuid": "627211ea-f997-4b14-a6fe-2e611fb2357b", "comment": "Malware payload (Amadey)", "value": "b301a531713439cdc09cbf9f4e72fd2dd251d557a331c3f438c10a542ec0daf2a95b04688539020cc8de3d86ff50c517", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671183754, "uuid": "274ce240-8441-4998-94f5-499794dc28e8", "value": "T1F554F121B6A0C4B1C15F05708C6AE6E45A7EEC324AB0D607777536AF7E30A91627B3CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671183754, "uuid": "6a09f401-6c31-412f-9c1c-bf0fc06cd23a", "value": "b35462da489bc13bae884e55b5227599", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671183754, "uuid": "36aa30cf-9267-453d-b02b-8946a7467213", "value": "6144:l0kALASoF3U+SPwdtgbP7gb0j9JCgktZJv8qMrc:l0kAMS8k+VKPlTCgkrJv8n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671183754, "uuid": "45834f65-c7c6-4d79-8c64-8d9bb9a9d5f9", "value": 293376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671183754, "uuid": "5649f595-818a-45c2-b457-eb5f5e07127f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671183754, "uuid": "cfd33eb6-7155-4e73-a278-f57f6a227c6a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22a4ef1f-7cdb-11ed-9db1-42010a9c0080", "comment": "Malware payload (GCleaner)", "timestamp": 1671151613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671151613, "uuid": "99dbbf8b-f3e8-43e4-9e3b-7a2575574962", "comment": "Malware payload (GCleaner)", "value": "3767d1024552c6c6c43d6fc5b25c0a11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671151613, "uuid": "a706e3da-643b-4bfe-8a38-751d230b69ea", "comment": "Malware payload (GCleaner)", "value": "bf867c7fc90c4e20667a5a24607cf9378065c1a3517bcc7d50309d5205f64a6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671151613, "uuid": "c48ad2cd-5542-4739-943c-697384f93676", "comment": "Malware payload (GCleaner)", "value": "54825093c84516fc1b9f91ca4f3d0901fa0ff30a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671151613, "uuid": "79ab0025-bdac-45bf-8f4a-5fa4b24c8f8d", "comment": "Malware payload (GCleaner)", "value": "85dc685af7450ef6e45cc62b7bff71134069e3d7d7fca369ef24d1b41ae3f5ffd11c6b25faf8493393855f0d25ce975c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671151613, "uuid": "43eb33ee-e16c-4f05-8f3d-f2c8df8f5896", "value": "T1BDB523D3FA808674D8A9C7B28A15A44D5B63FE7FD854D28E30E8376E0D71182D413B9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671151613, "uuid": "76b509c6-dc68-4b2d-9d87-da80eb49336f", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671151613, "uuid": "cc85e978-e250-4b15-98eb-030d2b0d81ed", "value": "49152:UNur/8SpVXa41jOY0NZyOwMZGm/b4EloQUKyQT02hWs+fxjrMAeeOCgSY/x:UNy/8SpkFzz9wID/c+oQx02adrdecY/x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671151613, "uuid": "e58ddd82-4670-40c4-aace-402cbaafef0a", "value": 2350402, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671151613, "uuid": "f5968929-b295-4523-a3f8-000cbdc22684", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671151613, "uuid": "c6a35288-3dca-4b81-bdd4-13e7f2e7f00e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18ff003e-7d61-11ed-9db1-42010a9c0080", "comment": "Malware payload (GCleaner)", "timestamp": 1671209150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671209150, "uuid": "2163dc97-cff4-42bb-8b51-95373346b94b", "comment": "Malware payload (GCleaner)", "value": "eb6522f897daa4b5f205b3095fbba9c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671209150, "uuid": "2661aa13-71ec-4c95-8404-b99b22547ae9", "comment": "Malware payload (GCleaner)", "value": "bff939648dfb3a9e20d20ce04f6f9e4dbdbc0bb96b6147b5a4a301cce28ec80e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671209150, "uuid": "f009aa38-9b7e-4cc4-b6ec-9c4a48d7a2ec", "comment": "Malware payload (GCleaner)", "value": "26e9fbb8117b8191924cd212d074218e17e9f142", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671209150, "uuid": "be4c0bb1-0bdb-4d4e-856e-38f18c18eafa", "comment": "Malware payload (GCleaner)", "value": "21503b7c36454eed9c9a88dd1f1743fe39d43f9aa5c519a50fd298d51def366a3bfe96f77696bb0a191c9148fe65de48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671209150, "uuid": "b2f1692e-7b63-41be-91e2-670f9cc09d49", "value": "T18FB5237EB2910471C0B356F93C214C7160E66C2B2D39CA9D37AC7F9B7AF79E0491660A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671209150, "uuid": "f16f3d8d-4966-43e6-9287-8a76db0df7e8", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671209150, "uuid": "6f0742c7-eea1-4049-9117-82b879889ec7", "value": "49152:UpJWOSa0TcCW3QNh9dR4kSWjBaDRnN0jcyddQDZ74h4dAP66RXeOCgSY/imF:UpD0hWeP0WjcDX0AKdQDZ7WYyRXcY/iY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671209150, "uuid": "45eaa2c2-76ab-4c31-90b4-59cffe6d47f3", "value": 2432426, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671209150, "uuid": "8db1067b-295c-4c7c-9be3-77a9ed634dae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671209150, "uuid": "28c70dbe-8288-4ba4-962a-f0b715ff50ce", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c892c6e3-7d3c-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671193553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671193553, "uuid": "fff871ce-9cf6-463f-bbd9-350fb530a63d", "comment": "Malware payload", "value": "94291b52692122ab90b75b90707ca062", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671193553, "uuid": "f547f49a-2074-4c4a-86cf-bb6b8416ab9d", "comment": "Malware payload", "value": "c0178dc0e1f125da7b6bab419edc783fdff63a376019140e086e6bc10ec588bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671193553, "uuid": "8aaf8b0d-41f7-4b3f-aad2-4f18a27a2b28", "comment": "Malware payload", "value": "4ef14839102959f7b63b2988379f3aa0408c6cc4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671193553, "uuid": "a1381c53-c7f7-4cfb-b831-f13bdcdb7240", "comment": "Malware payload", "value": "a5b320bbce7f08b9f67cf09f8592d13dd6d901f465138c22019306fe535b4ab17db2ae867feb4aea4abc70efa076b20c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671193553, "uuid": "17abdf09-9309-4c1b-a416-04a8e6a4184d", "value": "T15E55E1BA1F52A129CF2A1AFDAAA68F00B71FEF001EFD3D3136B54F8D9751444942A345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671193553, "uuid": "262092e9-071d-4ceb-9ffa-bc7db220abf9", "value": "21b6a4e9054e8bbad032c11f147ef0f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671193553, "uuid": "724bf3ed-4d8c-46b9-9a02-22a5c924aa73", "value": "24576:Nul96k3/hS8anVFj9vMzQo3SSH3PujZCg7EuRsQ8rRs8FN/MvV18fkWf:H18aVFj9vRo3vHfIUgTRsQ8rK8LktGss", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671193553, "uuid": "376017b8-b560-47d9-9ab7-965cebc0066d", "value": 1359272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671193553, "uuid": "8e17f4ee-4f40-410f-be5b-720b8b01cdc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671193553, "uuid": "c4d588c7-5418-4755-9c13-090ea78c68b9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2f796cd-7d20-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671181598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671181598, "uuid": "a21310d6-5099-475e-a80e-bcf0504735e9", "comment": "Malware payload (Smoke Loader)", "value": "2c311b935448494d354aba102474dc34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671181598, "uuid": "a97d9b70-466d-4910-9f4b-204d85343dd7", "comment": "Malware payload (Smoke Loader)", "value": "c07b420bcde2a315efb3340537ef6944bfdf559c6750956f5decdaa4d91b6340", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671181598, "uuid": "63453fbc-5eeb-42a3-aa5b-2f5a5d41307a", "comment": "Malware payload (Smoke Loader)", "value": "00df5524e830def97832a1f2d806a7cdbc3e11b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671181598, "uuid": "45fb5244-b5fe-44be-8319-7baf9be78e38", "comment": "Malware payload (Smoke Loader)", "value": "5feaaf9e9e5405dc5f69cdf144fcb048a0889c18ef413f294f14df98063f8ff60aafc4db21d42a855541e9ad09f9fd21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671181598, "uuid": "2260940e-213d-43d0-a825-2497ff5d5c5d", "value": "T11F34E0117270C4B1C1AF0530886ACBE05E6EF9318AB1E643377527AF7E30A596A7E74D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671181598, "uuid": "e4df38ab-d245-4b59-8d1d-d79966636e94", "value": "b35462da489bc13bae884e55b5227599", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671181598, "uuid": "52aaab4e-14a7-423a-9227-d5e59de1638a", "value": "3072:YZKkytJ3LSEw0FMucRfJskKWoGrxtCG9GwLQ2mppGT8ng4307HtWqMPDcfuh:6Kk4LSEw0m/oipstP10z8qMrc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671181598, "uuid": "d564d858-daff-49db-8951-75331ea2a050", "value": 232960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671181598, "uuid": "fd31ddfb-7c28-4a11-a7ac-b47621ee4380", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671181598, "uuid": "11291e38-2790-4006-9154-5e69095ac706", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1feddd6c-7cf6-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671163205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671163205, "uuid": "70648092-8727-4dee-96d3-a8b43cded589", "comment": "Malware payload", "value": "3ef91735e8134fc4d087860a2f8671a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671163205, "uuid": "f55b5c69-e5c2-43a4-9218-aeff22d8d5cd", "comment": "Malware payload", "value": "c07f25fbb23fe1ca7a379490d4f9867812c0b148d5d32a243ede3f494da7928e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671163205, "uuid": "65c4ec3e-9bde-4705-8529-9f72cadd7f16", "comment": "Malware payload", "value": "a74268cf92aeeca919d1e060c953f3219f53e00c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671163205, "uuid": "0e9a16be-58e0-41f8-b3a0-4ba06670b705", "comment": "Malware payload", "value": "7ce4eb8c1d2ad1e6500872eff64dde376e2356ccf30a8373087583614fd7770cddeedc923fa7a62b69de8a436b3fe38f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671163205, "uuid": "c6061cf6-9395-4a76-9073-38e7b3bd47ff", "value": "T14532C61675B2C9B3D8B6C774A8948882AA0B153553F1C4010F3C55ADEF233E55B7B717", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671163205, "uuid": "e2f21fc8-9ac5-485a-8e3c-8ede957bb468", "value": "192:Ay9tncnnnnnnnnnnh/Kmk8puFCgjU1lUjXMOy2l5oMEd+:Ay9AFDpuFCSUvUAda", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671163205, "uuid": "23154975-9ac3-4062-8d1c-16c55cb3eee8", "value": 11944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671163205, "uuid": "59d39fa4-c079-4b8a-8446-d9bc2a71df20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671163205, "uuid": "197e6336-a911-462f-9afb-a6992bca5eb3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de234f53-7d49-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671199173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671199173, "uuid": "8a90c211-0cba-4aa5-904a-0eeed3eeeca7", "comment": "Malware payload", "value": "4c08f7148c5c81fcdd0cbfc70e76420f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671199173, "uuid": "3262ad82-73b0-452b-bc0b-2d140ade99ff", "comment": "Malware payload", "value": "c213b1b84aa2abd2ea830352b37c2d98fc0fd5f7125a35720c7cb477859a8d2b", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671199173, "uuid": "e8b20d56-085a-4868-91ea-16761b69be6f", "comment": "Malware payload", "value": "4746a2d1587aad5d18079601255203210c2b99ec", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671199173, "uuid": "5a652c39-770e-4784-a472-3266c1db4ac1", "comment": "Malware payload", "value": "782baa3bd85f09c9b961ca0aa41913fde72e32c158e56ab5fe367c7c6f8aaa58dd788cd2f5f6b12fcaff41e3a2e5da45", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671199173, "uuid": "8a01958a-a8c0-43bd-b6ba-8ad64d29f4ba", "value": "T1B042AF79E30AF81DC0AAA57DA84BE1E4F648D3C38311F61E5051E29D4FC098747D5ACA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671199173, "uuid": "7d022d09-9395-4273-bc66-12a6395f20d5", "value": "192:ScIMmtPwRmPZNUzXX2m5bv/0rrf+icu2ct2H7Sg9knE6j4IA:SPXfUzXJAr2iczoT4IA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671199173, "uuid": "5cc86e0b-3369-47ce-8ffc-07bc335a041c", "value": 12716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671199173, "uuid": "9d53871b-58ea-40e7-ae33-8ea6f9102544", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671199173, "uuid": "164c50a1-7042-45e7-88f3-4536d8e103d8", "value": "\u0648\u0632\u0627\u0631\u0629 \u0627\u0644\u062e\u0627\u0631\u062c\u064a\u0629 \u0627\u0644\u0623\u0645\u0631\u064a\u0643\u064a\u0629.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b863462-7d6f-11ed-9db1-42010a9c0080", "comment": "Malware payload (Tofsee)", "timestamp": 1671215382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671215382, "uuid": "d2214e3b-8486-4811-b7c8-17ee00f1106d", "comment": "Malware payload (Tofsee)", "value": "31d5592f1627d5c5f133a440001e9acb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671215382, "uuid": "344895bd-e493-4433-b155-bd2fe02c55be", "comment": "Malware payload (Tofsee)", "value": "c310bcffb9147595faf00f7bfe71ebf3fc64027258e7ae643eca87e3f072ced1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671215382, "uuid": "baa8cf74-0721-408a-adb5-c24d03269c52", "comment": "Malware payload (Tofsee)", "value": "9d302c00bc8dc45a3ee7d47234e8b68444c15a72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671215382, "uuid": "8fece5b9-91e9-4caf-8ef3-a226c76dafd0", "comment": "Malware payload (Tofsee)", "value": "18a1e911ac4982136f7188da9f75db239cfd507158a49d940b82e06e6f65d4e63525ef00c59130beed66b752589386dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671215382, "uuid": "3684f0f8-29aa-41a5-8b9c-7789b1797782", "value": "T1B024CEF566B0E46EC115D7308C25DBE89A2ABC105E2199F32B18362F1E716C056FE37E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671215382, "uuid": "d0fbbd99-ee6e-4c1a-a1c7-6495a51ee2c3", "value": "3670997c8c2669588bad5b8c178dedd4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671215382, "uuid": "0ccac25f-39e9-4163-bd2a-81cf94219e26", "value": "3072:0ws4u8Larfv0RSaUNyzrXXNOau1LszvT1l2I840zwUzQRKF+:zNL+f3aUkzrXXNOv1gzb1l2X40M2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671215382, "uuid": "7ae3e725-1445-4194-94cf-723c79840e1d", "value": 219136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671215382, "uuid": "ae94772e-be8f-4a4d-9305-7e9135f0ae8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671215382, "uuid": "0af4067a-d085-484e-9cfe-80b56fb80255", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "752edfde-7d15-11ed-9db1-42010a9c0080", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1671176663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671176663, "uuid": "8a64a66b-3fd0-4092-82bf-4c61d3d65e23", "comment": "Malware payload (SnakeKeylogger)", "value": "b23aaf4a662a6b78ee16a4d2f5b4b138", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671176663, "uuid": "a6ee4793-2cf1-46b0-ab6a-630c9799eb12", "comment": "Malware payload (SnakeKeylogger)", "value": "c432e247154bd0feba7a647428f74d41d9742421d09ba59413a2365d4ddc7066", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671176663, "uuid": "9b2bb1ea-6677-45a2-8cb1-34a644c1b4ed", "comment": "Malware payload (SnakeKeylogger)", "value": "f299ad8141e6ca81de7c0555bf5af7d84b3f0950", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671176663, "uuid": "a27e1a58-a24d-499a-a07d-820ff7b40aa3", "comment": "Malware payload (SnakeKeylogger)", "value": "16d5bc6945cf0772873c90f9212ae9cb74fe3f447a9680ed2ebb5f1c76c2a00aecdaa033870f3f5ad6d49e68c86218a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671176663, "uuid": "aea13e7a-af6d-4aca-9766-9ca6db5884c5", "value": "T1BAA4BF11364CA322E8782B709399BBD1037F9ED176F6E98DE99E34D60770B907806E17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671176663, "uuid": "0b261770-a461-4778-a488-d86d5fc8008a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671176663, "uuid": "21f905e1-be41-4b7b-baa7-58724370993e", "value": "12288:zFHkwMAQvsg2a6JFSbzcH449+tBz/Uh4tGfNYI:zFHJMzMFmzYSBe48", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671176663, "uuid": "d5638424-9000-44b9-af09-cf457e2b646f", "value": 485888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671176663, "uuid": "f2816240-fc02-48c8-ad2a-eb2d422e8f94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671176663, "uuid": "14cf776c-f956-4937-9fca-6d8a5c7225e2", "value": "payment copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26bddbb3-7d39-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671191993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671191993, "uuid": "9f98f107-77f4-490e-b8c5-455f6f88bb8f", "comment": "Malware payload", "value": "1681dc7e3d638e243a27d9000d9d67e8", "object_relation": "md5", "Tag": [ { "name": "fakecrack", "colour": "#E25CDD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-1919", "colour": "#44128F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "side-soft-com", "colour": "#D2FB64", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671191993, "uuid": "c5e961a6-d588-4901-8a8a-265f97ea0083", "comment": "Malware payload", "value": "c4640d35eb441b5a327ed874afab4670a1b781c37cc318b3791a7bb4c432c501", "object_relation": "sha256", "Tag": [ { "name": "fakecrack", "colour": "#E25CDD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-1919", "colour": "#44128F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "side-soft-com", "colour": "#D2FB64", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671191993, "uuid": "f865306a-6f1d-4e51-af83-c21a3704ff39", "comment": "Malware payload", "value": "d3c24f40531f509e441a3568048dbe4d4b055ff8", "object_relation": "sha1", "Tag": [ { "name": "fakecrack", "colour": "#E25CDD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-1919", "colour": "#44128F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "side-soft-com", "colour": "#D2FB64", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671191993, "uuid": "a7828649-3fb2-48c3-a7ef-ac0033a7c34a", "comment": "Malware payload", "value": "3bba12fffc031b419b4abe4d2ba559b5d1692d18523973da14e13380d2be07afd91bc4b8b7d6fef6fa07e256c40a4f3d", "object_relation": "sha3-384", "Tag": [ { "name": "fakecrack", "colour": "#E25CDD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-1919", "colour": "#44128F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "side-soft-com", "colour": "#D2FB64", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671191993, "uuid": "a9602410-4072-4fa5-be51-2ef82200575c", "value": "T1E254236990B092841751BB6CC7B271D38B7E9F9D7E2642112F3B820EAC76762BD04C7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671191993, "uuid": "9cce4f50-7d21-422f-a529-ee1cc2567364", "value": "6144:Qss0SfKModPb0A9KTmxdJwMMdzOti/OMt1oiq9kehfc0Ur3:rs0XMohb0Kd7Md5oiekqva3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671191993, "uuid": "92cf80d2-69b8-4358-b78b-9ead64ed9f4e", "value": 289694, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671191993, "uuid": "6a62cec2-1175-4e22-8e09-4deee9ecdf84", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671191993, "uuid": "6d4af4d5-423d-498b-9596-a75fa730eccb", "value": "InstallerSetupFileX64.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f571ede-7cec-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671159124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671159124, "uuid": "42b8559e-ac6d-471c-b6eb-2740b061d832", "comment": "Malware payload (Smoke Loader)", "value": "b1b2ca9470c59eb5f811fc2648fd8d25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671159124, "uuid": "1ed0b61b-614a-43ed-900f-f74864d8e813", "comment": "Malware payload (Smoke Loader)", "value": "c5697208b41e075bc413064da73c13ce14648eef28db1070c88e0803a6824c73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671159124, "uuid": "58fb27c7-a51e-4f52-950f-472c72a0207d", "comment": "Malware payload (Smoke Loader)", "value": "dc17e148c2290e47040eedcd86e84da36fa29db3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671159124, "uuid": "3ea02d9f-a780-4fed-ac25-b149ccd04572", "comment": "Malware payload (Smoke Loader)", "value": "7f41814581963dc0ba6e3545ebd20ac610b06f445937d7b49fb51b143f88d52131c70e85ac95d6288b6c21de8dfa6f97", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671159124, "uuid": "eed00e3a-6102-400e-802c-1657edcba310", "value": "T1D174BF047AB3D4F1E932C5737826EBF466A9B810E9A1D6363319DF0F9D30293856630B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671159124, "uuid": "fc90b9fc-f598-4436-bb19-c08a1f24a147", "value": "2067eb05796787c0f2b3dc09403197ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671159124, "uuid": "cc35a929-7977-4b25-8d7b-f7c04c7ad68a", "value": "6144:EqY1kLWTJ9nVnReE942ggJ/V+0iPvzpQ6ijLxQFiaI:ckgJhVnReE9ZfZ0xnzpQ6ijqF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671159124, "uuid": "d71d6aff-8c95-4dbc-81df-516c2d7fbd3f", "value": 341504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671159124, "uuid": "63eed0cb-b334-4b9e-a284-78035a318e1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671159124, "uuid": "14aa036b-34a6-462c-aeb6-dbb15fdaf7f5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a458fbc6-7d99-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671233435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671233435, "uuid": "7060cf24-48d7-4e62-bdb7-1b53a413aff9", "comment": "Malware payload", "value": "99df4f3d1d0a30372b860f30d2d4e48b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671233435, "uuid": "eb34a876-4311-4d74-b418-9bcde0bc8a1c", "comment": "Malware payload", "value": "c6daba2ea0f0677a58b3dbbf5b39a7a7f7e6e09ffe89e464d3d7e25733d65dab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671233435, "uuid": "e423095f-71bd-43da-af76-256342aa9587", "comment": "Malware payload", "value": "ea9e83541fb6fd385f0c688338e5d06272f4b5ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671233435, "uuid": "021c0426-0609-4db5-b11e-48491e926743", "comment": "Malware payload", "value": "4b5209843eee52760f632e191e0cf182601532e1e56ec33e3b4f3e9f3fb5ca42ca1b2bf4faa3a33a3009dd6e15f5e1b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671233435, "uuid": "abd351a6-978d-4ba1-86a5-2789b347d3d4", "value": "T11274EFF03751E06EC252C7304C25D6A5593BAD205E62AAF33A182A2F1E357C169FE37D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671233435, "uuid": "90554e18-83f9-43ea-86d1-d305f5f5c1a1", "value": "aa9c378109186462717e17e657d0c833", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671233435, "uuid": "f063269d-65fc-4380-9247-259b832f8384", "value": "6144:LgSLoxNf/B3C4lop3/X3XzfGNil5XMMVw0CEYeigzp1vD40M2b:LfkxNXB3/loVfXzSi3hV9CTePt1v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671233435, "uuid": "212a4df9-5583-4ea8-85e1-de90b5ba075a", "value": 342016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671233435, "uuid": "c8e97c7c-ec23-4dc7-aa23-61d700b5af5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671233435, "uuid": "82a3bf24-3823-4cb7-9369-d5d6a78e5abc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0f6980c-7cd4-11ed-9db1-42010a9c0080", "comment": "Malware payload (RedLineStealer)", "timestamp": 1671148846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671148846, "uuid": "36412e3b-aea5-4230-ab2c-f665965db32f", "comment": "Malware payload (RedLineStealer)", "value": "ced63bc4092ac05e2b2ed432278945be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671148846, "uuid": "7ed53983-6628-4a89-a8bf-b2b356e7afd4", "comment": "Malware payload (RedLineStealer)", "value": "c76db68c7b019fadb9f76278b8ad1f9c6b39a9c08da712fb601381e05c7702b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671148846, "uuid": "77c90488-4e12-4e47-9194-6a0520e55001", "comment": "Malware payload (RedLineStealer)", "value": "ce96850b23f44d6048b08ead65a84b1d033e5fee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671148846, "uuid": "f17286ec-0d69-4f67-a15c-6420934c94f5", "comment": "Malware payload (RedLineStealer)", "value": "c633f9f83a8ef1400fecb73276312bf57f14dafc20fb57bdc09675c591d5522dfb045f5164ed255b3dbfec98ecba0983", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671148846, "uuid": "19436cb4-6455-44ff-b84e-f4e732b619ef", "value": "T1A094E0107AB3D4E3E932C9747826A7F4355AB850F9A5D237370AD71F99302938D2A31E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671148846, "uuid": "17bb8764-4bbc-4e64-b156-7a39ea1438dc", "value": "d134d10c41936619073a08bd546852f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671148846, "uuid": "1940fc18-d139-483d-b194-a9fe948cfa02", "value": "12288:HOd65vyT/DAHETnR6HmP7a7rt32xnzpQ6ijqF:WEvyTMETEHg+7gzK6Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671148846, "uuid": "f5746f51-0676-4531-8e99-363da97894c5", "value": 437760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671148846, "uuid": "22f47510-ba9b-4694-985b-287d107e798d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671148846, "uuid": "df756c06-3056-4abe-84df-ffff24c43559", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfaaea6c-7d16-11ed-9db1-42010a9c0080", "comment": "Malware payload (GuLoader)", "timestamp": 1671177271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177271, "uuid": "22a3620a-4ccf-4f06-a118-fe9778a09f7f", "comment": "Malware payload (GuLoader)", "value": "edaaf4dfde81b0f560c57b2a5366d371", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177271, "uuid": "8b4ef188-ed1d-4677-be39-1281468653ee", "comment": "Malware payload (GuLoader)", "value": "c8c6909613753e85fb9532b7a7267df9f9eda67a119d923eee52f58fc47154c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177271, "uuid": "86844ae5-dbd8-4e53-b6a8-de3bc3fcf6c9", "comment": "Malware payload (GuLoader)", "value": "00f0f1ec63956d968e91739bee57979b58ad6654", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177271, "uuid": "5f34e4b4-9ce7-44a0-8029-10e6bf4b0cf0", "comment": "Malware payload (GuLoader)", "value": "e9259b1da92cf28f825f1210133dc886bed107a47d249db1dce5a33aa3aa1532ad119e0e0fa3cd40b18f51c1e15ea58f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177271, "uuid": "72eb90e2-a138-493b-b0a8-50d35e4c7cb2", "value": "T1CCD4127223A2C8D7CC6806F4413353275279C26EAD546E1BDFEC2E2FBD567886C13649", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177271, "uuid": "f7a66e21-be4c-469a-9320-7d7053100645", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177271, "uuid": "24f38823-04c4-4ba2-b94a-defbc20283d6", "value": "12288:5ms7k7icHvgWTgKamvjwHy6i4JbttXXBobDUmhC+xYXTC+bkqspoL:0swxRTb0XtBUDUAxeWE1z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671177271, "uuid": "76852b6a-92d5-4715-b44e-cf5f5a7727d4", "value": 654915, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671177271, "uuid": "3b892e05-1cfb-4cd2-adf2-8634796cb6ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177271, "uuid": "6df115f3-8280-41b8-8e36-88ef34f013a5", "value": "Ziraat Bankasi Swift Mesaji.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56daf62d-7d16-11ed-9db1-42010a9c0080", "comment": "Malware payload (AgentTesla)", "timestamp": 1671177041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177041, "uuid": "4afc8ce0-f81f-4a56-9cc0-036f087fdf6a", "comment": "Malware payload (AgentTesla)", "value": "e0f08e6de79794f1ee62088b20ebd51e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177041, "uuid": "100c1fb7-277e-49fd-a4f5-efb19030b3ef", "comment": "Malware payload (AgentTesla)", "value": "c8da9dbb52f8297ec83361a3a728c87c5672b06b39fb097ab069303072d1c43b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177041, "uuid": "9c583799-3066-4aff-8a3e-559d46e9eeb4", "comment": "Malware payload (AgentTesla)", "value": "2fa3b54e43aca152213c5c6cb87de805486200e4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177041, "uuid": "4f7e6cc5-6a12-4723-b43c-adf2454b92dd", "comment": "Malware payload (AgentTesla)", "value": "c47e959cfe6933a88b8d18d939d1835394482d7c773be78f38b9ccd9bc6d4e906d17abfed0f306f7defe39cf40f19d31", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177041, "uuid": "0b5f9aef-4445-43c3-b781-c51026d5a3fd", "value": "T175D25C5AFBD8137D475111E17A5F2BC9E72EB93833E154A2286CA23423568BA03377DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177041, "uuid": "27af17a2-b271-4bc3-892b-c638a30209fa", "value": "384:PQMmdOFNYY0aaaIswqPeOrka1+fHQJ+t3rQkRhZzDMu9Jg3WfIyTB8bhRARmSisT:VFx0XaIsnPRIa4fwJMGiC3AIyWbRk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671177041, "uuid": "25c24591-3277-45b0-b36a-7a4ba4895384", "value": 29376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671177041, "uuid": "7badd005-56b5-4903-8732-b13100a290de", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177041, "uuid": "e7080460-fad3-4221-a763-16b8f73b3519", "value": "INVOICE SOA.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6dafd3a-7d20-11ed-9db1-42010a9c0080", "comment": "Malware payload (AgentTesla)", "timestamp": 1671181497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671181497, "uuid": "570bdae3-cfe0-4ff0-bd56-9d7e0631f042", "comment": "Malware payload (AgentTesla)", "value": "d367c3ff76c9ceb79e5d58c7e181872d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671181497, "uuid": "5d855fb9-3d00-415b-baed-9ff4ed3e0728", "comment": "Malware payload (AgentTesla)", "value": "c9048f1fd55decfb6e28922a6d80de0de31f7c7bb04f326cd4ec03a7fc4a4a15", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671181497, "uuid": "bae57875-ecc8-43fd-95fc-58d3b36a577a", "comment": "Malware payload (AgentTesla)", "value": "7edb27a629ea465b848d224482abada011115842", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671181497, "uuid": "01be380e-7e1f-44f5-b981-2bb80dbf326e", "comment": "Malware payload (AgentTesla)", "value": "ee2ab491f458f561a47efba28623d7822c9a1f98b4f236af5064765c322af129fbfb25abb3df907534a1f4d6163e027b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671181497, "uuid": "92299b44-fabd-4648-885e-d8eaae58d70f", "value": "T15E158C0A71D48F59EA62DBF10A00B4B0269737DE25DCEA3C8FE90FCA4411B18D955ADF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671181497, "uuid": "a97f28a7-b555-486d-ac25-ed836ce1c4d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671181497, "uuid": "02369bea-1efb-4398-8364-e34aaf437b77", "value": "12288:a/dG6HHlrmNzOnUxEbHtIliCeSkGJPaR9weD1313NhyYvaE1+I:tYqhut2ipSHdaR3Z1xC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671181497, "uuid": "f112ddcc-d2f2-42e2-83bf-252b71b92427", "value": 881664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671181497, "uuid": "2576e3e3-02c2-439a-a36f-3ed6b8dc9ce0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671181497, "uuid": "b1d5eec4-96fa-4527-8e44-8e4f7fe60d3d", "value": "d367c3ff76c9ceb79e5d58c7e181872d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7bf7a11-7d58-11ed-9db1-42010a9c0080", "comment": "Malware payload (RedLineStealer)", "timestamp": 1671205524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671205524, "uuid": "ad46e735-2f49-4735-ac53-ba43f6487fc5", "comment": "Malware payload (RedLineStealer)", "value": "0983975ec5599a8912ef6e1dd48c865f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671205524, "uuid": "4eda11a3-2395-4dbe-b4b4-6c44ceb9f220", "comment": "Malware payload (RedLineStealer)", "value": "c94eb4caa933f95d677746cdbc69aa950c3d714066f94be66d4848772da309d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671205524, "uuid": "6fe2efe1-a3ad-4d3c-abb0-a1aa0ff699dc", "comment": "Malware payload (RedLineStealer)", "value": "dd1a1cd956838ba3712366a3110274ace9ffdd38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671205524, "uuid": "0cfd0c1d-9802-4d5f-ada8-12e8af4da7c3", "comment": "Malware payload (RedLineStealer)", "value": "bafdcc3d58afbbabf8e7aafbdd04e8ba97649a1448f3fec309eafbd5e97a861dcff5d0fa44eb297fa7e297a8ff359130", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671205524, "uuid": "bbdc55b5-1ea4-49c7-a139-f893ae0b5e85", "value": "T184A47B6099312B63CF24D7F2093FE794355AD630CA5222C5C5FC747A33287A26636B9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671205524, "uuid": "3ed7b318-e7db-4d81-a12d-952a2f714690", "value": "68cdd67c3c3eb731955e4d1b327781a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671205524, "uuid": "230da245-89c7-44a3-9a5e-3879512c87e0", "value": "12288:zCcK7hn2DEFYW9cGOhEy5xCFnLrFRL82j:+cqh24FXFOFDO3FRpj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671205524, "uuid": "488969f2-d3ed-407f-9588-b63bb9c43007", "value": 481792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671205524, "uuid": "13da9713-2866-49ba-b067-b64081084b8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671205524, "uuid": "b1d3ab09-db02-4e2f-8aea-ad2454cef0b8", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c08f031-7d11-11ed-9db1-42010a9c0080", "comment": "Malware payload (GCleaner)", "timestamp": 1671174983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671174983, "uuid": "b19a0623-ca45-43b0-9b07-437646577d3a", "comment": "Malware payload (GCleaner)", "value": "f9fd72551ca9e722decf9951baeaa3de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671174983, "uuid": "7ac4ec39-b945-49c1-bcd3-e842d4c5fdec", "comment": "Malware payload (GCleaner)", "value": "ca133be8548606a2caf2e4ba5851d9b3f072bc92b5da032cc09edddf8bc11ee1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671174983, "uuid": "ae79f256-076f-4725-88a2-a6f63bf9d6d3", "comment": "Malware payload (GCleaner)", "value": "f6a711e0264f90746030a913d0d6185ad4cd09cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671174983, "uuid": "709b7a00-f17a-4048-9202-a0f5df1e13bb", "comment": "Malware payload (GCleaner)", "value": "9c1cf755471b12033d14556330202922a321e9e8eedbba7c7d899c6fb8da3b30635a32fcdc69015bf503f9012079c2a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671174983, "uuid": "7e196833-7524-4d16-b45d-c7a80bbfd1bd", "value": "T186C523BFE4A01876D0B709F939295C7255E66D2B1E28E55C3BC87E9B73FB9C05802207", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671174983, "uuid": "8dfb71ab-0f86-4b53-9095-cbe4738c6f33", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671174983, "uuid": "8e98c3ae-6e7e-49b1-a59f-76a684fce4f8", "value": "49152:opgBRC2jVLYveJoS+/Fwg79ZxhiWs+O9B5ieOCgSY/imP:opgTC2hYvm+/FBfhiGOccY/imP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671174983, "uuid": "8d005b4f-43f3-47a3-a2a1-6be692f6ea0e", "value": 2580222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671174983, "uuid": "16d44da3-aef2-4216-b8c6-014222d44772", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671174983, "uuid": "752a8769-e39c-4289-9ec1-afea789369a7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0403b66-7d56-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671204786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671204786, "uuid": "100d4ce7-87e1-4aed-9b3d-b0c7a47b6b65", "comment": "Malware payload", "value": "460bf592a24813d3c147fb1c0675d6e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671204786, "uuid": "20383c21-13a6-4c02-b774-fe4704e749e3", "comment": "Malware payload", "value": "cad7b6bc42f3521c11ab41387d03cf650343d556b8ea7cd618aad7a12101fd2c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671204786, "uuid": "6d5d3770-42f4-4af8-b8bd-d59645e4760d", "comment": "Malware payload", "value": "25fb59ed1625e52ff7245962f1b957bba6301f17", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671204786, "uuid": "a1977022-f73a-467d-8584-bbd321127613", "comment": "Malware payload", "value": "d1464381c5d960f486f07e80c7ee9583cca2fff947a44d925cc3f8f9a7e4755e24b51e4cb44e6bf1fcae986810b26592", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671204786, "uuid": "a15a76fb-82a4-4448-9f52-bc2d5149fdc5", "value": "T154512BABD7A14976D51426B7CE438AB57CFFC494AE0C1610C0933A09CFB7910A4AB90C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671204786, "uuid": "b29dbd06-277b-44d1-831b-b76b82b5f36a", "value": "48:9SygxCWUN2QPTjW1VtaHZwzUS703jnptqkRrwhE5nnQtLeX+2TtzSoTT:9r+CWUN22TjW1VtAS7+jnPq4whEZQtFY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671204786, "uuid": "1633cc04-07e4-4853-ad62-25ba1968acfc", "value": 2776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671204786, "uuid": "89570151-c0e8-4e94-b363-fc598934b7a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671204786, "uuid": "ae96edcc-46b6-4085-a870-9fee147a8364", "value": "SecuriteInfo.com.ELF.GenericKD.3681.tr.4665.396", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b790ee25-7d6c-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671214140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671214140, "uuid": "3a0f1de4-d0fe-4d07-a1a4-a3a8b856f4b5", "comment": "Malware payload", "value": "03ffb735d856b92add2e2356de67fa3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671214140, "uuid": "cd2252a7-5469-44ee-99e0-c55440af66e9", "comment": "Malware payload", "value": "cb2c92744e9408b81df6d78e92864d280635946b7d6de82e032124ac031ac100", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671214140, "uuid": "182168c7-39b9-4742-a217-1ca22094eb78", "comment": "Malware payload", "value": "6d3254a7a7594dc7d07e4f4eec6082513fdc5ca3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671214140, "uuid": "e59856ee-77f7-4812-990d-5e6cc59add0e", "comment": "Malware payload", "value": "0e86c2f3f0fe901d8a9974c2b3ab367e8e99ecb6746b2b40f9519acbd6cb8b958860e430610b1f8348f77b24c075732e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671214140, "uuid": "1851d2d6-8349-452c-816c-0082752a691e", "value": "T1C254DFF16A90E4AED191C7308819D7D8A63EBC105E2195F36B043A2F2A752C159FE37F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671214140, "uuid": "2b3c06aa-16af-4fc6-bb3b-607b6b439482", "value": "3670997c8c2669588bad5b8c178dedd4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671214140, "uuid": "f4557a7a-1900-4d50-9247-4ad518e9b7f0", "value": "3072:0NsnLL3FjLb0RviQuFdhMGjv2/p2TZvUqWnEsAPCxk24HdKUPLszb/v0V7XEr40q:0mLVLzFMduvmnKPkklFPgzr40M2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671214140, "uuid": "3f183635-50c4-40f1-9a6b-b91a0f0b6127", "value": 280064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671214140, "uuid": "9c5e9357-53a5-40ee-9bcd-d51391602101", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671214140, "uuid": "f9f7f2af-c238-4049-a616-bb4c5bd7ac2d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a108a847-7d4e-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671201218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201218, "uuid": "fe6a611c-1471-4ef3-bfda-be86e7f50e85", "comment": "Malware payload", "value": "12c7cee6a92afaf49acefcf20cb31204", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201218, "uuid": "9c62543c-997d-4af6-90bd-c158f08b7e5d", "comment": "Malware payload", "value": "cb40deef9f675c99731fe8c9a59659ee2d2993fdb2c403c05a3dc34d27aaec90", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201218, "uuid": "6a9e551c-8c9c-4131-b1c7-643e8bda06fb", "comment": "Malware payload", "value": "2597fb59ce4504bc37bd8edbb1590b10ae6a6ef8", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201218, "uuid": "278fedee-76c0-488c-8c6c-ff42448077c1", "comment": "Malware payload", "value": "d13fe5a075559fa139109e5d48e1f49d0d862c6c8cca653332b530bc1db9158dc56a7181900b9ae381a8fc5b2dcfb39d", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671201218, "uuid": "3b941b49-5723-4db0-beeb-a7313cc2be2a", "value": "T14B51F87A060D18D1D5FB51D78166BC74C11774EA56CA22CB0276FDF3113F63296B6840", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671201218, "uuid": "6c6f7b80-2a47-4104-8931-70df119bfe0f", "value": "48:Xg3x2uBjrrZjFjUh88gn1J0geUNxx5dbMnJm46A+X7CZb5jdjwC:g2OHrRFj288gnAoNy4JCt+C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671201218, "uuid": "13a4f732-7d5e-4698-93ab-72d433026744", "value": 2880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671201218, "uuid": "fda201a4-d694-42b6-b54f-378b824081aa", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671201218, "uuid": "5cf8f285-faf9-46cb-93c6-013115aca5ea", "value": "SecuriteInfo.com.Exploit.CVE-2018-0798.4.6912.28426", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "210797ec-7d5b-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671206586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671206586, "uuid": "1084c0e4-67be-4bd9-b7a2-af6136781eb0", "comment": "Malware payload", "value": "7cdd3b21f1622a6d8eac764f68da4321", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671206586, "uuid": "1c8ce68c-b3ba-4a18-acce-d45ba071ca2f", "comment": "Malware payload", "value": "cb8bc73bd35b2dd78015b971838e0cfcf84572bac91680b4667e347ec2016173", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671206586, "uuid": "053e5d7d-33b6-450e-9928-b06c16133a21", "comment": "Malware payload", "value": "8e0530ce619f86c4e9c1e0f61d1d7e671f16b275", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671206586, "uuid": "84b7dd44-e2e0-4e1f-98f8-6956288c638d", "comment": "Malware payload", "value": "8596a3343d64e1058d917c85b9dc4fc16be96fc405cc2313c9dda555a7763c85bb0419b306b494d1d179b8f2dab47c02", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671206586, "uuid": "4c494298-d126-40c6-b917-b854c52a81e5", "value": "T1FD9733B96FA47BF941F48C797CCCD73AF3B65A4221A55BA326E18518035FDB0AD001AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671206586, "uuid": "006daa6b-6531-4d7c-99c3-3be853a2a6c5", "value": "786432:6Ce5AQhR7Q55G0K8VqDKkarfaYOsOMzBy1LkGOvv05dTdcl3zkuIOn:6CtO820K8VqDorfaFMtIvOnw3W3g4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671206586, "uuid": "cb8ceefc-b924-49d7-8ed5-66b5f980dc64", "value": 40729322, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671206586, "uuid": "5ec1f646-b975-4ff8-8ff1-71a31bf7ed0f", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671206586, "uuid": "95f2b795-10dc-4587-9c66-a29966e4d517", "value": "FortiClientVPN-10_11_2.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c3ba09a-7d17-11ed-9db1-42010a9c0080", "comment": "Malware payload (Vjw0rm)", "timestamp": 1671177534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177534, "uuid": "0707fd9c-0834-4337-9fb4-29aac8288de6", "comment": "Malware payload (Vjw0rm)", "value": "0dd3d7d195a7d45f24c1f86c25b8bd73", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177534, "uuid": "10ec9a27-c619-429e-abe0-695e27874af7", "comment": "Malware payload (Vjw0rm)", "value": "cc17a222a8b6e268ef29c4e4de39390b77f23fc6c45ea21dc9191ac45f15aea6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177534, "uuid": "e360fb98-70db-44e6-bf2b-924b912055eb", "comment": "Malware payload (Vjw0rm)", "value": "cb4142317dc5ca92ba2eee9aecc8809d34276ce4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177534, "uuid": "9d266e6f-6e0c-4717-85a7-eea8553b5150", "comment": "Malware payload (Vjw0rm)", "value": "6ed2518fc6c88d7a605c573231f6415b0b7208249c51e5fe66cc64a1b6651579c68b7b103c04c4c997e66fc5247288fc", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177534, "uuid": "2ddaddd7-c893-4566-a625-2c17c7eec6bb", "value": "T16BD434D0FE0DA04A59A421A800341B8A597DDBFAD074CBEDF2167910DE56C4EF3ED6AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177534, "uuid": "d401ca6d-6b65-43f8-9ca6-63699568710e", "value": "3072:vTwFRFxmzUmKvOERglXIjl7U0lVJSpHOcdKzPaKjaFeMXnsM4MkY9WZY5i/1RgHj:v+67ykgieRJ4Xp8Gl+stC/MxiP1YfoO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671177534, "uuid": "8639df66-c77e-4bf4-85b5-d4ad92131a29", "value": 624183, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671177534, "uuid": "e15b60bc-8890-46c4-b530-a2bbaa0fc5b5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177534, "uuid": "1944eee4-1b9f-4d35-8621-548262b48be1", "value": "WORKSHEET.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed515df6-7d79-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671219814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671219814, "uuid": "7c3a3129-bb87-462e-8616-f34ceddfc3c6", "comment": "Malware payload", "value": "6ac3b4afdd3901466f45011d3b5f583b", "object_relation": "md5", "Tag": [ { "name": "82-115-223-60", "colour": "#F7CF6B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeEvilHunters", "colour": "#9F827E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671219814, "uuid": "419ac8cb-14f7-4bb8-a3d0-0da5d0399c56", "comment": "Malware payload", "value": "cc78faac454ef399815fcec3c8f9dd4fbd0548fa747618ca6a58f0a6b787d32b", "object_relation": "sha256", "Tag": [ { "name": "82-115-223-60", "colour": "#F7CF6B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeEvilHunters", "colour": "#9F827E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671219814, "uuid": "59d40095-3e3a-4cf3-82df-88f777bd3146", "comment": "Malware payload", "value": "4c227f1fbf500027e0f4193078dde73f474bf9fd", "object_relation": "sha1", "Tag": [ { "name": "82-115-223-60", "colour": "#F7CF6B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeEvilHunters", "colour": "#9F827E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671219814, "uuid": "044c387a-372a-466c-82ac-d62e987bb21e", "comment": "Malware payload", "value": "9b5f6a1ea3d65070bb82fece03940e0c7745ca1cf451179f633416247b4778af7e19709760bc164c1455f1a00705c4a2", "object_relation": "sha3-384", "Tag": [ { "name": "82-115-223-60", "colour": "#F7CF6B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeEvilHunters", "colour": "#9F827E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671219814, "uuid": "9d0e62be-eb9b-485c-b0ff-408d2408aea0", "value": "T1E026126DD96A137EF1CE2574D0974F716310C5A835E0636B2BB3078B5CC27928EC7A8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671219814, "uuid": "a7b28560-679c-4837-8be1-36445581e013", "value": "98304:Po7dHMKTCxdCoMwICqz1FPIauJndbwVsxL5:PcHMC4goMwZqb7uFRlL5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671219814, "uuid": "9204f780-67ec-4f65-a083-e14a3170eb73", "value": 4566061, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671219814, "uuid": "82930bcc-b2ed-498b-abee-48b2198a1985", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671219814, "uuid": "963aa35f-29ab-46a4-8c08-0ba111b748b2", "value": "Evil_Launcher_Beta-win_x64.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9509c152-7d67-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671211935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671211935, "uuid": "a742eab2-3b5d-4505-91e1-134cc32e18a4", "comment": "Malware payload", "value": "d47560986042fab20aa9bfbb7c7cc211", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671211935, "uuid": "7627999e-d265-4a53-bd04-18c427eea390", "comment": "Malware payload", "value": "ccd8f858057e8f7b43f3ae2490de946c65dab843514f0239bd9f50ba207fb8da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671211935, "uuid": "1221bac3-f2d4-406a-9712-9b6e83ad0b23", "comment": "Malware payload", "value": "80f009dd7b2c7afe88558dbfb3aa50d71d4dfffd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671211935, "uuid": "2895fa9e-a6ee-40e2-a0c1-db2e565bf6a2", "comment": "Malware payload", "value": "e079e7b087af12cd9b75c150bfcc990d26b3966db52506c73ccacd871ba0c12d1976806c01e402fb731236c16f3ad217", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671211935, "uuid": "15498597-2c84-487c-b7a2-7a325df6296e", "value": "T11D658C9B031039B8D548FFB77B1993A4B0491DB3703956CA9B82A74CF4BB36241B66C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671211935, "uuid": "ccd9acc3-5762-440d-bac8-0ed2488ea72d", "value": "9f2c76418357be5cdc291649da90bd66", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671211935, "uuid": "3c089b0b-556d-4f99-8fa5-5bd722fdd095", "value": "24576:RZeOPtcSLS2Z7MA77trZeJbpWGM9Qx11pQsGft/ItbJ3RwFgc2pRaO:fLPzntIJbO9QxbmFqJJJc2naO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671211935, "uuid": "cc0cae3b-82b3-4ffb-b6d5-8d71f853a129", "value": 1499024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671211935, "uuid": "cbca7588-cf6c-422f-94a7-0b7c121a33ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671211935, "uuid": "fe6bf0c3-fe4c-4b96-9e2f-f5845f95ea07", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45562552-7d63-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671210083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671210083, "uuid": "a7d893f7-38fb-4450-8d32-4f3b9766b490", "comment": "Malware payload", "value": "9f8ad8037c1a22d0f1c0329c3340ec18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671210083, "uuid": "478ac282-2479-46a6-a675-33001fae4c9c", "comment": "Malware payload", "value": "ce6cc42aa09da7448f7ba9a992584cdd69e76b3759edfabb1cfcadea4edf2abe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671210083, "uuid": "d9e3dbf3-d560-4d41-8c8f-d8894fd0e7fb", "comment": "Malware payload", "value": "fd9dbbda57b02ff92b00a636043efaf10b5ba3b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671210083, "uuid": "4b88f332-cbcd-4aed-a3f9-5de9e1a7f735", "comment": "Malware payload", "value": "6ef6044129ab0fc1705124456f7ceaf62d42a112428cc276cd879a1e6ada365c048f3e5da970bae06a4f4549fb17de4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671210083, "uuid": "c2045c02-3e36-404b-aa71-9f2551e2a890", "value": "T10065AD40DFB0B692E3CE14F4BD35D2AF202668235F20554A6AD89EAFDABD4D30DC5742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671210083, "uuid": "08c53193-e0a8-4725-9208-a9cc0dfb2bb4", "value": "9f2c76418357be5cdc291649da90bd66", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671210083, "uuid": "6c9490b7-df70-4bfd-bfdc-d1d30274e239", "value": "24576:BK2zcqHdKzg670sxJPgIO/eoFhEvTiWFBpXe0ZgbEyzrqybobBZy/MlCoy2aVMW:A2z7dk70sxJPgIO/e3vTJjLWQyz+yboW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671210083, "uuid": "7f6c26bd-de6c-4544-9cf9-36bd4464ee6b", "value": 1470608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671210083, "uuid": "974cac1c-fee9-4258-b59f-4ae06ad17391", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671210083, "uuid": "1eb00757-3602-49e7-93ab-122c36265028", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d90185a-7cda-11ed-9db1-42010a9c0080", "comment": "Malware payload (AgentTesla)", "timestamp": 1671151256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671151256, "uuid": "e4dc1990-62b5-4e62-b51c-bc768f248083", "comment": "Malware payload (AgentTesla)", "value": "2ccdb3745e61f38b90e67c3bd5211498", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671151256, "uuid": "ec15eba7-5353-4841-941e-49eadd4f9c18", "comment": "Malware payload (AgentTesla)", "value": "cebb1c6923fff0d97b887dae2f95d50972606637de730420e46e7f0053632b2e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671151256, "uuid": "fa43c59c-9a2b-43a1-870a-9885e7e5599a", "comment": "Malware payload (AgentTesla)", "value": "4177f9083c38b6c3b67e30b94572f20a45899274", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671151256, "uuid": "fe9d8349-ad75-4c9f-8070-3a6e3fc23f63", "comment": "Malware payload (AgentTesla)", "value": "3dd1d4cd81ccd35bbb064824633adcf83149ef7aaec902517e57fb6195ad5e16010da47afac590045956f8c54cdf570b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671151256, "uuid": "3314a9ef-2ddd-40f4-8d7e-e56fdd6c2791", "value": "T158D1C501D2A951B9EC6E7738B8EE474173BABBA73942DB5D34582206CEE579008A1373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671151256, "uuid": "974ad317-5e30-4848-9095-d51d9f352632", "value": "96:FL+4KNc5neEbb8QcCqEjvy47pVlu3SjsLh1zNt:d+Fjeuxey47T0Cjs9P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671151256, "uuid": "95a4bd8e-4d5f-46f4-be98-92ef254367d8", "value": 6656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671151256, "uuid": "3271845a-0093-4540-9516-e0c9f4f46020", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671151256, "uuid": "e08fb3b8-ea8b-4137-a279-5067c0680918", "value": "SecuriteInfo.com.Win64.PWSX-gen.1372.952", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0340edf-7d84-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671224516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671224516, "uuid": "107ba6d2-9bf6-4df0-91b5-8a35ac52b5d4", "comment": "Malware payload", "value": "f7abe6e19c02217cb7aaa08438e3d0ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671224516, "uuid": "a613063b-d0e9-4c56-96c1-4e3a61119f41", "comment": "Malware payload", "value": "cf7e87560e6226eca45aa85b0b0b7b0791c08a94c105e7263cd762a56b02154b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671224516, "uuid": "880f57af-dbd7-4906-874a-4fd5c55c50df", "comment": "Malware payload", "value": "7078aadc464f7ebfadea00fd6ea7795623c3470b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671224516, "uuid": "212d2b7b-2771-4163-b485-03888bac1e60", "comment": "Malware payload", "value": "4ef0086881a7c1bce066292a6c015f6b368f534aad58cd0e5bde25f2b2b43fd45bc1592963b474b820af929c143bd102", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671224516, "uuid": "ada1603a-8838-4b04-9ac6-48ed50099e41", "value": "T193656018314FFA93D6C8BC31AB6B7BFA69C21F54394C888DB2637D150D703506A16BB9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671224516, "uuid": "23ce1a11-9e5c-4095-b967-a72e3a8b86e2", "value": "9f2c76418357be5cdc291649da90bd66", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671224516, "uuid": "1786c0bf-9b6c-49cc-a0bf-cb7b191d43db", "value": "24576:0gYIGiRuPNrjDIg3ouUXbpRQkm/HSxqoD15glqYIzQmtAEfhvNsDmtyDi6nEa:0gYI/uPxj8g3ouUXdRAHSwoD15pYJmtc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671224516, "uuid": "a840b331-457a-4182-8401-515808bac7ed", "value": 1490576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671224516, "uuid": "b1ac610e-5af5-4a9f-9db8-7ee0ab4ba3e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671224516, "uuid": "e2a57762-d710-4409-acb2-3180abba0941", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89bcedf1-7d85-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671224801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671224801, "uuid": "9225da1d-ef65-4fd2-892f-ec78e1fcd142", "comment": "Malware payload", "value": "c8fd4848e4636ae40ce6ed19429fc757", "object_relation": "md5", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671224801, "uuid": "fc11f1a7-5ed7-4afc-96d7-19214df1b5d3", "comment": "Malware payload", "value": "d12dd926df010fdd3d6309fb947b8ec722378319bb83f80bec1855a1a688fe2f", "object_relation": "sha256", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671224801, "uuid": "5bba834e-1f7d-4140-a6f9-ee339ccdbba0", "comment": "Malware payload", "value": "75aeda25bfbb94d54fa70ebdbccc7a9806d0e33d", "object_relation": "sha1", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671224801, "uuid": "7559d813-dee0-45ef-8bff-0b372396502c", "comment": "Malware payload", "value": "9603419b2b3852bdeb09067bd62d6935879eb5c268aa5a1329a6b36a75cea5ebb452e74f8fa70951a3ac5f20b1cab50b", "object_relation": "sha3-384", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671224801, "uuid": "42a288a7-2f3d-4e4e-82e7-59efd921c1cb", "value": "T15F42E786BA0399B3E85DBAF464FB9BB68A63FC330CB4482ECE50E59179195548C12345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671224801, "uuid": "c95b1679-323a-41f7-b1ae-5f41473f858b", "value": "d0cdbbd7f8f609c37c0f93840522a8d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671224801, "uuid": "d0bfcf28-716d-437b-a974-020cdc911d1e", "value": "192:NnCpyD8U9ceDr4Q2tQU/1qHPpe0xjFaHrvgi0oEnE0y:iKsQCZt2jkkiLEty", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671224801, "uuid": "3c885625-17ea-4119-b1b7-7a6d82ce18df", "value": 12288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671224801, "uuid": "2b6a4328-6b85-4d68-b329-db2ae7b585de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671224801, "uuid": "f9ad6005-f213-4611-a1a8-07465ffb6663", "value": "i_got_a_glock_in_my_rari.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f77fb69-7d7f-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671222207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671222207, "uuid": "9416fd4f-fd4d-43a6-bc4f-fb12ab241020", "comment": "Malware payload", "value": "6744de1c479d6e47f7d4886ef9810330", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671222207, "uuid": "367ce772-698e-4d4e-ad79-62b317cff039", "comment": "Malware payload", "value": "d15dbc9807fae79a32c954c98a51eaff822e57fa3d9944b548d39fcd9f0f8ab9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671222207, "uuid": "282ba8f0-2d4a-4950-855d-0e963e35e10f", "comment": "Malware payload", "value": "ff85c458294b72384026af64c8b6db8f5cee36d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671222207, "uuid": "e3192f18-6d5c-4bd8-a1c1-bc4582b463b2", "comment": "Malware payload", "value": "64e444dfa3a4ab9a41ae81acfa53be58a50efca6b566a20dae5a1e7c3ea1f6ec3778adc8e0522c5de5073816ebe38c8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671222207, "uuid": "4b8e445e-ac61-4afd-a71e-ebe4dc9934e1", "value": "T1AA24BFF16394D4BED151D7318C2996E4A66ABC105E2299F33B183A2F1E312C159FE33E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671222207, "uuid": "9bd58d8d-e713-4479-ab63-7984fbebd9a0", "value": "aa9c378109186462717e17e657d0c833", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671222207, "uuid": "a01a759e-070d-45db-9ee0-3e0a9d594b56", "value": "3072:uLSUiPxLWOWqSbRStElN2qGoB2LZwYSLId2UaHLszBEAdX+h40zwUzQRKF+:RfxLWOWLL+6LXUAgzHX+h40M2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671222207, "uuid": "b8b8b608-3b60-41d5-8413-d337070d3e9e", "value": 219136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671222207, "uuid": "a0d3e12b-41ca-4c22-bf96-3fa6a39a07ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671222207, "uuid": "a03b134d-9d54-455c-a36b-72b30cc6153b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "475368ce-7d10-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671174438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671174438, "uuid": "a1e2ac6a-2278-440f-ae62-a5a38124624c", "comment": "Malware payload (Smoke Loader)", "value": "91ba5800bd767dbd6ea5729f461988b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671174438, "uuid": "206a59bc-b1c5-4a05-a937-bbb75bf034b5", "comment": "Malware payload (Smoke Loader)", "value": "d1a71528888fbcf0da1cc4cb959a9f66c73a8e03169602155a8ab724647a2113", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671174438, "uuid": "f9017e41-49bf-40ec-a0a5-45f128fceb4d", "comment": "Malware payload (Smoke Loader)", "value": "50c656475fa06e46a95188cfcc950bb6b902844f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671174438, "uuid": "a0c078c0-bc4f-46e1-a829-6b3e722da7ab", "comment": "Malware payload (Smoke Loader)", "value": "ecea62c0f579bebf257c27cabcadb6fb8a03836fa5b8f387dfa6ab27cfdaa19e3e8dffd854a4e76ca22d54684531a960", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671174438, "uuid": "35877d34-c917-42ef-8565-2ddbb3134f9c", "value": "T1BC34D02072B0C071C05F19318865D7E16A7EFE315A72A60777763BEF6E30A90663AB4D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671174438, "uuid": "4429cd76-c229-48d5-9421-188c4f6b1a17", "value": "b35462da489bc13bae884e55b5227599", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671174438, "uuid": "151020fb-2828-4469-adcf-2b3fc12fd949", "value": "3072:akQk4sn5L2Fqjd3cRV/yzbPgpkgZOmFOLQ2mppGT80crKjvHtWqMPDcfuh:BQkJL2Fqpgy1K5tdYf8qMrc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671174438, "uuid": "004b1c26-6294-46db-ba1d-6784f5786538", "value": 233472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671174438, "uuid": "138f921a-37ea-46a4-ac3a-6f2e833d183b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671174438, "uuid": "99a94f74-426b-4cc6-a8a6-edb11a4a872c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c25638cb-7d14-11ed-9db1-42010a9c0080", "comment": "Malware payload (Mirai)", "timestamp": 1671176363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671176363, "uuid": "74505471-b2d5-4437-8b9f-5f4b192b9b39", "comment": "Malware payload (Mirai)", "value": "e257afabe9327db6cbc51f2d77f59b9f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671176363, "uuid": "cbf705e6-6c2d-4642-b7d8-14a6e72c2118", "comment": "Malware payload (Mirai)", "value": "d1d79f410231e7a070f504b1359cf1b65d549e293d1dbf08761188b5f8be613c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671176363, "uuid": "e0b09c2b-773d-40da-8fa2-ac1ffc0e21f4", "comment": "Malware payload (Mirai)", "value": "7f4cf7090d4568c232d116f01633103cc35837f6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671176363, "uuid": "cfc12974-54ed-4515-af64-0bde8c4094d0", "comment": "Malware payload (Mirai)", "value": "d7e9873d38c6a6314957fa84999f8623c38023fbe0c15f2d8d097a01632479982200cf42cacb329ebd855075a84bf81f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671176363, "uuid": "b1966561-f860-428b-bd2f-1f233e11acb8", "value": "T166438DB4E42A9D54C0850174A8B48F750FA3F2C883621DF72BAA46B1540BEB9F60DFE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671176363, "uuid": "9f5d18b5-77ec-4b1c-af9a-f7f4455ce388", "value": "768:f3Dm+BLr3pN3b3xMmWQZ7YnYhJ2wGQDmhMOfcA1eCHo1Y4dbC2WwJZY10U:bm+JDpP/Z7VrGQDPA1eb1dbC2PJa10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671176363, "uuid": "2d3bad99-7de4-407b-9fe4-af58b9cf94e8", "value": 55568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671176363, "uuid": "42bc1dff-62f5-4373-9402-2203b8822ae6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671176363, "uuid": "d2aaea2b-82f9-434f-bb73-4fa03513b07b", "value": "e257afabe9327db6cbc51f2d77f59b9f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c0d8560-7d09-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671171467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671171467, "uuid": "ebbf4c96-ee74-4e0d-9773-ae4c6ad40257", "comment": "Malware payload (Smoke Loader)", "value": "efe9cdd655e96ac0fb550ae7e24044c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671171467, "uuid": "1e205df0-7556-4642-95a0-1ba30b11acfa", "comment": "Malware payload (Smoke Loader)", "value": "d30b368f3ecce618e1b5eae627b13d4f10628beb020e6a8cbe449f0c925d0d45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671171467, "uuid": "7e80e346-7ada-4e25-a89e-07e90e4466f6", "comment": "Malware payload (Smoke Loader)", "value": "583a2ddece77a287d8de6babb0c9a76fd91e2a62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671171467, "uuid": "83864ae1-7c39-4d10-b1c0-56baf04f7424", "comment": "Malware payload (Smoke Loader)", "value": "ee08ba0346114fe660710412bd830da6f83cdcb0c526a942e9512dcf78543335146276ae42ca8dadd8c2f4bc64968a14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671171467, "uuid": "713518ec-b564-4be1-97d8-db83c457b7e4", "value": "T1E334D031B2B0C4B2C15F1530C86AC7E06A7EEC318A71654777763AAF6E30B91667634D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671171467, "uuid": "f7ca6e5f-f348-4f5a-b560-8bb695657df0", "value": "b35462da489bc13bae884e55b5227599", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671171467, "uuid": "c40194e6-3ecf-428a-a8ae-02c373ece874", "value": "3072:7xTkqcEBLObXppccRj2n50GSOebFYnYRvnnt/XdFsLQ2mppGT80qkdHtWqMPDcf2:dTkSLObXzG50j3yQtvvtjq8qMrc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671171467, "uuid": "2050d82b-c233-4d92-ad7c-b26250a42bf7", "value": 233984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671171467, "uuid": "40cb4ae8-b31b-4e60-8265-0378fc35db8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671171467, "uuid": "65881991-85ac-4e43-b114-d19c89c396bd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2b70e35-7cf2-11ed-9db1-42010a9c0080", "comment": "Malware payload (Amadey)", "timestamp": 1671161760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671161760, "uuid": "de5e1d15-5dc6-4944-8370-c2ae091d5432", "comment": "Malware payload (Amadey)", "value": "1f0e5cc38c468bd8d4cfcc26174267ea", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671161760, "uuid": "d83ab093-24b0-4152-bdb9-05b79be21f14", "comment": "Malware payload (Amadey)", "value": "d3711e3d5e5f3cf7e115bea8a8dd59948c5c7ccf60930bf88101ce8fadff8ffa", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671161760, "uuid": "0f83def7-825d-4c99-88aa-3752f46297bc", "comment": "Malware payload (Amadey)", "value": "babf08b0b69f0ea3edb8f1fce7386c509f63a126", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671161760, "uuid": "f4ec40a2-5947-4bf0-a55c-ca94682aebb0", "comment": "Malware payload (Amadey)", "value": "921c0f9656bfcf4d49cc5c5be17a0f6a46e246753a4570e40efafe8477da5bfda0626b07ecc0be05f0821465f38968cf", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671161760, "uuid": "4938e8c7-0f03-4c5d-809c-251d3966a7e5", "value": "T1DF84D0017A73D4E1F832C5754826FBF465A9B8A1FAA9D6333309DB0FDD70253892A319", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671161760, "uuid": "75f59126-8ec0-4de4-96be-c86119223461", "value": "2067eb05796787c0f2b3dc09403197ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671161760, "uuid": "3b919922-797b-4512-a3cb-a7506b2b0c3b", "value": "6144:ALYQeLbPGgBH/EjLYklW18Ix3LUuFk1waFzCKGPxNc0iPvzpQ6ijLxQFiaI:gefGg9/QNW18IVQuFFMzvGPPcxnzpQ6T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671161760, "uuid": "e1df868a-7803-454f-a7ff-6df1bbccf7e0", "value": 382464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671161760, "uuid": "97801ca2-8de8-4fb5-9cfa-cac7137198b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671161760, "uuid": "d9d47784-7f27-4739-a373-0b7b2b0a7ed4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab922c20-7d78-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671219274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671219274, "uuid": "0060d7a4-ffe5-4ec5-998d-e1a41cf688fb", "comment": "Malware payload", "value": "f493b3139c42ca20b830086e15f2e85b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671219274, "uuid": "fc503851-4a6c-44bd-83be-3a4a29011845", "comment": "Malware payload", "value": "d3ebf5179cfeee390848119eac91057385b6746835b80093f47637cb83895b42", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671219274, "uuid": "fddaf3c5-0f39-4c92-b7c8-2067427f590b", "comment": "Malware payload", "value": "66737f491c521707613b196ee4cbf24ed311a503", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671219274, "uuid": "a8db78ac-249a-43e8-916f-d18e267b71e7", "comment": "Malware payload", "value": "0c483a7deb37846e5a4e1ab69ba7d525eb1d55a8da40eca6753ae163734fe0ca80601c6b3833c0b810e04e3048fbb82a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671219274, "uuid": "fa5db7b8-eb6a-45d6-8904-22f82150512f", "value": "T11724BEF17670E42FC152DB308D24EBE4B66AA8205E6195F36B14261F2E316C095FE37E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671219274, "uuid": "3d3852f9-ca73-4b92-96f4-39285d473a93", "value": "3670997c8c2669588bad5b8c178dedd4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671219274, "uuid": "0634f76e-fa77-45a7-bcdb-e8c0dd17beb0", "value": "3072:iJVCuxLx3DV0RkKkUTcra0TPlX2Nvo1XLszXS0yro240zwUzQRKF+:kMULRDYyra0TPQ8XgzWM240M2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671219274, "uuid": "cc79a68d-cb51-454c-99db-568ca66f9444", "value": 218112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671219274, "uuid": "9f5a54b5-8ff3-480d-8a13-40a04282b9e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671219274, "uuid": "24e64ca8-1908-4ac1-b5cf-c8ab9b8c33c0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c51590bb-7d17-11ed-9db1-42010a9c0080", "comment": "Malware payload (RedLineStealer)", "timestamp": 1671177656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177656, "uuid": "5693ed93-588e-4130-a630-7d0987ca3cb4", "comment": "Malware payload (RedLineStealer)", "value": "2ddc73f4587ec5b8789a888af4f89875", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177656, "uuid": "a56f5f7c-c26f-4e81-a483-86d10ed5a9c0", "comment": "Malware payload (RedLineStealer)", "value": "d442cafb41f6040d52df52f81a3b4acfd1f722ab0781c7cbc700cfdc78f85590", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177656, "uuid": "d6a08be6-3ba2-45d0-9517-f670c9480672", "comment": "Malware payload (RedLineStealer)", "value": "e5d19d29e2b31fefb6ee9a959bcd1df3075cbf5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177656, "uuid": "4e72027c-ddc9-403e-90f0-a9102d04f6cc", "comment": "Malware payload (RedLineStealer)", "value": "410224065123af83043729eb6e6e7986675b30dab5c7e831ef84b4abc5ad81d2edafd504da64332e380e47b7a6a2ac65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177656, "uuid": "7840d60b-216e-4a3e-ba10-fcc1ed21d1ca", "value": "T1AD74F1117371C432C09F19308566D6E1ABBEED321E72965737716FDF6E30A80A67A30A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177656, "uuid": "e8c572c3-127d-4a99-9eec-a4f47da16999", "value": "b35462da489bc13bae884e55b5227599", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177656, "uuid": "04853404-ac5a-422b-ad70-074be912c76e", "value": "6144:KPnkVLOd8wZHXlig2Sn5D8QkdEGfs865/quAMiL2h3ytI298qMrc:KPnkVidxVljj5gQgEGfyqRMiL2kee8n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671177656, "uuid": "5830ddda-c983-4a75-a4c0-57fffb7a1dde", "value": 355328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671177656, "uuid": "843345b6-d40f-46a7-8ec4-69c1ac7e7f9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177656, "uuid": "3179d267-172f-4712-99f0-0fdb8c6d06db", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b299ecf6-7d0a-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671172041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671172041, "uuid": "44e6e51e-4f1d-4d0d-9b97-925b666340ce", "comment": "Malware payload", "value": "704bdf8846dc3b28044ca91d67caf747", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671172041, "uuid": "12eff146-65b6-4842-938e-a7d48cb7a491", "comment": "Malware payload", "value": "d4c0cb5e9b6e52ff60edcb98ec30081a83a0e1949728158e52a5c1bd63ece478", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671172041, "uuid": "a42421b0-beed-41ca-b6f5-395f90dd000c", "comment": "Malware payload", "value": "023937ab95bc9b3e1bec825af94110e1c06b8864", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671172041, "uuid": "09d9c1e4-286c-4fb8-a8d5-3f4d4cd46078", "comment": "Malware payload", "value": "4827da6a67cdb54087b96a2ebea8dfee43290088c5e00ff01d9923912f4c25559d3b844997daf3f0455165d20c67bcdd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671172041, "uuid": "35b27b19-bfc8-4a77-a6f8-1fa9854637b7", "value": "T13EE1C70293999737DEA78B7A6CF323821279F7969963CB9F1CC4D24B7C017C85A51B20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671172041, "uuid": "7272f4f6-0b7c-423f-b74f-9cc67ddfeb4b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671172041, "uuid": "896e2533-d843-45cb-b7a8-b6f80491ee5d", "value": "96:ncpWkBUZ5ECxaEtKJ8OdrOzEyTsk1xRdbFnU:nKmECIgKHwzrT1130", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671172041, "uuid": "a2fc3436-845b-47f1-a608-9d9989985397", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671172041, "uuid": "5a164736-ae71-4ea0-8717-082d2c810731", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671172041, "uuid": "4319df3e-1c5e-4039-85ae-d69f3bff230c", "value": "SecuriteInfo.com.Variant.Marsilia.5818.25860.14211", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f80739e-7d5c-11ed-9db1-42010a9c0080", "comment": "Malware payload (AgentTesla)", "timestamp": 1671207201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671207201, "uuid": "7de5e38c-2717-4ec8-ab5f-f0ade1e7e587", "comment": "Malware payload (AgentTesla)", "value": "50ff3364a56f0deda9654332fbd4e01e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671207201, "uuid": "08baf232-d905-4924-95fe-bbd991fac572", "comment": "Malware payload (AgentTesla)", "value": "d526dab9c080204906723ff1db7eb667463273ac6b9f4293370484b9980cbd13", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671207201, "uuid": "dd081693-4244-4ba7-9174-fcef17de934f", "comment": "Malware payload (AgentTesla)", "value": "0496d23b4edd5d88934a5431c3691dde964c529f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671207201, "uuid": "f9041931-7469-496b-a771-a1b14131b38d", "comment": "Malware payload (AgentTesla)", "value": "7a5a8ebe6e9ed5cfd94b17b7676028f1d75081ce51a325914fe75b078823fec9fbcd535291efd834c3305e2ea595ed57", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671207201, "uuid": "1d55b0fb-7e9f-45d1-ab83-f3aee6381fc8", "value": "T1F95423165A081ABED433C9EECC4BB5BABE47600A645FC8743E423DE89500A1F761DA8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671207201, "uuid": "7ec2c87f-42d3-493f-9b12-b57ef97753da", "value": "6144:AhPQ3Zp8VbrJ7olS+MO/ap1UHMKoXlG8oGT6HmTfExDzD2mnIv:w28Rd7FOiftKU5TOmfu/Dfc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671207201, "uuid": "bba322b7-e981-44fa-a66f-df855726156e", "value": 303888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671207201, "uuid": "420a634c-f745-4a85-9a1f-980b01e6e180", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671207201, "uuid": "957498d3-994e-42c2-9e70-539db5881765", "value": "Shipping document.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "585c6244-7cde-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671152992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671152992, "uuid": "5f74c679-4a1a-4bee-9499-c7d19df9480f", "comment": "Malware payload (Smoke Loader)", "value": "e11d7d46288998bbcee1d87de104d4dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671152992, "uuid": "d7699e07-f7d6-4985-a177-aad69d4c13e5", "comment": "Malware payload (Smoke Loader)", "value": "d63f4904bcc929b4abc5f3ab18f26b98a1d8554da0532eb842172d66ab148127", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671152992, "uuid": "5c6beba5-812c-440e-a0d2-8495af467a53", "comment": "Malware payload (Smoke Loader)", "value": "f671c1e1e87e7fe82e6a77ccc6e0cb2a00dfdf3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671152992, "uuid": "08f56123-a4ec-4b76-8fc2-366f4957b6af", "comment": "Malware payload (Smoke Loader)", "value": "4824e0ccd12ce5952364888c0a6b296f54c647e5f0cf24a6d3c63ff95c720109e675bb2084dac6cb3de1cd06c299a767", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671152992, "uuid": "b11b4c91-af64-4caa-9afe-d521361f85f5", "value": "T1C374CF107973D4E1F832C9754826FBF46A5AB851EAE1D6333319D71F9DF02A38A2A305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671152992, "uuid": "c9687eb6-d06c-475e-bf76-a41e6995efdb", "value": "2067eb05796787c0f2b3dc09403197ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671152992, "uuid": "a6933de2-0d11-4cf4-a905-946cedb2f6b0", "value": "6144:SjYQ9LhPKk7xP/gxta0C6kZ1k9o5M5yfDpk+0iPvzpQ6ijLxQFiaI:S9NKcNIc0PkU3kDJxnzpQ6ijqF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671152992, "uuid": "61bebd8d-16a2-4561-9f86-237b3d410815", "value": 340992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671152992, "uuid": "26641949-d813-44eb-9a64-662574200c98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671152992, "uuid": "4c213a59-79d4-46dd-b403-fdfec23bce48", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4137d1a1-7d18-11ed-9db1-42010a9c0080", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1671177864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177864, "uuid": "1ff46d06-b247-4c7b-af1c-58935f0fb438", "comment": "Malware payload (SnakeKeylogger)", "value": "e9b2e64ddf17c71449d3563e85dc6f79", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177864, "uuid": "3b2b9b60-20a7-4cc0-9fab-2499a6c389d0", "comment": "Malware payload (SnakeKeylogger)", "value": "d7335453c1381c8325550e7e3c3a49ff25ac4d5f6f6a6809ca7fc0c8f0e82bfe", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177864, "uuid": "93f0169d-578f-4ee0-a057-49470be9d850", "comment": "Malware payload (SnakeKeylogger)", "value": "db54265036a3834cd83b3d9d0eae9a15c3619871", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177864, "uuid": "2cb60d26-b7d3-4d3d-9377-23ad5e2dc97d", "comment": "Malware payload (SnakeKeylogger)", "value": "cfa5aef7161a313f777f3cc64d664124636ef7a20454501ed7656c871f00204974c8f2fa244c027e435a587eea6bf80f", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177864, "uuid": "44014944-1259-478f-b7e7-dbb825a5c4cb", "value": "T14553D50963980275CA7182B638A7634AD733E39B05F75BA574CC960EBF232869323795", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177864, "uuid": "5b216850-b9d7-42e0-8248-6b59248dfe5e", "value": "192:fXtl3ME29E9Xw0XMUWr5kSM8stYcFmVc03KY5X:fXLM+9Xw0XMHiSMptYcFmVc03KMX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671177864, "uuid": "7d2c3282-3c5f-4757-ae1b-3c137ddc39bc", "value": 61440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671177864, "uuid": "1b931163-70da-4973-a56a-b9802605ff1e", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177864, "uuid": "ef12e25a-d358-4092-becc-a5df3dced7cb", "value": "TT12052022.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2990b058-7d78-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671219056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671219056, "uuid": "f5990007-3702-4beb-b2ac-e92aa78a149b", "comment": "Malware payload", "value": "8ec8c827bf6f89455740a2abc66dc40c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671219056, "uuid": "d30966b0-3874-4078-9eaf-924565a3cd8a", "comment": "Malware payload", "value": "d75930cf740d7678d770fd77db1f4612d8e6d41f6abffde531703460c1a957c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671219056, "uuid": "1b148cde-f991-4156-8456-4c0653a3c22a", "comment": "Malware payload", "value": "c5108dd63375888d6bc0008cef2eacd7cfbf8c62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671219056, "uuid": "742066e3-880b-4902-aabd-d979df4345b1", "comment": "Malware payload", "value": "1b7d3eb7b972b9df60ab0f925f32c0914e37b5964ae868546e9db9c8a0cdd79d12b76cafaa4cf7bece18d414d3a699dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671219056, "uuid": "45bf6065-6744-487a-97a2-9f7906b0fef2", "value": "T1E0B5237EE88411B1CCF386F838255D729AF76D176931C49E3B987E1B3BF28C1A50614A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671219056, "uuid": "91d140f8-769a-4c24-a08d-a80f97e1e42a", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671219056, "uuid": "4846dc3b-35da-4cb1-85cc-ee6d92699b52", "value": "49152:0pFKFZi62ZI0+VIbF4DSyjMWR7qc6e32Q7w3MPFAwg7SjheOCgSY/im7:0pYFZiDZf+VA4u8MWReGTDPGwg7S1cYV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671219056, "uuid": "666b83a4-b3fc-453f-a073-3db7191b2850", "value": 2441782, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671219056, "uuid": "92261e4c-d929-4dc1-af37-8ec730bd8934", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671219056, "uuid": "87ba61c2-9299-4e62-ad0f-740a49ab3414", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb0d7f86-7ce0-11ed-9db1-42010a9c0080", "comment": "Malware payload (AgentTesla)", "timestamp": 1671154097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671154097, "uuid": "31c839aa-32a9-4bc3-a5d8-e997db9cd8d6", "comment": "Malware payload (AgentTesla)", "value": "309cfd9a000ab82aaaf7539bb95dd6c7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671154097, "uuid": "1140733d-0d9e-4f35-849c-8e29748e96c4", "comment": "Malware payload (AgentTesla)", "value": "d7a4c03c74a241e626a6bc16038d62a07b9fa1eb9887da3353c1a9df96d78839", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671154097, "uuid": "712a9d11-31ff-461a-bca7-5d3383b9da7c", "comment": "Malware payload (AgentTesla)", "value": "0f5325f27fcdde4651cc2a1c980eb551bedd4a87", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671154097, "uuid": "b14164c2-0849-456c-b16e-5cb40877d1f9", "comment": "Malware payload (AgentTesla)", "value": "fa329e256fba63d707f41670d90053e7794a94daeff835f577bba5be5c484b1e2317bf26fbc8dbb37dcfb0c972539ffa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671154097, "uuid": "caf43c18-c6fb-4467-8d25-c053131b1b5d", "value": "T132D1C70193F952AAED7D733C68AE471073EAB7833842DB5D349C221BDEE535009B56B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671154097, "uuid": "658906ad-dda2-4e9c-bdc7-947aa8d6a23f", "value": "96:dLu4KNcKyl57dprueRS3v0cCZT4yvYDUEVlu3SjsLh1zNt:luFfCbcoPYDUk0Cjs9P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671154097, "uuid": "e778c984-cae5-47fa-be80-e0b7781334cd", "value": 6656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671154097, "uuid": "dcf44016-d065-41f8-a0ca-c74384c13aed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671154097, "uuid": "076e96dc-96dc-4ea0-b0c3-8da51acbe73d", "value": "SecuriteInfo.com.Win64.PWSX-gen.29126.15165", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdcd46a6-7d14-11ed-9db1-42010a9c0080", "comment": "Malware payload (Mirai)", "timestamp": 1671176355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671176355, "uuid": "c63e175b-84c3-4fe2-a78f-ae417ad897f8", "comment": "Malware payload (Mirai)", "value": "d2b099cd13d4903472aa9752bf5c6f31", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671176355, "uuid": "55462942-648c-4391-af9e-bc6495528cf3", "comment": "Malware payload (Mirai)", "value": "d8913948ec121dba3e87594feecffc26080a23add4f9d68851f99508a93884aa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671176355, "uuid": "1e312560-9847-4ed7-836b-e22bbc43d287", "comment": "Malware payload (Mirai)", "value": "88ff1b0e1baca2bba0ad64e836d449c9c42b29e7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671176355, "uuid": "337ff544-71a1-4bac-8f47-93407e38d849", "comment": "Malware payload (Mirai)", "value": "fa59e85971fceeed7461475b0e5f4e78cabbdd2813af05d8f6163d71593afab83850107bec60203ebba9d564c377bc9d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671176355, "uuid": "8994109a-4702-4b0a-b780-8789c0c60428", "value": "T177432B95F802DE7DF80FE67D44164E09BD3063C261830F2A27ABFEA36C720966D56D46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671176355, "uuid": "4eb8e931-6831-4fb4-b8ba-a92820d67b7b", "value": "1536:/+dPsTgnLbMuv5tAbaXnb7f98V8TWl9ouSQy8fNLsA:23rAbobZ8V8T4oHQD1b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671176355, "uuid": "b39175d6-289a-4b77-b3bc-b1d21cbdfdb5", "value": 60452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671176355, "uuid": "4727dc35-596c-44bb-b209-16f6846b7b73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671176355, "uuid": "4b09d866-6317-481d-b6fb-5c2774277f32", "value": "d2b099cd13d4903472aa9752bf5c6f31", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4123240-7d18-11ed-9db1-42010a9c0080", "comment": "Malware payload (STRRAT)", "timestamp": 1671178030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671178030, "uuid": "0c70e855-0da6-42c5-a89d-42b551b16b4f", "comment": "Malware payload (STRRAT)", "value": "39b0de1a6d74b5049feba881f9c430d6", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671178030, "uuid": "6788c244-e385-4d28-ad5c-08ca876e9a12", "comment": "Malware payload (STRRAT)", "value": "d8c04d3a6e6e5058c10a56890a9dcf41ac5e47a22dc1002e89415ee0f37c7f05", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671178030, "uuid": "cd61b545-9035-486b-91f0-67a082a1e312", "comment": "Malware payload (STRRAT)", "value": "012d378caf4b47f4a44072dd6e024ffc11c12e20", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671178030, "uuid": "98c65f73-d16d-4c38-87b6-7284c7e8bae3", "comment": "Malware payload (STRRAT)", "value": "d71947ab927e6452c7ad3ef7ee31b1d17a2c5cca259b5e31434258990bb59296c0235c45647fd32257fcc848f21291a6", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671178030, "uuid": "f2f62354-127a-4076-be07-0d14d8bfab63", "value": "T14955BF02FA638372DED143BD8D0B97618E75ED248732C4472AE8BB4C2CF559566DA3C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671178030, "uuid": "9a24826b-d034-4b8b-9d3b-4da43aad2800", "value": "24576:HxagTy0aExf73p2+iSb4CX18DLRijx150Yo9y:HxagTyWxfU8bPXkLR2dL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671178030, "uuid": "df782d34-2af8-49fa-8beb-a0d5c4ddbb3c", "value": 1400291, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671178030, "uuid": "d751f76d-a700-4865-9e54-3bc1684158e7", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671178030, "uuid": "d51d7ae1-9a84-4b26-9db8-2bea7b983d80", "value": "39b0de1a6d74b5049feba881f9c430d6.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e52a09e-7d20-11ed-9db1-42010a9c0080", "comment": "Malware payload (Amadey)", "timestamp": 1671181349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671181349, "uuid": "41dd6854-cecb-41bf-9432-d5944b8aa8c3", "comment": "Malware payload (Amadey)", "value": "1a97c4406f348d25ead8d0602ad4bc76", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671181349, "uuid": "d879d17e-d9fa-49d4-a67f-fa3b068b268f", "comment": "Malware payload (Amadey)", "value": "d8f86de2df70991a48c9833e906bf0d39d731335e3055ecc1a32b150a5296709", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671181349, "uuid": "4a71700c-ea2b-4ea5-bbf7-2350459dab4a", "comment": "Malware payload (Amadey)", "value": "22e5a1098ab941bd29ccc584535db7e70dea21d7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671181349, "uuid": "5df9ca90-9c0c-496f-8e7f-ba99391879c6", "comment": "Malware payload (Amadey)", "value": "09a6aec825fde1c754973cd5f79d7fc9ef42de4d272e712cd30105f9481ca34c2ec8f0bfe21277d530ba9759b0e1019c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671181349, "uuid": "dd51ea5d-e81f-495a-8140-3e269534ca79", "value": "T1F354E121B3B0C872C51F05308465CBE0AA7EED316A71A947377676EF6E30A9152FA30D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671181349, "uuid": "66ea25b8-d4e3-46ce-8f6e-29d37853411a", "value": "b35462da489bc13bae884e55b5227599", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671181349, "uuid": "8a1104a4-5572-4c63-be69-cb908a183f3b", "value": "6144:tUk2LiaIHxnaoo2WoBUqraScFELtf8qMrc:tUk2eaSxnaz3qujELx8n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671181349, "uuid": "598ca41f-b8b4-46e0-a800-cb61bec9a0ce", "value": 293888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671181349, "uuid": "6c572304-6eb8-48f0-8239-442c4424ca41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671181349, "uuid": "63177a21-d66f-4774-864b-05b56a6bcf68", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "996333a9-7d50-11ed-9db1-42010a9c0080", "comment": "Malware payload (AgentTesla)", "timestamp": 1671202064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671202064, "uuid": "49ed3cff-98d1-4a68-92ff-44f048d9a255", "comment": "Malware payload (AgentTesla)", "value": "8d86c96a7c5fc4396a0af3636251758b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671202064, "uuid": "e647fb1e-244c-4f85-9a26-935bf6dda770", "comment": "Malware payload (AgentTesla)", "value": "d948e2e5b7923679b32213880208686393e5900de3fd81d292a11eaa79cd90cf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671202064, "uuid": "124019da-9127-40bd-a0f6-c4bbb6397e36", "comment": "Malware payload (AgentTesla)", "value": "4484647fc1cf7e42a40f68b7ab04f960391081b2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671202064, "uuid": "312d18ca-f9d1-4e14-988a-8f600fea8ffb", "comment": "Malware payload (AgentTesla)", "value": "98b21fdbc6956f38a15631d103dfbfefa505a14a79204604ee2f0359a1446a742fc05a68a2e9dc188ec210ebf40b3fda", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671202064, "uuid": "0fe5dd4e-3754-44eb-b12c-ce7d16049a47", "value": "T1B564236E50F58E299FB8C9F85D2C1573DD2EC6B012A91ABFA60F05B855BDF1C7240AC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671202064, "uuid": "d6144630-c8d5-4733-8dd3-7b2c564382d0", "value": "6144:ivr9Lb5IHXwl0vXZl/takuaEOlWXyK1ar53ha5+XxS0PQr7DtN8eoCuObr2I51qF:ivr9L1xoZ1buv2WCt3k5DF7n85bG2I52", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671202064, "uuid": "525a51a3-e7a9-4c16-a038-dfa213411e95", "value": 330846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671202064, "uuid": "4b7b2147-821d-4938-9562-357cbe5d4511", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671202064, "uuid": "986007a3-1c89-4037-a57a-bfd398ae38fe", "value": "Pro-forma_invoice9122022.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efc82ab8-7d4f-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671201779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201779, "uuid": "15609a8e-3c00-4025-9079-f4b90a57c8e4", "comment": "Malware payload", "value": "d5173d2ad2c0d0f487452a7ea10edbf8", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201779, "uuid": "99d29162-0f0e-46a3-af05-a42b05b1d8a2", "comment": "Malware payload", "value": "d949ef27afd6e2665a14bf2c3e99402cc4f367288d9a3437b817acffab723048", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201779, "uuid": "6a062079-0e16-4879-b4cb-45452e50d223", "comment": "Malware payload", "value": "ddb2c1bda8ced1ea9e473edf3a1de721f4bf3f60", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201779, "uuid": "4e132045-35ab-4dc0-9c15-4b2de3d7f9de", "comment": "Malware payload", "value": "62e5db7c58e92393cb79a7fbde3c4b8f33e8f8c02a5030c7d2f7245b37b0bb5f5f0395a1b056dd07f68071d4638a52e8", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671201779, "uuid": "a8216624-7f4c-414d-b265-485ba554cd85", "value": "T155C29306F689DA05F26602345C9BC6D8B62EBC0D8E51920FB7107F2EFCB17B14B66395", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671201779, "uuid": "7f5ada4f-3701-4c2e-8b9b-3c5dff4a2461", "value": "192:gNrtUg4Ig3gZ0yZEo5yGc6ri5bv/0yllEA9Q04j:gNrtU1OZPyGcS2rlD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671201779, "uuid": "7b3c462a-1c40-4a53-876a-3c7bc12cddff", "value": 28160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671201779, "uuid": "8c959462-22bf-46d9-99fe-7e6f3e324361", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671201779, "uuid": "09c0569f-8c1d-4776-a4e6-43c76bb8395f", "value": "Dear Email Owner.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2506ee83-7d23-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671182541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671182541, "uuid": "39968314-80b2-436e-8366-17fdcbb6e6a8", "comment": "Malware payload", "value": "be43e87f58862ecc790e03f977012306", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671182541, "uuid": "ab4ca065-146a-4c6b-b31b-32ad6eefe54e", "comment": "Malware payload", "value": "da4aa0c813563b0d7f7a6fff63c496489ea7138b870949e7a79d6ebc27dc59e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671182541, "uuid": "cd442319-2a2d-4679-8d49-1b1b7ea8450c", "comment": "Malware payload", "value": "27475a9300cc66ad71e99e8bac7ea7b78acda6cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671182541, "uuid": "a4a0fd51-0a1d-46ed-b72b-1836aea1adcc", "comment": "Malware payload", "value": "1cf986314f4b02fe9ccec1df0393edba75b4aa4def7a955590b967831387063b815291d79748ddfe78142364b4237f9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671182541, "uuid": "10a6c837-0cd9-4c3c-a3f0-f973d236f31c", "value": "T1C3D1B60192FA45B6EC6DB33CA4AE4710B7BABB977441D75D34AC120ADEE135008F56B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671182541, "uuid": "8bc75b66-0460-4cec-be40-1546e87c6630", "value": "96:kwpL+4KNc1wl1+ClMs6oqCotNTJ3DKVlu3Sjsrh1zNt:ke+F9rHjeztv3Du0CjsdP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671182541, "uuid": "640424f1-bdf1-4862-9f37-e316f2dfa9a6", "value": 6656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671182541, "uuid": "b5dfda86-6fdd-4be7-9f1f-f0d617cede83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671182541, "uuid": "f8fb99bb-dcdb-4ede-acbc-5672f3797947", "value": "Swift copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b38b7b3-7d42-11ed-9db1-42010a9c0080", "comment": "Malware payload (AgentTesla)", "timestamp": 1671196027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671196027, "uuid": "b389b8b8-f7eb-4736-9cb5-3d27b8f225dc", "comment": "Malware payload (AgentTesla)", "value": "47b24b8f0958e6139b703ad4dee06a57", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671196027, "uuid": "cbdd5599-c874-4a1f-bab4-479065eb405d", "comment": "Malware payload (AgentTesla)", "value": "daaccf41b392b7619f284cf62dc713cfb8af98b561f4af29a78ee718cf579a56", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671196027, "uuid": "6feede14-a2a2-4928-89f7-40b1a7f22e23", "comment": "Malware payload (AgentTesla)", "value": "966553d9ba482f49e281791b1c9993a847921e00", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671196027, "uuid": "2244ce0a-4c14-4d1e-8a5f-f41733e2d989", "comment": "Malware payload (AgentTesla)", "value": "6d92d8b66b50d8db52616b869a2eb8cd2994959f3eda044e1bb71d0a5690d3df29d201a8cc022259e660316f09f7c488", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671196027, "uuid": "4939744d-6b07-45c9-baac-28982270ac4b", "value": "T187E4024D7326D52BDEE4E971F8FAD04506F2BCA98D61CA2D304336AFC271B9C9A14706", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671196027, "uuid": "29620973-7f8c-4fd0-8049-e36633eba38c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671196027, "uuid": "1ae689c6-abc7-4960-ba1d-d148a9c39b08", "value": "12288:ZPuYd+V6b1momPZefxSgsM7hO4Oy+39sANyRuJoBgoAH9VrCZIcqjYrPuYd+V6b:ZPuYd+V6bIomxixOYOTTNyRuJouN95Cj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671196027, "uuid": "fdfdfe1a-ee7c-4446-b6cf-b37754d0eccd", "value": 704000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671196027, "uuid": "cdc9ff9e-13b4-4eb8-be1d-90f79cd16072", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671196027, "uuid": "31d8b8ba-b969-44e1-8e28-1aabfdf52e46", "value": "PO-4526738902_12052022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "906bf45f-7d3f-11ed-9db1-42010a9c0080", "comment": "Malware payload (GCleaner)", "timestamp": 1671194747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671194747, "uuid": "e3d41c10-166b-4837-a214-411bd7e3282a", "comment": "Malware payload (GCleaner)", "value": "7fe640f9f6251601012eeecb984b00a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671194747, "uuid": "bc4c2363-6814-471e-9a44-dc1602d2a23e", "comment": "Malware payload (GCleaner)", "value": "dbadd25ba3f6fce8eb3ad77277c0c5d2b307a7d318c0dced326136f728b98f01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671194747, "uuid": "8d1af2a3-40c8-444e-bf2b-894b3062968b", "comment": "Malware payload (GCleaner)", "value": "a6fa9010b3009fa09f7af8112e294b1ea5a35985", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671194747, "uuid": "c4bec548-295b-4a11-b0f1-aeefe51783d0", "comment": "Malware payload (GCleaner)", "value": "0456d2e5ccdf6471c25524efa2483e02c6109fe3f712d7679d7822ef09eeb498f607b52fabc0468620d39fb322ee55e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671194747, "uuid": "d4e1618b-567b-4d4d-8c23-809a260d7bf0", "value": "T10EB5237FA5800471D4F34AF93C7B1D2259D66E236828C5AC3BD83F9B7BF5AD0580960A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671194747, "uuid": "ddbfa77c-ab55-4fab-a184-b217a204f642", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671194747, "uuid": "f11841e8-7ffb-41e4-936f-79dbfa1b94a3", "value": "49152:IpBTU8JPmACZEyuN12fVNgiV5fCMGnTeJrEqtluzeOCgSY/im9:IppJmAvyMbi/DueJ3t4zcY/im9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671194747, "uuid": "571780b2-8ecd-4712-9560-707fe72d0943", "value": 2399666, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671194747, "uuid": "15b33d96-cdef-4330-bf66-1d5f298e7fe0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671194747, "uuid": "3f9da7f7-896b-4376-b2c0-b4391681cb1f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfcb15f1-7d9c-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671234797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671234797, "uuid": "056c2f81-aae2-4cf4-a72b-ae3137791f34", "comment": "Malware payload", "value": "cb8c3c7fc367018dece983a8e2e633bf", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671234797, "uuid": "87e893f3-4501-4afc-9fe6-f4686b7da09a", "comment": "Malware payload", "value": "dd20d29f9571400b35455b7d7423c5700b74bb6f218d6525f880bdf5e2ca63d5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671234797, "uuid": "fe9d4e95-aaf5-4c4b-8c09-f498911e0984", "comment": "Malware payload", "value": "e1d8768df1c35ef0893fbc5f9a5333a726f8443c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671234797, "uuid": "0d117c8a-f527-4272-b5c2-ce2f34db3eea", "comment": "Malware payload", "value": "6e9d46d85e530011f989e71f666597e6f080836cc1f73cc4f1b2e713a4b5a06140c0470cfc0314492357fd64ac27ba86", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671234797, "uuid": "97208a1b-947e-484c-9aa8-c04776077d49", "value": "T1CBA36251B7C1688422AF9FB2B72FB9E5FD1A09BA3954084BC400FFB06DB5615EAD0D70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671234797, "uuid": "1a438e68-0666-4d1d-afd0-6e30aa2e1b37", "value": "3072:iZsERoDO9sNpFjF9x3ZcMyeqVfE7EWnApf2:VwomsNpBF9x3ZcMyUESApf2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671234797, "uuid": "5b7665c5-c4f3-4f4a-81e3-6b75af947bd9", "value": 101761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671234797, "uuid": "608101d4-45e1-41b0-b663-5bcca1678fe5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671234797, "uuid": "21acc817-ae82-41cd-8466-760b628f949d", "value": "AutoUpdater.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66824d7d-7d9c-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671234620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671234620, "uuid": "f4828839-5bc5-4ac8-9624-32e86484c212", "comment": "Malware payload", "value": "af14b0d8c758daabc01c3e7875a76785", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671234620, "uuid": "1f68de68-2822-49c3-b16d-acb13ca21125", "comment": "Malware payload", "value": "de391649878b1eb9c9e25c07774553e6dd8f63200d5bb536e12b61ee2f9ecffa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671234620, "uuid": "f768d9ac-212e-47cd-8d7f-9eda80ceb01b", "comment": "Malware payload", "value": "ce22d5cdc4caf7f2ab0015ea5925e5f37cee58a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671234620, "uuid": "e8d416ff-0438-4650-a04c-3f4f9ed0740b", "comment": "Malware payload", "value": "2a24a83c74eab7e4d07698264deabb7f39445ed28ff2a87a5da4e45795ef29f6f2c43833b1fef3281e5448696030c60a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671234620, "uuid": "05a26318-4fa4-4564-a39c-b99f43f82de5", "value": "T1BF74E0F13690E02EC152CB304C21E2D9693ABC155B3255F327183A6F1AB56D099FE7BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671234620, "uuid": "860d0f0e-c234-44cf-a50c-1e0656e847a2", "value": "e6bd3d9b5d23304bda5e80b81c28964e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671234620, "uuid": "768b999d-3f12-4073-9315-b62b47a59302", "value": "6144:j0Lj90f23OPx/XT4QWoiuE1p12lhyoUMA0GP+PFvgzSi40M2b:j0fWOe6oi7TAl4dRP7u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671234620, "uuid": "855d4289-d6e1-4b09-9fea-574654b17ba9", "value": 341504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671234620, "uuid": "9f11e06b-9d3f-40f3-bdb3-592f5378dd31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671234620, "uuid": "941dcc96-a9f5-4e53-959d-91a5303a226a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37174b45-7d17-11ed-9db1-42010a9c0080", "comment": "Malware payload (Amadey)", "timestamp": 1671177418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177418, "uuid": "f08e6e6a-9962-4517-9013-7b8e3331cf9f", "comment": "Malware payload (Amadey)", "value": "e1f60dea728d0607cd3638406dca87bf", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177418, "uuid": "03747248-bfa6-4859-87b8-c0741e608f6c", "comment": "Malware payload (Amadey)", "value": "df659e6350471addf6200bca3571a658511e9ccbc57a27707a33d8d096d08334", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177418, "uuid": "d2c3d3b1-04d0-4887-99d2-cfac8cec2c8e", "comment": "Malware payload (Amadey)", "value": "640d8340ca1c54b459975178de6df85941996766", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177418, "uuid": "65ef722a-e58a-44e3-be41-ba53eaf68adb", "comment": "Malware payload (Amadey)", "value": "8eeb5b5d51f90fa85a673f5225af6b5e05cb8cdf6e34b5669e698d3738862a2885d5e827bf41de5b120c03d54a0a2d88", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177418, "uuid": "45af44e8-7c9a-4a5c-8da3-625837763623", "value": "T14454E11172B0C432C19F59308C66D6E15A7EE9325AB1560737723ADF7F306A09A7B34E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177418, "uuid": "666120c6-1157-4ce6-bcaf-9a1a593d6cfa", "value": "b35462da489bc13bae884e55b5227599", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177418, "uuid": "3a533ac1-7369-4cb4-94a6-ee9b2df026b6", "value": "6144:8DDk55LX6kIDxTHFBExkjJe0tgAB7bitfV6R1M8qMrc:ADkXb65DxbFBE+jIEgm7biT6Y8n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671177418, "uuid": "52ab5847-d8bf-40c3-9426-597ec3760951", "value": 293376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671177418, "uuid": "b08baeab-19c8-4c4e-ab78-3ac9c4e07c34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177418, "uuid": "c34d573f-8156-4088-972c-62cab5391fec", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16d76995-7ced-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671159325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671159325, "uuid": "b69f91bb-9ab2-4ef1-8861-21bbb3fdb0d4", "comment": "Malware payload (Smoke Loader)", "value": "ed1121d2ac7bd98bc353749ab12d5a81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671159325, "uuid": "53e18cf7-0825-4410-b999-2fab930f5179", "comment": "Malware payload (Smoke Loader)", "value": "dfc6e20b44bb80c4a1f21054f326497c81bda2226a4db22b009b4896bce2f2e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671159325, "uuid": "e817e0f6-1028-45a7-ba18-b14bfff8790b", "comment": "Malware payload (Smoke Loader)", "value": "da865d0c9398f9be867226f1e00256bc76ec9d9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671159325, "uuid": "e210ede8-36d7-4a75-917e-08d0ee28f238", "comment": "Malware payload (Smoke Loader)", "value": "cab7d14ea0c9363d70f6ba04d4ba37a7bfff2ea523edc2545026500b8cbef61a8a0d4eada409208e7f2db202c85efe1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671159325, "uuid": "662757e7-5d6d-4dfb-bd67-8c0ee632a63b", "value": "T1A874CF007AB3D4E1F873C5745C26EBF46669B8A1EAE9D6332319D71F9D30393852630A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671159325, "uuid": "ad869f07-edd8-487e-a36a-2b72c23e2976", "value": "2067eb05796787c0f2b3dc09403197ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671159325, "uuid": "ddf34286-8ff0-49e1-ac97-f8a8a6dfe927", "value": "6144:OzYOoeL+lJpgbGzbDyubF3rAQXZKl+wjb0iPvzpQ6ijLxQFiaI:ZeWpQGnDyup38Q4xHxnzpQ6ijqF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671159325, "uuid": "9c46a7cb-2309-42d0-b0b0-3fed4deed6cd", "value": 341504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671159325, "uuid": "bdcf5081-67d4-4b5b-92ab-202ebfc2b743", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671159325, "uuid": "7a3857e8-cafc-423e-a7fa-2374ef855390", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1096c5c8-7d07-11ed-9db1-42010a9c0080", "comment": "Malware payload (RedLineStealer)", "timestamp": 1671170481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671170481, "uuid": "fab94345-4c3c-4058-af9b-7789dfb2ba98", "comment": "Malware payload (RedLineStealer)", "value": "d2744bfca25b9dc2626acbe6577e8de4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671170481, "uuid": "3e812853-dfce-45bd-9ebf-991712e1e1fb", "comment": "Malware payload (RedLineStealer)", "value": "e1a18f0c3c17e89784482e9574c44c3e5878e659a6e0abc71fb24bcc1078f89f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671170481, "uuid": "b312a2ff-7730-4991-80e2-4dc3569a1853", "comment": "Malware payload (RedLineStealer)", "value": "e94066711058e0dcef652e4b6a73ada18e2cc842", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671170481, "uuid": "da4d8a12-2759-4401-a9a3-8c29fc4b9944", "comment": "Malware payload (RedLineStealer)", "value": "0e9894beab2daa734cd88f441c3807d8af9f7a7535206ec99d9814d754e81dd119711af2b9564ac5384d28878a58fd21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671170481, "uuid": "2cc08c7f-b13a-40c7-92af-9e23f32e4673", "value": "T1B974F110B1B1C471C59F013088AAE7E42E2EFD714AF15A4B773977AF7E30A90597A34A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671170481, "uuid": "fc58f0cf-d65d-4553-96da-c00eca7778f1", "value": "b35462da489bc13bae884e55b5227599", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671170481, "uuid": "2c608d11-e0f4-41ba-890d-6b7f91e4ab67", "value": "6144:08kzLHWhpebIevDmJ5CNu7CUN7qv+2ilTCUNpLxTCZpD/I6tiQ8qMrc:08kzbWflqDmz9N7qWjKDg678n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671170481, "uuid": "d218d6ca-131d-4b8a-9fc4-8224c8670209", "value": 355840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671170481, "uuid": "c9a3e800-636d-4e9e-a4e8-11f3f338954b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671170481, "uuid": "4321ddd0-92d3-4432-b75e-a6c265e4b5ea", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f37f1019-7d4d-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671200926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671200926, "uuid": "985618dc-fea6-4d45-932c-18a91f2370d7", "comment": "Malware payload", "value": "adebe32cba2a072790e25d6d8ea87c9f", "object_relation": "md5", "Tag": [ { "name": "45-153-241-207", "colour": "#86D11B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeGaliXCity", "colour": "#607CCC", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SpaceCity", "colour": "#5EBE6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671200926, "uuid": "a818c591-e908-4012-88c9-639ef22a0a6d", "comment": "Malware payload", "value": "e248843812031027dd510d9dadaf973dcf15a1f081fceb39069170f8b2168882", "object_relation": "sha256", "Tag": [ { "name": "45-153-241-207", "colour": "#86D11B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeGaliXCity", "colour": "#607CCC", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SpaceCity", "colour": "#5EBE6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671200926, "uuid": "53306b15-50a5-4e85-b12a-99dd2ca9ee6c", "comment": "Malware payload", "value": "27990ca7b87ee8f0de27c498d598118830bc26e2", "object_relation": "sha1", "Tag": [ { "name": "45-153-241-207", "colour": "#86D11B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeGaliXCity", "colour": "#607CCC", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SpaceCity", "colour": "#5EBE6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671200926, "uuid": "631f39b5-6d7e-4a07-8ed2-0e88eed4ec1f", "comment": "Malware payload", "value": "b1087990622f2006b81d1bf1e8f4506b0e1086b1264960c7790c6b82c8489b53bd44b86e0dc8831b6d83549765464ce4", "object_relation": "sha3-384", "Tag": [ { "name": "45-153-241-207", "colour": "#86D11B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeGaliXCity", "colour": "#607CCC", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SpaceCity", "colour": "#5EBE6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671200926, "uuid": "a682b0c4-9c0b-4086-8f81-02839d31c840", "value": "T14EF45A27E3B18BBDC156C13E81A28E19A73FB87D0733C1D745828619EB59AC01F3566E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671200926, "uuid": "e4cef34d-b7fe-4928-bb59-cb7f55433720", "value": "d13d399db15c51a1337d692663151209", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671200926, "uuid": "89855c90-defc-4c39-98f1-0c7e52300a3c", "value": "12288:zaia+of8EJE4zszA+MkJPSS7lWo/TzHDqsZDD9OItfD5HgHq/lLguf:zaizYtsM6TjDqWDgwfZ8YLguf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671200926, "uuid": "8a7734b0-cc5a-4989-acf9-ef334ec2967f", "value": 793600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671200926, "uuid": "4da05d32-a06a-48de-b73b-a30f5ecdb97b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671200926, "uuid": "ef455b17-af40-4848-8279-7048c099a36b", "value": "SpaceCity.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0b3fcf6-7d3d-11ed-9db1-42010a9c0080", "comment": "Malware payload (RedLineStealer)", "timestamp": 1671193916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671193916, "uuid": "0bfa7480-5481-48f9-8ea6-d1c5a8a346f9", "comment": "Malware payload (RedLineStealer)", "value": "ed1d68fa54e0088a953c175aae256bac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671193916, "uuid": "3b860b33-975c-49c7-86ed-c33fd18458cc", "comment": "Malware payload (RedLineStealer)", "value": "e2e971deea530f33a4ffd47036f59ad36dc9a8fcf881cd1df8795af9830b8acf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671193916, "uuid": "7a709d32-cd4f-4e34-bed8-73b66aeabbe4", "comment": "Malware payload (RedLineStealer)", "value": "fbd0cd72771c6457fa7a01bb19e9ba0fb8d555d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671193916, "uuid": "f1b40076-9a94-48df-ac75-e0730b48498b", "comment": "Malware payload (RedLineStealer)", "value": "99cc016c5da9f72b94701111e663244ea96f7b8f3cb339fc73da45b37ce1fd411414f22697535febcf4a1046e74d816d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671193916, "uuid": "90074fb4-7319-4759-bbee-aa45dcc9f3ed", "value": "T19774F021B761C072C50F95308D1AC7E19A2EFD310E73528777BA369F2E30B91A57668E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671193916, "uuid": "e4ec21a7-5059-4229-b9ab-a35b5be88740", "value": "e21f10fb81de748812499eebaf8a1cc1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671193916, "uuid": "874e21a6-d887-4984-a853-20e9c87ba1bb", "value": "6144:HMf1LzO6hTPpKv38JCsai6sATek83VshyXAERtRPRAQ8qMrc:HMf1nO6tPpO6ait/3xXAGfZAQ8n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671193916, "uuid": "a6a0e2b0-781d-42a8-a245-265269cc9507", "value": 341504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671193916, "uuid": "146c67b9-a2a6-4685-ae83-ff7149b37c44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671193916, "uuid": "ba32cb00-c27a-48f7-92dd-4c9f8f79dcf7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c201aae6-7d61-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671209433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671209433, "uuid": "a6de5dae-0eff-4d4d-a8d6-94075acf1840", "comment": "Malware payload", "value": "942d84922b0ded018522752d149a7389", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671209433, "uuid": "d5da914d-607b-48a0-b187-0b569a87b911", "comment": "Malware payload", "value": "e39a8069df68c25abbadb9ffbe07bfa767cd9e7ad7c66f06f49dd9222953053f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671209433, "uuid": "cc112138-6b49-4b7e-8bc7-c10a10eeb69e", "comment": "Malware payload", "value": "e5e05580718a158c0f8945203fb44937f1c3d711", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671209433, "uuid": "789e22a7-7b57-4abf-baeb-a91783fd844d", "comment": "Malware payload", "value": "4753c61bb1d5867e7406070a84f7463bcd4be18fd829cfa6d0371db58917e8d4ea247c8da74850c01b4d9d6ba3ee8b9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671209433, "uuid": "59adc9ce-b47c-42d2-a134-92b350f2d926", "value": "T13854D0F17290E47EC159D730482596D4AA6ABC11AB621AF33B242B2F1E712D056FF33D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671209433, "uuid": "e0a2b1f6-c01e-400d-94b0-b73ebfb74724", "value": "3670997c8c2669588bad5b8c178dedd4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671209433, "uuid": "f05a6769-7a99-432c-8510-4f27db7a4c6b", "value": "6144:obkLX7TltsDrZ4W0/j0MmSeiTy2a1gzLLw9OcLr40M2b:og/TltsDrzSxmqFaurw9O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671209433, "uuid": "084f845a-a08c-4a13-8d5c-66073bfa7727", "value": 280576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671209433, "uuid": "5594d0a5-c152-41a0-a602-cee926b48c4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671209433, "uuid": "6c6f871b-3bed-423b-80dc-7f41724440e2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5188e630-7d53-11ed-9db1-42010a9c0080", "comment": "Malware payload (Amadey)", "timestamp": 1671203232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671203232, "uuid": "68c9e1dd-667b-4dcf-8b66-9706e8b00c49", "comment": "Malware payload (Amadey)", "value": "0e8a123ee38e6298d862b3267a3273b9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671203232, "uuid": "c637a916-1b70-4710-b682-ffa79b45b106", "comment": "Malware payload (Amadey)", "value": "e485011009f74cb1d7916897cd22732446b816632e67f234a7c606fe172da6c4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671203232, "uuid": "4ab2bf24-e575-4da0-8e2a-cf36460523ea", "comment": "Malware payload (Amadey)", "value": "f0eda2f5d2239dcaffa2b67f4a13f5b2f5e409f8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671203232, "uuid": "d40b8aff-292b-4cfa-801a-e55905b656e4", "comment": "Malware payload (Amadey)", "value": "0649f5932953b914a17ef5a7304ef9f9fc7e3a380910c800912473eba32718bfcd1c1c441306f6ab10b54113a3b94fc4", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671203232, "uuid": "df8dcf90-c5f1-4859-a54c-970f9f315197", "value": "T14954DFF172A0D46EC113D7304D18E699A67AAC158B7259FB3B14262F2E302C15AFE37D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671203232, "uuid": "857a75a2-d89a-4752-a112-ab8acefb54f8", "value": "2cc3e4b8a374ca30888470c0a531eceb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671203232, "uuid": "9e5df326-baf7-4535-887e-9b1141f30d1b", "value": "6144:avLG+7DXlDl/1O9BSfsKG/odDhfgzxp40M2b:avpX5ldO6jdDho", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671203232, "uuid": "8fb4fb97-1b31-4d81-b952-7db687b88942", "value": 280064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671203232, "uuid": "3a5eb8df-ee3e-4eaa-ba05-69f4c1137935", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671203232, "uuid": "27122fd9-6f5e-45ad-a492-4630f95e84aa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f461c5c-7d33-11ed-9db1-42010a9c0080", "comment": "Malware payload (GCleaner)", "timestamp": 1671189403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671189403, "uuid": "abca2dd4-05aa-4744-9339-86677ebbce27", "comment": "Malware payload (GCleaner)", "value": "870c252a0dffb75be5e3bd0a150c3b8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671189403, "uuid": "244b1918-2515-42a9-a61c-11a0250e8dd9", "comment": "Malware payload (GCleaner)", "value": "e4905d474c5324522cbf8f887f820210d0a110946f4deac0f8caf6564b4224ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671189403, "uuid": "679a9c5b-4812-465b-a07d-2e8661747175", "comment": "Malware payload (GCleaner)", "value": "cb36e257d0f8d0ec0e580f3beff79c76c87081bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671189403, "uuid": "8b975667-7c75-4840-8673-f18f5644cf05", "comment": "Malware payload (GCleaner)", "value": "957e51352505c7fd15fc5d39ea99901e284f0fc11037a3185d544ba055c0d0041d5d12f49bbe86c1daa5ba7c726040a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671189403, "uuid": "2ddcf689-7bdf-43b9-aa40-e87a945e274a", "value": "T152B5237AE5080174C0F74AF838329D6292F67E2B2931CD9D27D87E5B73FAEC12851649", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671189403, "uuid": "2e541454-0536-4c40-a807-d98ea7335588", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671189403, "uuid": "c0eb1f7d-5f1b-433c-af95-7890a717bad5", "value": "49152:opLvxmmswryi90C5QULX667VTsLK9p5A1zTDVeOCgSY/imk:opLZmmIC5QQQ292PVcY/imk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671189403, "uuid": "9b028e37-9eac-4282-be3d-e3113e48266c", "value": 2403026, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671189403, "uuid": "ddc35cbd-f2f6-4201-9c2c-aa18fde8ec0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671189403, "uuid": "cb319f10-d467-492a-a3df-01dcbc23c54e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2996416-7d2c-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671186644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671186644, "uuid": "714c99f9-a0c7-46f6-8b06-32644e4dc1f8", "comment": "Malware payload (Smoke Loader)", "value": "546f5c81ab3a6e689a400b4e8042da41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671186644, "uuid": "e68c77b2-767f-434e-8765-c9365e7723cd", "comment": "Malware payload (Smoke Loader)", "value": "e62669a342d6ff770736296f60ca03957ce4dcf63aa1b98829e9f62b21b22842", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671186644, "uuid": "c624acae-9f44-4fe7-97e7-4164116ab455", "comment": "Malware payload (Smoke Loader)", "value": "09a7be32eef0272ac9e40bae7452603ed7e75022", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671186644, "uuid": "a339f3d9-bfb1-456f-b934-206b0b997a24", "comment": "Malware payload (Smoke Loader)", "value": "e3869f14e3ab5cd09ab7c192c123eaec228466b12dd29518ce3abab6ad07200a5a8772dbf3187cd8cf9d35ff75dd345e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671186644, "uuid": "311c6449-b529-4909-a98d-647848725783", "value": "T12C34D01175B0D4B2C09F1630886AC7F06A2EFD315971A60B77B536AF7E30B90A67A34D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671186644, "uuid": "51b26521-c868-461c-8020-64951aa34be5", "value": "b35462da489bc13bae884e55b5227599", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671186644, "uuid": "05e5adc0-4ca5-4949-814e-690f6bd7bdcb", "value": "3072:8sGkEL9FLyrUDHBcRb5sbQUtkuAemXdZDn2p1x/LQ2mppGT8pGhQ2HtWqMPDcfuh:nGkuLyrUrpQEgn2pzcta8qMrc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671186644, "uuid": "4ade4cab-b5ab-4671-a2fa-7ce6d023fad9", "value": 232960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671186644, "uuid": "ddafef47-633a-4097-890a-436abd505f05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671186644, "uuid": "763dde99-5ca9-4d5e-808b-a2dd6a707d72", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9f8a2c9-7ce7-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671157021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671157021, "uuid": "e92f5fe4-f392-4324-a940-d936ce57d028", "comment": "Malware payload", "value": "691a9d8136154fadd6662226306232f2", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671157021, "uuid": "4ecf9366-53f3-44fd-9487-332454b50d2f", "comment": "Malware payload", "value": "e703dc3820bca22e586c4bcce8f60293c2ee5b38aa3a7ffe8ab20f56620a8e97", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671157021, "uuid": "bb042d2d-28d2-4bd6-a159-681f0ee0d8e4", "comment": "Malware payload", "value": "98c121efb285e06de3b9087a4f2c1feab098f8fb", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671157021, "uuid": "c35ac018-357a-4540-82fd-edd91b4ceb58", "comment": "Malware payload", "value": "81b39b9855701ac466970213191ce6e35d27bae8cd285403355e63c13a42c832ec848e611da098fd1d4b13ee3a1c8bfd", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671157021, "uuid": "61711c9c-b4fe-4656-bf6c-5c2085830f05", "value": "T12F2733635C06A9DEC031A439197A5385A875CB6E3EA226322440DBB7D5F34A4CDDEFCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671157021, "uuid": "1619d0a5-6b73-4d9c-8afe-a116a5cf220f", "value": "393216:Bs/gOQxmsJA35z7A79L+tuJ1mbgafiubc7ZHbjT9i/zVN2I+TXK5uKpPbNiRSKcy:BsI9HJA35z7c5h/mbBffclHJi/zVN2Ie", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671157021, "uuid": "dfa67433-15bd-4cb4-83fc-162392c8816a", "value": 21469575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671157021, "uuid": "fd48cd2b-ab09-4990-b5b4-60f9e4c17687", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671157021, "uuid": "bfb8c822-3208-4061-aaab-69eef83618b3", "value": "prog.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87cb3460-7d41-11ed-9db1-42010a9c0080", "comment": "Malware payload (CoinMiner)", "timestamp": 1671195592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671195592, "uuid": "bc9f35d7-cc50-484d-a02d-5521e93a4215", "comment": "Malware payload (CoinMiner)", "value": "2ce47b8118fb875aea9caf7de554497a", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671195592, "uuid": "dec5ccc8-006a-4a43-8437-90f199b8d046", "comment": "Malware payload (CoinMiner)", "value": "e72affedebcf2dc4dd252820661d724cff6543de8ed45534368bb694732d870b", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671195592, "uuid": "641619b4-c538-4e4a-9bbd-72384324a61a", "comment": "Malware payload (CoinMiner)", "value": "b73ad86e868c39000fe10e9efcbc549660ee73c2", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671195592, "uuid": "297811e2-b4b4-460d-bf62-81872c0ce3e6", "comment": "Malware payload (CoinMiner)", "value": "7834d90d9406ee5bd6f6281edd480c4552cf78452e9b1d2ac75e4c06c039361df3b94a45a1acefb8cac886262e5bd13e", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671195592, "uuid": "255f5471-4129-4505-8801-92a82dc21aa5", "value": "T1FCC53A2291713712D8ECC632A1F90955FA70ED959D3E129E3C4F3E8ADF7D0824D67A82", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671195592, "uuid": "e20f3d70-8e2e-42d9-8329-59ee1166fcc5", "value": "3442200917fc80cffe283ba89887c292", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671195592, "uuid": "9e1f8c3c-9308-44c7-885b-1387123f07d7", "value": "49152:eb/3sTc5rFGnVpVYK/nmO+ZNAmfvDrqPh2OL:CK/nmO+ZNAaCA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671195592, "uuid": "3e098f71-f514-4f8d-994a-2a48546d55c1", "value": 2534912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671195592, "uuid": "05bba6f8-59b0-4fea-b7f1-3dfe8062a562", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671195592, "uuid": "f65faaef-4ae2-408c-8076-609295017b2e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a76ecd7d-7d4e-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671201228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201228, "uuid": "a43795fe-6185-4bde-9eb2-8ba1b96f30c7", "comment": "Malware payload", "value": "d5711c7dd676247b08e5d6bcfa3163e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201228, "uuid": "fa7a3193-a7b7-4d44-a29d-8ccd9e802584", "comment": "Malware payload", "value": "e736927372d65401306e5deda3e516c24a1f52641862034847218d3923993ed3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201228, "uuid": "caedfa73-f1fc-49cc-8243-d0439cc2363d", "comment": "Malware payload", "value": "3b6255b87b2067a2022fa3049faf52609e884797", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201228, "uuid": "4e1343c1-863e-44d6-849e-1de47d8353e8", "comment": "Malware payload", "value": "6462ca607c4d62d97da79ccdf016ee517552ab230a3309e0153e677216d021042452313765a36a8021dee02b18abf3b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671201228, "uuid": "fa05c2b9-3c6d-43a6-977e-f7dec3481b79", "value": "T10DD36C2471D0C272D915107647A6CF71493A7C382E129ECB6FC90AF50F79DE6DB2A38A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671201228, "uuid": "5e212054-37cf-4b85-8d61-35fcfffc9359", "value": "e85508dfe798dc480467052fa273374d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671201228, "uuid": "01f4fa27-a945-40eb-aaff-b4c064c81d3d", "value": "1536:eKxc4RtWJO//IFKnRkfJg29k0SBfO1XLqs8KMBC2iaCD2xenYT8Ji1dytJivnSq+:9l/QHSBfYLh8fU2zq5JinzcmU5Go", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671201228, "uuid": "7ccabce9-e2b0-42b1-bba5-8cb2824dfaff", "value": 131072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671201228, "uuid": "be34ba0f-c1cd-4541-8fc3-fc6c33fd2584", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671201228, "uuid": "38303f4a-d7d0-4364-864a-a52ab0190411", "value": "SecuriteInfo.com.Win32.Evo-gen.11044.4023", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51d4b4de-7d4d-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671200655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671200655, "uuid": "4a19837d-e152-4aff-820f-3ca9e3681d32", "comment": "Malware payload (Smoke Loader)", "value": "4d897f0df62be35d49cd9aa46885050e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671200655, "uuid": "bf1bb9eb-5269-4900-814c-2a6a9f3be170", "comment": "Malware payload (Smoke Loader)", "value": "e78688fb25722ac62b7246b1704d35d86cc798aa12033e45d8a602a08c76bc4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671200655, "uuid": "c7582634-3157-4a71-b8d0-c861324f5d0c", "comment": "Malware payload (Smoke Loader)", "value": "1244a2ece9664a04bb0ad455a0b35b1230adbaec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671200655, "uuid": "1847925d-6f54-4baa-8672-14b9626ca0f5", "comment": "Malware payload (Smoke Loader)", "value": "353eb4cce2e47e6ae2ba2daf72333543e31d8e7f4e0c84e40ffdc63f9b3c7518fca2494d30a28d3fa010360c8abcab79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671200655, "uuid": "061a056f-e716-446d-92b1-1882c645c5ba", "value": "T1DD24BEF023A1F46EC191D7308D15DAF9A66AAC105E21A5F33B192A2F1D306C159FE37E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671200655, "uuid": "6a95e125-dbfb-466d-a2ce-b170ee2fb83e", "value": "2cc3e4b8a374ca30888470c0a531eceb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671200655, "uuid": "e3daaae0-0521-4acc-88dc-fb76c54c76e9", "value": "3072:A6+77LCvuqSRPm0aEFN16ZQbVyLgI+3YbFZmisYLszgfPhX9740zwUzQRKF+:R4L6upIAVyX+AcVYgz2hX9740M2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671200655, "uuid": "20849473-e88c-4467-9dea-565ddc55f25c", "value": 219136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671200655, "uuid": "90e45d50-f28a-45af-bb14-0d0156226af9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671200655, "uuid": "2fbe1a4c-ac01-4e45-bd70-152a0b0c6d9c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96704ba7-7d18-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671178007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671178007, "uuid": "49029dbb-0a9d-4176-a65f-39f952712590", "comment": "Malware payload", "value": "84e6b5c1bed5e859de1a52fdd297af3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671178007, "uuid": "f86ea8eb-8d8e-4d89-a517-d1a03872b27a", "comment": "Malware payload", "value": "e7d26798b72969f68440983de0fc69305968a63f846bacd1669f43aa9ffd4f89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671178007, "uuid": "858f8f90-a35a-44bc-afb1-750313c5ee5a", "comment": "Malware payload", "value": "d509fc66bac411ac144160944780abdda645d92e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671178007, "uuid": "872444ee-b8e0-4489-a839-db11cae2ffc8", "comment": "Malware payload", "value": "9aeb97c3602d9c2b8784df513f7347c96b59b8cf44e5ae58aa9d0ac322d4e895c92a1f8ca8987ee78aa6f19e69395917", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671178007, "uuid": "2ef22646-b0fb-43f4-a45c-b805bc962c16", "value": "T110F533BB23C74B6BCBFE193420241DA218839569B4C88C1AD6982FB1D7EC91D743C75B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671178007, "uuid": "b1309094-b21b-4837-b227-c3a9fac7f277", "value": "d5e0355f8764c235b38759b860077ceb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671178007, "uuid": "092de6ff-fb02-4602-80b8-f22c6fb546e7", "value": "98304:naZx4nHWpIwDZbLmqjC34hLx7KDAY90eT0+8A:AxaWuYLmqjXKDT90ew2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671178007, "uuid": "38ac2c08-f70d-4130-a89b-7ddfebaf3c05", "value": 3441080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671178007, "uuid": "3a01c1f2-0b64-430d-82f5-60bd08caddda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671178007, "uuid": "b69cc225-585d-4965-93c0-0eca2936c012", "value": "84e6b5c1bed5e859de1a52fdd297af3d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "101f783a-7d35-11ed-9db1-42010a9c0080", "comment": "Malware payload (RedLineStealer)", "timestamp": 1671190237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671190237, "uuid": "583d8bc1-4022-4105-b3e3-79bf6f8cae8d", "comment": "Malware payload (RedLineStealer)", "value": "719d732513063d7361c297a317112404", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671190237, "uuid": "446f3eb1-151b-4c4e-8d46-02e915c94cd0", "comment": "Malware payload (RedLineStealer)", "value": "e8276226bbb4fb085378490e9c34ec4cc50f145b79e3e2d5b63ec35739f43565", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671190237, "uuid": "7665818f-2b61-417e-a9f8-0171309613f8", "comment": "Malware payload (RedLineStealer)", "value": "9b2d33a360dcd2d04076566686a12a0f38243265", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671190237, "uuid": "a4381751-f867-4e18-93c0-ebbcd82fd27a", "comment": "Malware payload (RedLineStealer)", "value": "e61d63537e3fe60f8ecb8c448a7c47ba2713f0e893850941570709ef597ef91ea0fc93c357cfbc732042e2b9c24356cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671190237, "uuid": "7cb3aa41-0c44-400b-b13f-f02240b5a821", "value": "T1CC74F110BA61C532C01F82B45D56C2E1563EFD3129B1A523377B3B9FEE70AD1663A34A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671190237, "uuid": "b9128ed2-c560-482b-ad49-476ad2136295", "value": "875e7ce4bbed8fa04d22755473fc97c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671190237, "uuid": "1a44503a-4d48-4271-88e5-b1c7e1a72f02", "value": "6144:GTf/+LkibfnkvqeTk8nYCiBaoXVYUS1WTkJPaRhYqtV9V10D8qMrc:GTf/+wcfkq78nGcoClmsPehYqtV1A8n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671190237, "uuid": "f5af12a2-e580-4e02-a4a7-e4e8891be05b", "value": 349184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671190237, "uuid": "1318f540-7fcc-4ad0-8327-71125057ad96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671190237, "uuid": "1fb4d849-4eeb-48a1-a74a-6a333023e028", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75c30d26-7d6a-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671213171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671213171, "uuid": "0deefee3-ed6e-4fc8-a856-e3db06411c16", "comment": "Malware payload", "value": "392916da17e4ef4d8c88c778cf75db5a", "object_relation": "md5", "Tag": [ { "name": "1228806356", "colour": "#B96B05", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671213171, "uuid": "5845bbb3-3126-4ac4-a50d-171379a5a6c7", "comment": "Malware payload", "value": "e8b323a81faf2904459bb4a35bc8e2519850afc9f960ffd06a22f3e197185a9a", "object_relation": "sha256", "Tag": [ { "name": "1228806356", "colour": "#B96B05", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671213171, "uuid": "73c88480-09f7-4254-adb3-68be9bea458b", "comment": "Malware payload", "value": "1996bc54416273a26bf938a713f9f35a5aae68a8", "object_relation": "sha1", "Tag": [ { "name": "1228806356", "colour": "#B96B05", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671213171, "uuid": "7ffc663c-0ea3-4cdd-b59b-23b3ef41fcfe", "comment": "Malware payload", "value": "427ae0addae6af686aa45e224b3a4323f717bfb04edc1cc30bce9be22da2ad73af341657901177274f5dfbde59b81896", "object_relation": "sha3-384", "Tag": [ { "name": "1228806356", "colour": "#B96B05", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671213171, "uuid": "0deeed7c-ca22-45e3-811e-798dfee87dbe", "value": "T1A3855C06E2A360ECC56BC270476B6772B531FC155134ADBF9698FB302E32F50662EB25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671213171, "uuid": "9cb769fe-44b1-43a2-b9b7-abec76042e9f", "value": "24576:7HL0HvwglMtNroES7S8asBci5cRMyBAUIqw5NOcH9iIDMNUEer0OVTm10ku2w:7r0YglMbr3SWpsWjRMMKIIDB/k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671213171, "uuid": "97b7da29-4339-47ce-b5c2-4f540d66cc99", "value": 1712128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671213171, "uuid": "6bf98db8-6f5c-4d89-a778-d1b2ff90a6d7", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671213171, "uuid": "37b4d1aa-00c4-4f86-9352-135aba19ff81", "value": "Setup_Win_16-12-2022_16-47-34.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a385df0f-7d56-11ed-9db1-42010a9c0080", "comment": "Malware payload (GCleaner)", "timestamp": 1671204658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671204658, "uuid": "c052bccb-9f9c-49bf-9d6d-341607beadad", "comment": "Malware payload (GCleaner)", "value": "8c42e728eb80d17b3289a0d89f29f5fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671204658, "uuid": "b3896ecc-3607-4701-abf0-c4e9e1ea2f34", "comment": "Malware payload (GCleaner)", "value": "e8de5cb7465dbae0d628571ebb0ce1f5d04c8782d0e9df09de91048564beafc5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671204658, "uuid": "e7027a25-1fbc-4890-bb79-39c2dc87000a", "comment": "Malware payload (GCleaner)", "value": "981364af615dfe8f6aa4a993cf2ec2d06a18d323", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671204658, "uuid": "6f80eaf4-8fe9-466a-b450-bc84e62d8b94", "comment": "Malware payload (GCleaner)", "value": "f8db1e68ba56ef7829699b936567e523ac80c868a84d9ea2079ebd5eface818d6466a882b7c95be407e559a5cf209815", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671204658, "uuid": "82ce7e72-51c6-471f-97e9-434f6f03ddd2", "value": "T11DB5237F944411BAD0F74AF83832AD31A9EB6D1B2D29C98E37497E5B77F6DC0040912A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671204658, "uuid": "d012bb65-6f29-4978-b877-afa5a34b0332", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671204658, "uuid": "368bb83b-e8b4-4a18-82f2-eb668df349f2", "value": "49152:kpuO6HH0DUwH1ioUADwQULPfutbkuWfReOCgSY/imA:kpuzHvO17vOPfnRcY/imA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671204658, "uuid": "51f98d0a-ef4f-4f2e-ad56-cabd8122be0a", "value": 2431752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671204658, "uuid": "6cce0938-d616-47eb-af3e-3c151821c35e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671204658, "uuid": "71bf7703-deea-45bf-8bd0-b374581256f8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8b59c70-7d88-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671226249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671226249, "uuid": "c0c12a29-1b0c-43ed-b60e-872de5ec16a0", "comment": "Malware payload", "value": "2af9b774eb7b9e7bd4fe395c53a5847e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671226249, "uuid": "15f24aeb-8c84-4177-be39-14d57e8d3f82", "comment": "Malware payload", "value": "e96124b1800141082dd22d28bb7f0ac2b249671d34d6f4462fbc17a66c5330ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671226249, "uuid": "3af3c05f-a525-4b06-ab44-7aaaf462101f", "comment": "Malware payload", "value": "3a17ff208c2279863dd368d028bdcd335d446b3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671226249, "uuid": "889be9ff-ba53-4fd5-b2ac-fae6c99bc00c", "comment": "Malware payload", "value": "dfefa1d1b6ce95ce6ac91e0b1aa57a68c237c385b651fff3143e1ede19438e967a47249d6d2a46d90d87596497a754bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671226249, "uuid": "654210b5-06d6-4a1c-aadc-7bb8d8c75bd9", "value": "T13774E0F13762E52EC192C731A91E92D4957AB8110F6259F32B147A2F1E302C166FE37D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671226249, "uuid": "41cb5aa0-7b3b-4293-9d27-179360aec8cf", "value": "aa9c378109186462717e17e657d0c833", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671226249, "uuid": "5cc3938c-b322-4ac0-b625-5ca2ece02755", "value": "6144:lSPLiebknqBkBq1vtTdrmaNwMuwaIX0V5G2K5njogzp40M2b:lsOMvkoxXSMBI5cJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671226249, "uuid": "c650eff8-dd31-435f-93e1-764ce831654f", "value": 341504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671226249, "uuid": "60804880-323d-472c-aafa-5c646e52f28b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671226249, "uuid": "3d27f302-b0cb-4a1d-8214-5c7bf077be17", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f22a8f7-7ce4-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671155527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671155527, "uuid": "cea508aa-9f76-4444-958f-f053eb6817fa", "comment": "Malware payload (Smoke Loader)", "value": "5d6f036e4e324f31e3079f6c8a7827b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671155527, "uuid": "d1af0068-5b8b-4f3e-8d9a-cbf4405efb4b", "comment": "Malware payload (Smoke Loader)", "value": "e964125371ebe6a2ba7a8dd9f881f85841b5d7ca7aa4e14edd62a0234ccd02ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671155527, "uuid": "45fdef75-20eb-4ded-8ccc-62e8b5d6ac67", "comment": "Malware payload (Smoke Loader)", "value": "7bc44ae4ed4ef8caf80eb2fe85846a2089dcdc5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671155527, "uuid": "94cdd52e-6d35-459f-9d63-de463fb08797", "comment": "Malware payload (Smoke Loader)", "value": "782987bbcaa9dfa96978a3a9069deffd0751a32abcb472af05105753502a3992877b2e456b4f6f6d096f6c5ea119eaa6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671155527, "uuid": "65509ac1-03ae-4165-a5db-341aaa7bec28", "value": "T1DE74BE217AB3D4E1F931C5741826EFF416EAB821EAE1D633278AD71F9D703938926305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671155527, "uuid": "8415870b-e1c0-47a9-a438-41ac46846c9f", "value": "2067eb05796787c0f2b3dc09403197ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671155527, "uuid": "bba5142c-c1e7-446d-b0ac-8fde921e8a1b", "value": "6144:G8YQUsLi5f0DGoO+n3nlgvA+0iPvzpQ6ijLxQFiaI:osuf8v1+xnzpQ6ijqF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671155527, "uuid": "07581100-6778-47dc-97c1-dcea2a9b0f12", "value": 342016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671155527, "uuid": "eda7aeef-3122-4736-a671-a12a72798995", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671155527, "uuid": "87e6c387-93fb-448b-a6cb-f94b91e2b1d6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b652a25-7d62-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671209583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671209583, "uuid": "c61cc3aa-e33a-469b-88bd-63270aff84d1", "comment": "Malware payload", "value": "e28d378477f7eb1a4ac3d86bde53a02f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671209583, "uuid": "1a4841f2-4923-4323-9527-06a3d8450fe4", "comment": "Malware payload", "value": "e9dfa7091ae536608ed7d95240cb6abba1033e14af969d271c804edf477ea387", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671209583, "uuid": "668f8d69-683b-4161-a822-edbde1abd052", "comment": "Malware payload", "value": "ac6f2cade9e2148adbfd4669232d0eb4395dacac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671209583, "uuid": "1f4c33bc-a5d5-43e2-8273-835a135dd633", "comment": "Malware payload", "value": "e389882715bad3bf88b240fdbeb77dd4b657cf75e8566017269e265b409cc09e905ba66feace29627dd5bf974fc83810", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671209583, "uuid": "8b8a1fa1-980c-4c03-b6e5-b950e98e45da", "value": "T16D656C417C8980C2FAE757FB6FC4D014C2EA2D25E50006C66AF908B65CEAAB514EF75F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671209583, "uuid": "2473fc14-42a6-47f1-a1d5-4712005a0293", "value": "21b6a4e9054e8bbad032c11f147ef0f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671209583, "uuid": "71388f28-eac2-457d-adcb-cec4d0c1c2f9", "value": "24576:4aeEAyLoXEfcS/gnqrpwRI3GindgJjwOO9mo05m4I6l8tdA0ZDYIBNi8qNJ1Wacw:lfuiqIWindgJjDOmei8y1WaJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671209583, "uuid": "31bfe95c-933a-4e6a-b080-905cf07c6735", "value": 1419688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671209583, "uuid": "0d5ac569-d728-4180-b349-99a776150d8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671209583, "uuid": "49a60f38-bbae-468c-8175-a49d9f1afe2a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "822b3a08-7cdb-11ed-9db1-42010a9c0080", "comment": "Malware payload (Amadey)", "timestamp": 1671151774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671151774, "uuid": "71c0c8a4-55a6-4d2d-9b2d-8a4dbdfe9714", "comment": "Malware payload (Amadey)", "value": "e016f49f4aa6dbda7a063dee0a10ee00", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671151774, "uuid": "2473cf90-d45a-4839-a7da-0d4548aa3c08", "comment": "Malware payload (Amadey)", "value": "ea858f7c43d07795962dc46f78d74a6b2fdc720bbe3357eafcc0dfbd58b25509", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671151774, "uuid": "0111f62b-3a19-4627-8b69-bf2542d29113", "comment": "Malware payload (Amadey)", "value": "79c2ad9679f508c5098b753432e942be815a78bf", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671151774, "uuid": "59e5cbfe-5c62-4b0c-b012-4b10c0e5be8d", "comment": "Malware payload (Amadey)", "value": "787f5eb39d0242b5fa019e1e43560c9bf5a3e566ed576dbb47bf6cb4fab4f2109d508fd53b51412148f85b784d8af68c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671151774, "uuid": "39fc7ba9-03e8-4472-b2a7-56f0f59e0c10", "value": "T18884CF817A73D8E1E971C573CCA6FFF4A659B810E9A5D633230AD70FA9302D3852A315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671151774, "uuid": "365baf8f-de0b-4a3a-a56f-48270ce460c9", "value": "2067eb05796787c0f2b3dc09403197ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671151774, "uuid": "5c78361c-6c88-43c0-93ef-e08b2812e66c", "value": "6144:jhY92fLBvOULMlOrOyuhTMDIG7TljqT0iPvzpQ6ijLxQFiaI:RfNOsMIqZ+EgTlExnzpQ6ijqF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671151774, "uuid": "99d7790e-2c99-4011-ab0c-775203c47dcf", "value": 381952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671151774, "uuid": "e1bfe6bb-2f9e-4cea-8966-96eaf81e9aba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671151774, "uuid": "27c18b8e-a31c-4b39-851c-f7fc275d5d37", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e37afcd-7d67-11ed-9db1-42010a9c0080", "comment": "Malware payload (RedLineStealer)", "timestamp": 1671211897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671211897, "uuid": "f017b149-ec1d-459e-9b07-212362f1e37e", "comment": "Malware payload (RedLineStealer)", "value": "508336d4babe4b14fb814f227228a87c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671211897, "uuid": "2a4c589d-8a02-492c-9ca1-70dac2764d72", "comment": "Malware payload (RedLineStealer)", "value": "eaad85e85aef80cd47497b7a47fd5237071b65d53772f1a9bb8f3b1309773465", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671211897, "uuid": "c6e85738-d8b5-43fc-b2c1-8f3617165510", "comment": "Malware payload (RedLineStealer)", "value": "a19d1d71dc8ba80dba5c8e042168057af6ee1579", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671211897, "uuid": "c6f07051-3c65-4caf-9a7d-32a6330db896", "comment": "Malware payload (RedLineStealer)", "value": "11ba22d6df21eee6b388fd09d640db6ac10b176b660957a81b018d95a4bb022a38f77939b7972bcabcd805535fd7c8d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671211897, "uuid": "69379692-2d3b-45d3-915d-fc52b297631f", "value": "T14074F0F036A1E46DC601D3318E1996E15A3ABC100B7265F33B547A2F5E306C29AFE67D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671211897, "uuid": "46b4addf-6104-4b59-a40d-d2eaa34c8121", "value": "3670997c8c2669588bad5b8c178dedd4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671211897, "uuid": "2230acc4-d32a-455f-84cc-67326695c03f", "value": "6144:kzLW/8PciJp2mKg+FsgD5mCE/XMGFfXTMA+Ph2XdXCgzat540M2b:kzM8Pzp2bbFsImCcX9APAdXvut", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671211897, "uuid": "eb0a2891-f1da-40e8-9538-ad0acc6e7af6", "value": 341504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671211897, "uuid": "a386b187-df19-4f49-af2e-12b104eacc8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671211897, "uuid": "14d6aab0-a641-4c7f-89c1-788f2bbf9fdf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c89be63d-7d4f-11ed-9db1-42010a9c0080", "comment": "Malware payload (Formbook)", "timestamp": 1671201713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201713, "uuid": "0a70e9e1-92a7-4cd7-a4de-85c1c9c58a19", "comment": "Malware payload (Formbook)", "value": "97035795797fa82a83bf4cc47c791367", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201713, "uuid": "fd35c2b2-93c4-4062-8ea5-015820cc49d1", "comment": "Malware payload (Formbook)", "value": "eae7a8364c919d448dd89c353da557610ac04731044b9fc29abea356a4fd4a76", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201713, "uuid": "9f9335a0-f3f7-4d0f-b11a-71f3a7156e8f", "comment": "Malware payload (Formbook)", "value": "c6d39f16e0c3d23307e6596d3f143ed1fae3f554", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201713, "uuid": "44e32378-ee05-4b8b-8b26-51acbd8a054d", "comment": "Malware payload (Formbook)", "value": "4d38ce9cf725202fc10b54bb43450aaac0df885c9781bcb8979132a27c0d7cb482168bf32718b87240061bc815e3232c", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671201713, "uuid": "39874ce1-e777-4cf4-acb9-d0734bdf3c48", "value": "T19ED42396BE78CCA2973CB508F7CE260475730D1E4421869E742DA36497DB6EE08C76F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671201713, "uuid": "3fa09cba-838f-445e-890d-90a2a025d9fd", "value": "12288:f3SsA1UFuIqZJMawnBtNFxlMQwEiwc4+08vGgmffdTM2SqvxW2+XZc:f3S/UwIwGamtRlV9+0rgydTxxW2+Xy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671201713, "uuid": "91620a32-0300-493a-a2b6-aec56f44bdf5", "value": 605149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671201713, "uuid": "b60ec9d7-7e37-4365-9736-79f85bfff97c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671201713, "uuid": "10be22e6-a2e5-423d-8aa4-92894e7664a1", "value": "Purchase order 45003814781830171.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84b2f74d-7d6f-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671215343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671215343, "uuid": "2e6807aa-cee0-428d-a08b-031ee8b3ed5e", "comment": "Malware payload", "value": "941955f09d25315d73b2c4d2a770effb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671215343, "uuid": "d8bdf6ad-e1d0-4f54-82e6-060364ac714b", "comment": "Malware payload", "value": "eafff3ba71335a4d391f404ac2cc0177f71af4d27c803bc17a5b6b7b9388fefe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671215343, "uuid": "2203b296-6975-45ce-8c48-548345eaa6f3", "comment": "Malware payload", "value": "cb75b87274bc4c07511b11d1037cde2c0a77b564", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671215343, "uuid": "045adc3b-4c5f-4d3c-bb5f-73c39c41d4a2", "comment": "Malware payload", "value": "c8c23065459407644a5b6e482014e31ec1bc587684b88027fe1f48b39b3cc0864990ec4f3537e17a888aec1e14535365", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671215343, "uuid": "a070aebf-ee8b-4154-be9a-9b7396acb6ea", "value": "T13FF26C116950C473C413A4B8C869D6F17E3F943222F9C987AF295B758F316C2A37A30E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671215343, "uuid": "76d6b338-a286-4ec6-9c3d-bd1e0e35425f", "value": "768:bGGz00Fx6Ab5XsCKkRgjKLNA2tDzKeajpzZLLYmULa:vYgB8KLK2tDmeajpzZLLY3O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671215343, "uuid": "d57c4a37-4a16-4368-87b1-817694f2b8af", "value": 37056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671215343, "uuid": "4a9ec0d5-850e-44a3-8f4f-3da5ecb936e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671215343, "uuid": "0353ec00-04c5-4f3b-b66d-3d03e7aa8290", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65a81d3b-7d4f-11ed-9db1-42010a9c0080", "comment": "Malware payload (AgentTesla)", "timestamp": 1671201547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201547, "uuid": "ba5360a9-0ede-40e3-87e5-9a3b56827e20", "comment": "Malware payload (AgentTesla)", "value": "606cc7f6516338b3a455191d3ee2955f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201547, "uuid": "08eb7a65-5e0f-4085-8aa3-88161a0d3087", "comment": "Malware payload (AgentTesla)", "value": "eb53610d359179d03ef01ad63ae9828f88863a575f1a4bf8df326ca4aaff4796", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201547, "uuid": "f13bd4d8-bd85-4762-b2e6-eece589c42f4", "comment": "Malware payload (AgentTesla)", "value": "a2d2db77362d7cf1fa2bfd1923c4ec192eb3a678", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201547, "uuid": "26eb81cf-b589-4ee8-bfac-c32676dfc6f9", "comment": "Malware payload (AgentTesla)", "value": "908824af400c3c55874f2750643c23a67d8fb540a1db79c9771c536e8beebb0497ee71fc30f92d95059437c045d9bc73", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671201547, "uuid": "6e7e0a48-12cd-4af6-8105-65df101c56bf", "value": "T1AB64239655F2C0BFF8B3813395B3822DD376A717052A529B9B220F5B36245F25E0C1FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671201547, "uuid": "9719f524-6e10-487d-bec9-cd69cf9b7c35", "value": "97318da386948415d08cef4a9006d669", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671201547, "uuid": "5640bec0-8daf-4c88-87db-d5b452d9f1a6", "value": "6144:rkwS6p2wiyaaBzazh4b6W1a7fuNTv1JkEEdn9Rso/U2mfpkB3ev/+sD:NRndqh4J1a7fuBUxd9Rs8URAeXj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671201547, "uuid": "4f84010b-8f45-4adb-95d0-e8ab267feca8", "value": 334618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671201547, "uuid": "e3aad200-902b-4bf5-9dca-1db80c37c995", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671201547, "uuid": "c876ce68-b58e-4c18-b46d-db12d0d3333a", "value": "APPROVED PO NO. 17730 PR 16806 & 16807.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f20d26a7-7d16-11ed-9db1-42010a9c0080", "comment": "Malware payload (Adwind)", "timestamp": 1671177302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177302, "uuid": "8e2b9c95-2dc8-4f94-8504-29cce42d377d", "comment": "Malware payload (Adwind)", "value": "a610242a0b3b54cab36a82c544194359", "object_relation": "md5", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177302, "uuid": "fb2d37a0-2552-4c5a-a42c-2bf2f1ec98c7", "comment": "Malware payload (Adwind)", "value": "ebb080655706287f25fa86d155d27265594051b40325fa72bb9bffc89f2ef6d9", "object_relation": "sha256", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177302, "uuid": "d14fc3f8-13f2-41af-8af7-fc0c667e4583", "comment": "Malware payload (Adwind)", "value": "757ad55aca925ae83146400d27468ef2ff1f6bc6", "object_relation": "sha1", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177302, "uuid": "666a1332-cf3b-48ab-b1d0-53819d79a645", "comment": "Malware payload (Adwind)", "value": "dbdc44f095dee2b269af3edadd6a24bef61b126d53e58af41417952b68f2f06d48f07c5e2e76cb3d1351d086984bf834", "object_relation": "sha3-384", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177302, "uuid": "c0346edf-898b-43d5-ad3a-815aed1fbc38", "value": "T1E3D4234ACEADDA154D370580FB6FF6915C2DA499E9D228F3E901CAF2E1C0D9E1B2D4C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177302, "uuid": "1030463f-22bd-41f6-823b-d67f970659de", "value": "12288:X0vtjud9VUl9NeSMjTG7KGB6jB4S3PnGoDzKFT6Xss/Aq4DIup:X0ljy9VYeSsmKm6N4WnGo/mc/P48A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671177302, "uuid": "4a53140a-e6b9-4f62-ad35-daf9f53efa76", "value": 646797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671177302, "uuid": "ba083c57-d23f-4dc8-98f6-7098708c225e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177302, "uuid": "79ef5b78-a8ab-4021-986a-044d48ee2da0", "value": "Payment Swift.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a04f85d4-7d4e-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671201216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201216, "uuid": "68b37bca-e0fe-46be-bf07-eb910732885d", "comment": "Malware payload", "value": "e2143b4f14f3ba3be2ea246a1c7ac223", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201216, "uuid": "46a46d36-78c9-42fa-8bf3-36b6cdc1ec30", "comment": "Malware payload", "value": "ebbad6fe23e96ccf9e5667e59d87dab75add4b9c6bb5340b5143b1c0eb3db1a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201216, "uuid": "cd42f6bd-cd01-484a-a843-3525ea87244c", "comment": "Malware payload", "value": "39f49951997572888ba4244015162e70477e6051", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201216, "uuid": "21c0c17d-7418-49ce-b2d4-f5eb69ea74bd", "comment": "Malware payload", "value": "1df0638a0b7df3c5a45948f11770637ead16000584272d4abbe29d24d02d9777f530a24bc6e8a1bf90ff03087fd7205f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671201216, "uuid": "07f45556-e7a4-45b1-9f5c-5649d6e5ac6a", "value": "T1A7D36C2071D1C272E515107647A6CF71493A7C382E129ECB6FC90AF50F79DE6DB2A38A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671201216, "uuid": "9d7bb8e5-b38e-49fd-b7bc-d5963121ef4d", "value": "e85508dfe798dc480467052fa273374d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671201216, "uuid": "7ff21c68-69da-4beb-af7b-0b9814af8a48", "value": "1536:Rqxc4RtW5+fYIFa3RkfJg29k0ihf01vLER6u/CKIKL2jOYT8JiXTJktJuvnMeKvQ:olf5HihfOLERhqKJJiXf9u5U5CF+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671201216, "uuid": "ae077e2d-d763-4bdd-a893-282a467e5c8b", "value": 131072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671201216, "uuid": "5c7cfc67-b4d3-4687-a244-2e70a55ded0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671201216, "uuid": "ac7af5cd-9e16-4dc7-87c6-70e9364efa4b", "value": "SecuriteInfo.com.Win32.Evo-gen.18039.29971", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07f78e03-7d7b-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671220288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671220288, "uuid": "82a296db-71c1-46d4-8398-3c1ba19dd6ea", "comment": "Malware payload", "value": "a53af3358766690fe2252c320d88d93c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671220288, "uuid": "a0da7123-9241-4e59-a958-19f04338b246", "comment": "Malware payload", "value": "ebf9155541505989cb6a6ce59567ed80945dda159a1b7e9e0d5e6446f2cc2e9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671220288, "uuid": "fcb6ece8-6fb0-497d-ad9e-a1097a9c983e", "comment": "Malware payload", "value": "01c49a5e0834125ec31c33b4feda3baa3780abf6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671220288, "uuid": "3a1560c3-be26-4fdf-9209-439867cbc14c", "comment": "Malware payload", "value": "da93a499c9d7fa94223afef630fff17a1e454d514c6664ddc81fe7318a1de5df60a562fdaa0c00b988d12563612a76a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671220288, "uuid": "a2b4c120-c457-408c-b131-77363a915a40", "value": "T1A924BEF16290E46EC151D7358C19A6E5663ABD205B229AF33B083B2F1D712C056FE37E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671220288, "uuid": "2c084088-aedb-40c7-9189-c854110c2c78", "value": "3670997c8c2669588bad5b8c178dedd4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671220288, "uuid": "8c5b4afe-1a56-4c36-9266-942a3afc1608", "value": "3072:lM1clPLecITm0RxaXXbGASaW09T/qrBLszOQI1UeRtH40zwUzQRKF+:OoL7ITgXrBRJFeBgzOtxtH40M2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671220288, "uuid": "7fe7f1ea-bf9e-4eee-8159-a785d9bb5a39", "value": 219136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671220288, "uuid": "6d0beb26-fdff-4205-9227-1f7a7b657125", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671220288, "uuid": "83a6cbfa-6810-4ac6-b937-7db764c8161d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20de0b0f-7d5b-11ed-9db1-42010a9c0080", "comment": "Malware payload (CoinMiner)", "timestamp": 1671206586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671206586, "uuid": "dac20a4b-0bd6-41c1-986d-48b211e30398", "comment": "Malware payload (CoinMiner)", "value": "59b0162612709d8cdd72ca23557ad85f", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671206586, "uuid": "03c54f16-24ba-436b-8aed-6f2bbbda88e0", "comment": "Malware payload (CoinMiner)", "value": "ec2eb6345f2e7ef75f0e38a7bd4c60f420a0ff02a8e9b37005855409f0e23aec", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671206586, "uuid": "75f18292-336d-4d11-9936-62b6c2856a83", "comment": "Malware payload (CoinMiner)", "value": "fca13863218cec25705a9343686b126744273bc1", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671206586, "uuid": "4f0ebe92-7e17-4393-92ad-d60e9e45dcca", "comment": "Malware payload (CoinMiner)", "value": "66e4cfca4cf8abc77da791e0def1296d6a50126f8bb759ddcbf0058dd58ba5484475855d625bfe4451a9cb57c9b80605", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671206586, "uuid": "228e854f-4265-4a86-8aff-e9fc9e2ba4a0", "value": "T133C53A2291713716D8ECC632A1F90956FA30ED959C3D129E3C4F7E9ADF7D0824D27A82", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671206586, "uuid": "50aa5264-8b68-4347-a5ce-e3dd9209f46c", "value": "426a8110704055a0fd69fde6dc7e6f11", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671206586, "uuid": "390660c9-81ff-4a8d-a703-bf914d7c7bf0", "value": "49152:ROjmMTyuRnhrFGnVpVYK/nmO+ZNAuRfnmRqfkjjr:2R7K/nmO+ZNAuR8nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671206586, "uuid": "2220293a-9f05-4cdb-a243-d2ef6d6518d4", "value": 2629632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671206586, "uuid": "c29c4fe0-03d3-4b00-aa6b-0f85ee28b566", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671206586, "uuid": "b5235dd8-825f-4a6f-bec4-4e284b0ffd1f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c936594-7d4e-11ed-9db1-42010a9c0080", "comment": "Malware payload (RemcosRAT)", "timestamp": 1671201210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201210, "uuid": "a53992bb-4cbb-4d80-8f94-2a9c9ea67559", "comment": "Malware payload (RemcosRAT)", "value": "e91b3084a91bf5f9ce86811f93235fd3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201210, "uuid": "b16bc627-c198-46f3-96d1-a870d700baf7", "comment": "Malware payload (RemcosRAT)", "value": "ed308bebbabafc1cef70a9baa46e51b0aed7e35c633a0e394a769c2721e134cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201210, "uuid": "f5cd6fb2-b213-407d-840e-f187a05c6966", "comment": "Malware payload (RemcosRAT)", "value": "f830ef1de89985ee637ccf15a37eaabfd559c974", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201210, "uuid": "1f86da9d-c624-4daf-b0f0-f8e1fe11d9b4", "comment": "Malware payload (RemcosRAT)", "value": "9baa1ee91a858c6ce151159959cbd5b1627c9cd425ab7150d0c2cc665a27e474377abb470739d22bfe771c9ee4a36a05", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671201210, "uuid": "a0874cc9-5d80-477b-88bf-93aa3c4c41e3", "value": "T1BD45AD0A71D48F59EA62DBF10600B4B0269737DE28DCEA3C8EEA0FCE4416718D9556DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671201210, "uuid": "0e09409c-3a4f-42d3-944c-7d76b1b34655", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671201210, "uuid": "72aa55a4-f2e4-4099-aefb-190d4cb03bf9", "value": "24576:uUoOb2b4lTZB/AU65fjsGBR9EZDm1xWgD6oCfW0kjkp:9vib4V/AUUjxBR11x/D6FfLkA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671201210, "uuid": "cbefd2d7-d391-414f-9f4d-125df698f569", "value": 1180160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671201210, "uuid": "8976eb2f-00fa-4d62-9fc4-c628b0c4e5ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671201210, "uuid": "09af10f5-5381-456c-920e-de0c3b1e5a3b", "value": "SecuriteInfo.com.Variant.Lazy.276061.22224.4704", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f05d838-7d62-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671209589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671209589, "uuid": "d7b64845-2d49-4a9f-a5ca-f2e00d5857d9", "comment": "Malware payload", "value": "1d668ac0d03b0a28fa7b4fc4494dfc7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671209589, "uuid": "995cf6c5-1b84-4b73-9bc9-5c2cc55f4a82", "comment": "Malware payload", "value": "eda2c870c2a97ecc988ac2e1a53f893d83c563fa5b40b3194f9dd8c33e0bb2fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671209589, "uuid": "e79ca122-e467-44a7-8b68-4db75650650f", "comment": "Malware payload", "value": "2468f7129e87541961450b6cea83eb361f82a621", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671209589, "uuid": "daf09b10-37cf-4430-a73c-c97710d128d6", "comment": "Malware payload", "value": "54034aace65b729fd87f604504fd0efd1982c73a644886de602241cdefc9069040780c42e8490d5fd36366bb63a44901", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671209589, "uuid": "7497bf54-47af-4ee7-9942-d1e81e59c71b", "value": "T11BF1A619EF564633ED6A4F7E989312D10BBC97533C87ABAFCD805108AD812684A52FF0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671209589, "uuid": "157d3cf0-74c9-41cd-9a72-d65d6e9a044e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671209589, "uuid": "03457836-7c76-489a-9ab7-cc481911b39e", "value": "96:xjwAimGGx2l0v7+4GkTNu+/D10gQvH+0GkSYx0HvHQrFnU:xLT2lSpGkTNRrWg0HhrSY1O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671209589, "uuid": "3b9a590a-7618-42c6-8fe2-2836fe5154d7", "value": 8192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671209589, "uuid": "0194b477-49d0-4eaf-a475-d46184827661", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671209589, "uuid": "4fdc798f-1c4f-4258-af9a-b4cbc58ebb42", "value": "PO11132201.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8abb8c75-7d6e-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671214924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671214924, "uuid": "b072bfcb-1dca-4173-9a8d-d48fadc8d675", "comment": "Malware payload", "value": "735d9f6198657375a7bc2924424f454a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671214924, "uuid": "ffb0cbb8-a5e8-4fed-8b9f-e7e9c3d38177", "comment": "Malware payload", "value": "ee4f8b57a8079b8446a1effa1607fad6101db23fe0babc908085c49838e25e5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671214924, "uuid": "24865e91-3271-4f3f-8780-2579c0e92859", "comment": "Malware payload", "value": "88dafd8b7050af691606c0e726a4905481e47b0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671214924, "uuid": "6ca93fc7-629f-4693-94af-693e92dda90c", "comment": "Malware payload", "value": "0e0f73d2cebfca2698bc6db60c27e8680940247f073bc44c492b50fabfbb2c9cbc501cb87ab3d1271935db03fc74b775", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671214924, "uuid": "d19cd74a-eae7-4e4e-b0a6-82f2259f84f6", "value": "T1C354D0F03790D52DD152C7304925DAE4A93AB8109A3155F32F283A2F1E346D1AAFE37E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671214924, "uuid": "a9ecb622-5027-42a1-8fb8-4b61f7065463", "value": "3670997c8c2669588bad5b8c178dedd4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671214924, "uuid": "d008dedd-76b6-4081-8463-09082a656ce4", "value": "6144:LELQeA6ZLi+zGBpcCssz+BPLZ7agztKYA40M2b:LE3z++upcZsz+BDRpKY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671214924, "uuid": "17032691-5297-4dab-a24b-309e5e6e6db3", "value": 280576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671214924, "uuid": "b8e031d4-87cb-42e3-9761-5674d711aef6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671214924, "uuid": "4ae3ba36-abe4-4bbf-8d90-da68930d754e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4101069f-7d0d-11ed-9db1-42010a9c0080", "comment": "Malware payload (GCleaner)", "timestamp": 1671173139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671173139, "uuid": "b6d9e50c-afe8-4267-8c51-556fdf9d6a71", "comment": "Malware payload (GCleaner)", "value": "937adb79cc3f8617be0e9cb5ba1445ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671173139, "uuid": "9ba6687b-f0d9-47f5-83d6-3182a66b0067", "comment": "Malware payload (GCleaner)", "value": "eefaee53c97088afac653ad043ab5d1d9082086662059879dcc5dfb3fd5f2f50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671173139, "uuid": "4ab878ed-4c2e-4d1a-b7c3-21eb6a8a6bbd", "comment": "Malware payload (GCleaner)", "value": "96efc40be65bc94ba9ff29743f1f8172104e80ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671173139, "uuid": "1df230de-b743-4c9b-8abe-e5a6c593aacd", "comment": "Malware payload (GCleaner)", "value": "2f1108f0165764275670449bb169a307a6cb73951a10deb356ff2c808dee99f8f80b86dbff402797b6f2b736280808e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671173139, "uuid": "8455924f-9555-4560-9c81-b585304db560", "value": "T146B523BFA044407AC0B74DF839615D314AE37E1B6969CA8E37987E9FB3F78C15816206", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671173139, "uuid": "33eb70f6-5bb9-46e0-a86a-a2d70eee4abb", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671173139, "uuid": "7d2520ce-eefc-4753-aeaf-33a58f67c412", "value": "49152:cpRx0skS4Qi6egmn7r2+9Yqj5XqerNYbKdrH+DebENeOCgSY/imo:cpRx0sp4Qi67Ur24YGN1H+qEcY/imo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671173139, "uuid": "d291cec4-77e2-474d-a9de-46ed288b16d2", "value": 2413207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671173139, "uuid": "705e0113-a107-49b2-9acb-468e6334f340", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671173139, "uuid": "1e021b4c-1df7-456f-b506-adcd71ed4cc8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beb9444b-7d02-11ed-9db1-42010a9c0080", "comment": "Malware payload (GCleaner)", "timestamp": 1671168626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671168626, "uuid": "7326162c-398c-4a2d-8561-0264b7cbe80b", "comment": "Malware payload (GCleaner)", "value": "7a3ee78fd5bcfa5606bda48e5d18b6f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671168626, "uuid": "659b9b8b-c711-405c-9e20-9e3c667bd7c1", "comment": "Malware payload (GCleaner)", "value": "ef149d7af7f4f74c8f08272f6fc3396c841593d8305b12610c0e3078929afc17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671168626, "uuid": "c6e99080-6767-4afa-bbfb-5a48305388db", "comment": "Malware payload (GCleaner)", "value": "cb7c4937ac2d8b1f16f03618fe4fff1c21b995fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671168626, "uuid": "039e1964-1d79-48a7-a062-7c9f3142ba62", "comment": "Malware payload (GCleaner)", "value": "a547ae7e1e77be34ec1311df1e9a242b75622b25bbdcf6c97a5afdb76e67f5f2e4d16599b197a0cde436d5e4a6d7822c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671168626, "uuid": "e51c8c3c-b623-424d-845b-6090af5eccb7", "value": "T130B523BF59902871C1B34AF93C76AD2246E57D1B2DB9D94D33A83E8B37F79C01A02215", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671168626, "uuid": "29970cce-e15c-454d-b984-30bf9f7e73de", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671168626, "uuid": "718d3824-c781-4743-bb7a-fb0e6c27b35f", "value": "49152:8pqq9JTFS757YE279gN9IOXN0bromaZrn0NjFKDs17ZjmS1DheOCgSY/imR:8pJ9Kd7YE2hgnIO6romJjFLBFm+9cY/L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671168626, "uuid": "9315f766-fc21-4926-8461-bbe04e240933", "value": 2428073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671168626, "uuid": "95700a13-34d9-4b76-b4dd-55340335494d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671168626, "uuid": "ad545da1-05c7-4c04-b03a-f19ee16a9cb8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c153731f-7d9b-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671234343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671234343, "uuid": "071c3bfa-7fc7-42e7-ac6b-fbeb8bda0e21", "comment": "Malware payload", "value": "78933cde5eb56e5217c397743e4aa677", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671234343, "uuid": "d8c8372f-1db8-4b5f-8487-a14fe897f727", "comment": "Malware payload", "value": "f0853360e376af5dfa30c090ea6c91c9786351c3563b9026394d7aec1e218aa8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671234343, "uuid": "f62d0a03-ccf8-4e41-8078-317fa5233887", "comment": "Malware payload", "value": "f2b2a93d483104271fd161298fe0503e5d8e657a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671234343, "uuid": "b6c616ce-9384-4679-bb20-f356ab77f7d2", "comment": "Malware payload", "value": "71fb1699d6791200d8896fcb56f184ebcb043c479908b843430e6280929f6785f3cc537b37546230f90e652df81ffed9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671234343, "uuid": "ee96d4db-168c-4ee5-81e4-4bb50ae93a00", "value": "T11DC523BFE48420B6D1F728F938268D6148D7BD2E9925E85E3B943D973BF68D00C56309", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671234343, "uuid": "1c1a8ea1-c8dd-42de-847b-435ffd1aedf8", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671234343, "uuid": "b7c2358f-fa50-44c6-a1b4-aec20c0e82d8", "value": "49152:Ep6vYAiSX6oXMkkdwdlBiSHaMCFXQh2GuJdjrsHeOCgSY/imH:EpBKX6udlXhCeXuJScY/imH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671234343, "uuid": "a14ef4d9-b8cf-48f7-bc67-f94f4c4bd5b3", "value": 2573837, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671234343, "uuid": "149307a7-18ee-4f0b-8df0-f9885cd16362", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671234343, "uuid": "7ce62d9d-6da5-46e1-bff5-0eaee9fd698e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "789003a3-7d53-11ed-9db1-42010a9c0080", "comment": "Malware payload (Formbook)", "timestamp": 1671203297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671203297, "uuid": "caecf9be-ed94-4131-b879-6476d5beb35e", "comment": "Malware payload (Formbook)", "value": "058acb96a62c083c0d8914afb3e0974e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671203297, "uuid": "9d860377-5c31-4f48-a0b9-87bf1def016c", "comment": "Malware payload (Formbook)", "value": "f09fbab736a95a4d6aefcbfe08a0ed19ab627eb05fd13271dfd5d1de82cbdcd3", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671203297, "uuid": "7dfb218e-c967-4a5c-948c-e1010a43b77b", "comment": "Malware payload (Formbook)", "value": "e1c216a821d8dd36abe4ac7ae80f44b90c9172fe", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671203297, "uuid": "68daa1cf-95b9-403b-b2db-b3c7d642c3d1", "comment": "Malware payload (Formbook)", "value": "0b193f506b2c627caeba6370104d4299db8c433887a211d8cff29cb6bb18fb0b092b6aab6e8db7b8a2b85ee352dbb9a1", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671203297, "uuid": "7abc3361-3902-4878-b597-ad50251d145a", "value": "T1EFE42390AFF4E92DDE20447106B6B0C597B3F00853729A987B7C9F66A70FDD2252274B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671203297, "uuid": "5330e3a4-fdda-4d15-ae13-896c253eaab4", "value": "12288:yZ+9tvUmtBrASq86QaJZ76qIJgNhU3aHHI1S8WDcKEBkKmYu8gWd78rrYk3:Y+vvLo86QMZ7QQuoT8WYu8Rd78r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671203297, "uuid": "62630caa-9b9e-45ae-93cc-08c031c6c33a", "value": 677888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671203297, "uuid": "94aff8df-8a0b-45f1-aa9c-ca77be4b4e83", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671203297, "uuid": "bcf53f65-4a77-4a9d-ab54-addfdecb1904", "value": "Outstanding SOA.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "414b80b2-7d2c-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671186454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671186454, "uuid": "5e6c7279-0399-4711-bc9a-ce81eeecebf1", "comment": "Malware payload", "value": "68ec929ba13e2bf686016df02aebee08", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671186454, "uuid": "4eae0700-c877-4d21-9c26-ddb8109eede5", "comment": "Malware payload", "value": "f1175ed4589c29639f333a1ebf3dab89f3ae5d7c6f0be64e4e97844ba9af44d2", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671186454, "uuid": "66bde6c0-ca2b-44db-84b9-a9a92fc7efa9", "comment": "Malware payload", "value": "b29dc44d5e9e97339aa02692ac3389a9fa34b15c", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671186454, "uuid": "43288d1e-20a9-431c-80a5-5e340bf26a56", "comment": "Malware payload", "value": "5d691562be6856ec97d3cbb28bc1a6ed60abb8cf6063ab482a5f7ace71adf37e8e21eeb5061805df51b48ff4783a4b1a", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671186454, "uuid": "77b8eb37-e746-4d3b-be49-d2a99bd038ea", "value": "T1FB152355FFD08F5BE2431138A2E6EB4985DDDCE56360E1F3121C7A162138A1E2ED623E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671186454, "uuid": "b0c49e67-1af5-4f4c-b8a5-82f1f2bd80d5", "value": "24576:Y6c+yruf1cdSQ6DCa2gQAe5vX0f7alPLwtfzgqi7hr2FUzb:BjyyfQSQ6r2gpQvG7asfzg9hKFeb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671186454, "uuid": "99cf818c-362e-47c5-8535-cdc896f1d9d2", "value": 939520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671186454, "uuid": "11bfeeb7-1bd8-493d-b469-4646ae020f24", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671186454, "uuid": "e39a9b96-dd3d-40d0-a5ae-681f826953a8", "value": "ACH_WIRE REMITTANCE _DECEMBER.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fc7f157-7d61-11ed-9db1-42010a9c0080", "comment": "Malware payload (AgentTesla)", "timestamp": 1671209134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671209134, "uuid": "e55775e1-58f2-41ed-a707-d6f6fc012f62", "comment": "Malware payload (AgentTesla)", "value": "991901b931ea1a26704e62e50adfdf79", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671209134, "uuid": "4dddc685-cae0-4537-8a30-556bd62fa1e1", "comment": "Malware payload (AgentTesla)", "value": "f1270ce895ff157fdf1831ce5bf58142b2f3dc9ed85bcb54ebe9f48a9b9e76e1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671209134, "uuid": "a29dd9e6-5c6d-4265-b4eb-eb3b00bde031", "comment": "Malware payload (AgentTesla)", "value": "e4e032fac79978f249fe99fbf5c3c5ac85ec2085", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671209134, "uuid": "4f11ec88-fa53-43de-b0d0-b43f19a7192c", "comment": "Malware payload (AgentTesla)", "value": "54457fee6256eea5e66bbadd211b3ca74bef3c6e92be081d00554ab5a615c4ac690f77eb3fcecbbc16dca18cf010c620", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671209134, "uuid": "79658c88-fdc4-413f-82f0-9d812977cb99", "value": "T105842394F1D4116F79ED00262C41EF2A975AF2953D5C8E85CC07EB7B8622BAA30D29F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671209134, "uuid": "668d7039-d0dc-4075-acf6-17d2a80baa12", "value": "6144:/1rZEaXm46QZondlYSodfShlrjraMg6CC+SEiYDkzNl0EFa+56fp3xo0REyTHkte:/1VEa2jdlUhShlPraMCC+bDkgDfpKYE4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671209134, "uuid": "2ebff72f-99d3-434b-af72-2cf102a4c6cd", "value": 378337, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671209134, "uuid": "ecbec0a6-52d7-4025-a611-9b7b6a11b71c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671209134, "uuid": "1a39584a-4730-48a9-8f01-b0729223834f", "value": "DOCUMENT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50e6447d-7d40-11ed-9db1-42010a9c0080", "comment": "Malware payload (AgentTesla)", "timestamp": 1671195070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671195070, "uuid": "6ad991e6-aeb3-4ce5-aa03-fc41dcb17b48", "comment": "Malware payload (AgentTesla)", "value": "dace6db3fe0da103b36f0d29015560aa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671195070, "uuid": "ec0501c0-744b-4298-8119-8fa942b81204", "comment": "Malware payload (AgentTesla)", "value": "f18369d534405f858d2c9027fc2d1255a092a45aa421eeae3445bc1f8aabc7e8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671195070, "uuid": "f4e5176f-cbd2-4d8d-bba8-e068db35163d", "comment": "Malware payload (AgentTesla)", "value": "92b73dfb956985601c604e7cc2ed9b5f7fa775e3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671195070, "uuid": "d86ff0fd-6499-4ba0-b15e-e549ab16ee26", "comment": "Malware payload (AgentTesla)", "value": "92ea07cfdc4109823903ed782e58517f7ee1be43aab88f3467d2118aef6449d9f2eb030223de36458cae0125fb3cabf0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671195070, "uuid": "1fb36a24-8a1a-40e7-918b-14f220be48dc", "value": "T1070533BA9100D8BD736AF8E5E0EDE37010F491A9E161F206913FF2047E59A2C69B5937", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671195070, "uuid": "0ffaf2a3-bbc5-4c59-9468-2a90fdde8473", "value": "12288:jJMjVVTC7bL9CYC+MCT+ejHK/KK3WAmG2H0x/eDyZAk523DhCXNDxV5yp6zbYU:OhCzRROrff2UcyZFkDhCVxjypysU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671195070, "uuid": "ed6ccc72-692f-4ae3-b3f4-2250ebd192ad", "value": 830966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671195070, "uuid": "c0c5cfa1-c2ad-4f83-aaef-ee7417972f49", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671195070, "uuid": "0ed05640-a01f-4f95-b988-7980512de411", "value": "soa usd 88,362.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3230591f-7cdb-11ed-9db1-42010a9c0080", "comment": "Malware payload (AsyncRAT)", "timestamp": 1671151640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671151640, "uuid": "a1dbb6a0-d114-4420-971e-7a134d7cf0f4", "comment": "Malware payload (AsyncRAT)", "value": "71dfc2ff159de9d6e2dd03fa8fe6d5ca", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671151640, "uuid": "98f173cd-5f92-4ab3-bce1-8d3a95af34c8", "comment": "Malware payload (AsyncRAT)", "value": "f1fd3f0e4d1584f6fd26c7f149c53cd61dec90bee45fa8512d19b7697521b278", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671151640, "uuid": "a70d5d24-6bbd-477a-bac3-8cdb55f5f066", "comment": "Malware payload (AsyncRAT)", "value": "bab2cef93ce614ca5dd42551950039264f2e88ae", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671151640, "uuid": "9764f88f-cf02-4373-8609-a87893f6cdbe", "comment": "Malware payload (AsyncRAT)", "value": "cb7419137f77db356802cd8d3e9c6f706c97b458ac896a54f6347189b90d1904df9eb7561b696ba5d4e35de28bcbe607", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671151640, "uuid": "49e46521-0825-4f97-82ff-3d9b026bde69", "value": "T1B634FDB564A7C89AFD4ACB40727CFFA555B271F3A5C81A20133C6604CBE9FA52E4C14E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671151640, "uuid": "a5286b13-d4fc-4290-8425-dac035fcc211", "value": "3072:uC6S/QIQaRBYzD6ls50JhsQowmGcAn3ApP:F6S/QIQSBYz8s50XowmGcAn3ApP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671151640, "uuid": "36d7e6ba-79d7-410a-aff8-5146db49dac4", "value": 248875, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671151640, "uuid": "5f1cfa68-cb17-4970-ade9-6fd2afb21a82", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671151640, "uuid": "ab952468-9209-4942-ac2a-dc62c566ef4c", "value": "x.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05568dc5-7d34-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671189789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671189789, "uuid": "0ed3c003-d90e-49a2-b738-47dd2bc6df9d", "comment": "Malware payload (Smoke Loader)", "value": "6a70c8ff0b09cc809fa362398e18b3c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671189789, "uuid": "dec11275-8b84-44cc-8c15-450e2aa6245d", "comment": "Malware payload (Smoke Loader)", "value": "f331a3b1ab03bd227de9722bfc16dfaf0bdf8a692995ebc868c711c08f664b9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671189789, "uuid": "26264327-a1dd-4f7b-88e9-3b35a35a16a1", "comment": "Malware payload (Smoke Loader)", "value": "77011a9774d30c2aa71777ef756b217442d57564", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671189789, "uuid": "b4cf90c1-1583-4f0e-b89c-f05305cd2217", "comment": "Malware payload (Smoke Loader)", "value": "ff0ac6033ca9fcc31c7f67b93f8b4e38d956387d7963f12ef379b51e970d7e1d30188d068072aa18f7158be6ad8c4327", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671189789, "uuid": "d90d645d-0b28-4a44-a156-04eda39a5dc3", "value": "T13F34CF11B2B0D072C02F45708969C7EC5A3EFDB159716A4777363BAF6E30AD0663A34A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671189789, "uuid": "0d6a0c2b-c366-44cc-811a-e0ed58c3590e", "value": "807baf2431f1bb1a8bddbe264b439a93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671189789, "uuid": "7283cf5c-2917-4501-9792-690b72cdab27", "value": "6144:eLhyLd3BRfc5wE2BO4IQGkRQmFstTtTHX8qMrc:eLhyFPQwLE4I1kjFsPT38n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671189789, "uuid": "e88019b1-330b-4953-a4a3-93f3598697df", "value": 241152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671189789, "uuid": "639b9a0a-c120-414b-acc0-f304bded9174", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671189789, "uuid": "9da99fe6-ea85-4e32-bab7-cb0f85bd0021", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e6a9d5a-7d47-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671198099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671198099, "uuid": "03056ba7-fcae-4fa8-9910-b02007f53dd0", "comment": "Malware payload (Smoke Loader)", "value": "08949ecb5511ee337879b3e9042f5b90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671198099, "uuid": "9857b1f5-1f4e-47b4-8b63-6bad602b083a", "comment": "Malware payload (Smoke Loader)", "value": "f3832b6368e6ae655c164c0acef137ae37e68dc8ed83ad1e452fdaad147bd122", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671198099, "uuid": "3a214d11-7909-4612-aa63-b4e8c6c4ada3", "comment": "Malware payload (Smoke Loader)", "value": "f9cf814acdd53c9f77420c7188ce4acd52272219", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671198099, "uuid": "5c36324d-eab9-4785-beb8-a37b570b6d77", "comment": "Malware payload (Smoke Loader)", "value": "82a65c5b4e941643a8cee2b328988947236c1d18eb455799cc13b947ef75506323cf9ba017af2e13349e1c78c68a940d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671198099, "uuid": "63a4092e-63c2-40ec-a385-1d0a60837364", "value": "T15524CEF13690E46EE152E7308C15D6E4962ABCA24E2295F37F182A1F1D342C156FE37E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671198099, "uuid": "1af89223-e24c-47e0-afa1-0147d6d607a4", "value": "2cc3e4b8a374ca30888470c0a531eceb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671198099, "uuid": "ee08bfce-597d-4669-a26a-6d0d6843d7a0", "value": "3072:Rl3uK5L+kyTpSRXn2q/9lD6TIfj0i9msdgvmcLszPKa40zwUzQRKF+:H3TLdyTY2qFlD21iUsdgucgzPX40M2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671198099, "uuid": "74987a44-1b52-46cb-bfcb-02d54d3fca1a", "value": 218624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671198099, "uuid": "6712f31a-fb3d-495e-ab28-90bde0aaedb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671198099, "uuid": "cfbed483-fbb7-4b97-b4eb-98f092531492", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d65ee97-7d40-11ed-9db1-42010a9c0080", "comment": "Malware payload (Formbook)", "timestamp": 1671194984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671194984, "uuid": "3403c760-3bc0-4e74-a69f-4785ce8d849a", "comment": "Malware payload (Formbook)", "value": "b3e83d8057646cfb9e26e506c9db1591", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671194984, "uuid": "ef1a4d13-bb3a-4742-abf2-5215730e60b5", "comment": "Malware payload (Formbook)", "value": "f4d737ac425a1c0bb32aa1d8d33a7cdfbcaf497af59257428e6433af20630e97", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671194984, "uuid": "68a29a81-86e1-4655-be0c-2f9ee91be4f1", "comment": "Malware payload (Formbook)", "value": "b8ecfa84ece82b904de6afcd73eaafb332a6a233", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671194984, "uuid": "a0eed5eb-7deb-46f0-b8f2-4e5e43b0ed29", "comment": "Malware payload (Formbook)", "value": "ea6853eab34eba890a09c43ee7c94b331848d3959a62e28f6f1f68d5c874b7b0cd6accfc6cb95d3fdf045be6bb919ec2", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671194984, "uuid": "887d1a60-c3ae-45a2-b53a-175a25523a37", "value": "T1E4642395A7ABEDB369E27B35AB572EDC50D2D1D903F2FEC0167E7111410B580E8C8A82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671194984, "uuid": "8c41e7d4-a7f9-461a-92f1-fca12bb2b75c", "value": "6144:Ua9kriFAcbfpz1nOa4YSiUYzzNgezsk4NUIE6Xfjh8o/Y7aAiTFtsY78REkOv:bkriqOjFUUbmUIE6XfT/4iRm7ekOv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671194984, "uuid": "1257920e-33a2-4c05-b57a-80b7f26560c8", "value": 336936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671194984, "uuid": "f6771191-016d-4056-abbc-f1208fd2fc9f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671194984, "uuid": "14588c52-719a-4fa4-83ba-1405259f3f3f", "value": "71084394.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07dcb70b-7d20-11ed-9db1-42010a9c0080", "comment": "Malware payload (Vjw0rm)", "timestamp": 1671181204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671181204, "uuid": "dd273841-540d-437a-a834-7dea66167eba", "comment": "Malware payload (Vjw0rm)", "value": "993d2db1fef5f9c2c11be95525e4f297", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671181204, "uuid": "edab7f6e-70af-46eb-9e99-1dfb4d924948", "comment": "Malware payload (Vjw0rm)", "value": "f586a8e7a61af0223ee6020b4f4a5f76976af43da2eea30ed4b383f763682d3e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671181204, "uuid": "e9beb81c-e830-4f38-83a7-376088a4ee96", "comment": "Malware payload (Vjw0rm)", "value": "a4cc3b4748729632f1aae432a1797161e4a9ff47", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671181204, "uuid": "df2032f1-6492-477c-a3b8-11b902b018fb", "comment": "Malware payload (Vjw0rm)", "value": "1c44d380fba65d54142bfcd4ca9c77bdaa003e1ab178a189f1c0f282de533c448e1b43c5df2e0f54bdab8a90f5d4c193", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671181204, "uuid": "8a9451c9-b736-4b7c-9302-b4db600a16b3", "value": "T1EA948BD0FE0DA04E59A524A810341B8A597DD7FAD078CBECF2177910DA56C4EF3E92AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671181204, "uuid": "d27ecbea-6a91-416c-a8ce-a05f73a711a5", "value": "3072:tpZFqXDp3Xjehwn+9e6a5JkJI+buH+TkHDFunCloM0BBMHKsCduMFzMYvKLMr164:tW9XjeSn+u2OpJO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671181204, "uuid": "d71147ba-162a-475a-9ee8-e3d6cbd8621b", "value": 420380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671181204, "uuid": "dabc8ae7-c0f2-454b-81d1-9552509ad314", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671181204, "uuid": "aea8b3b3-5838-4d8e-94d3-3e9d7001953c", "value": "INFORDIC15-12-22760041220222HI.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb111cd8-7d34-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671190121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671190121, "uuid": "7e15c3aa-4068-4d37-b862-e335a4386045", "comment": "Malware payload", "value": "35edc9bf738ccc4d5fd49649a34e9fe7", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671190121, "uuid": "2a56af76-4af4-4af7-ad31-8e9ac83a7410", "comment": "Malware payload", "value": "f59a95b9f439aee8392951a912b80a1e2c59f553d9668f06705e274590de6696", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671190121, "uuid": "63d0e754-9eff-4330-a910-d939a515627b", "comment": "Malware payload", "value": "f4dd9897500167e62f61a5703180ad3ac1da1359", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671190121, "uuid": "4ea96195-bd53-44ec-8b73-cb55cec0db54", "comment": "Malware payload", "value": "f47bd3a5e0434cba10c4c7e57bf13ba5f9a58e19cfb2ec0e5dbc611f5c9c3ec1598be0ba6a331625bf21dae5f39cf490", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671190121, "uuid": "66b60c81-a31b-4de6-adf3-9992c2f09c02", "value": "T10F24F1FDD0146D6DCAAB6439529824E2D59CA582B173AE0E2FE0FF4D17435E303EA60D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671190121, "uuid": "8aabf470-62c4-4e5a-816b-cd6d2f2404cf", "value": "3072:DA3GI3P5LAzGGueF1O+9ysshJrqjUaUlKUF65Ni36nZBRUJzWmSUF53kpXdp:DA3phLAqeFZOPqUli5NiKnRAVZ/3SNp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671190121, "uuid": "78978281-8e5a-4675-82a1-6bc0eb6d348b", "value": 216434, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671190121, "uuid": "af8df41d-a66f-4a89-b9f6-dc1490e450c5", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671190121, "uuid": "ec3c82db-d15a-4db2-951c-9c0b1409d801", "value": "SecuriteInfo.com.Trojan.GenericKD.63957735.26142.11975", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83d8924b-7d4a-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671199451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671199451, "uuid": "3eecca8f-8b37-4638-b018-56f14ed7cf28", "comment": "Malware payload", "value": "797eb733cd66b65ebdd7fd8c90ce62c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671199451, "uuid": "d09c8ace-600c-4815-91e7-76b19619a7aa", "comment": "Malware payload", "value": "f5eac3f3347e0ab121f318cabf6a5687923cd9d6938f05855c215b90e4d918c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671199451, "uuid": "04233e89-d801-4b38-84be-4bb1fe2b65f3", "comment": "Malware payload", "value": "7a17d8e729f9e09141c185c9725c2ff367382ffb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671199451, "uuid": "6546eb1c-8336-478f-af19-d3dc45855e5e", "comment": "Malware payload", "value": "8dff83a7c6ccf54bc57a994ced123dc1031eabc962016fbe3f8cffd4b3cc2ee4407a0d7feda691a34b683d2e97cb3fd4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671199451, "uuid": "34f7c096-5e10-4b07-ab93-1352966294e0", "value": "T13ED1D701A6E951BAED6E773C68FE4600B3BBBB877881DB8D34981117DEE134005A5372", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671199451, "uuid": "d4537233-1bf0-49fa-80a5-215f31a7c83e", "value": "96:FLO4KNcx2nk4RWBDZCz0ZvhdwcLVFu3SjsLh1zNt:dOFfkCgkYhdh5UCjs9P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671199451, "uuid": "f511f4c3-1c54-4266-9a53-2d314b5e797e", "value": 6656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671199451, "uuid": "d2f690ea-00ea-42df-9734-1c1c618e6ae7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671199451, "uuid": "64f6f052-0d54-42c8-8722-754f67f6f3d4", "value": "a516b9a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be0944e1-7d76-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671218446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671218446, "uuid": "7e6189a8-1194-41d8-94a6-927b79d9360b", "comment": "Malware payload", "value": "753a8c78784b699636a6a88fad0357d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671218446, "uuid": "9ef019d1-0b0a-451a-b57c-5b54ec7bfc74", "comment": "Malware payload", "value": "f63993a7e4dc3e4242509482ca4d9ee1cbd4c00d219503ecf5d139d763a42f35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671218446, "uuid": "87a1d3d9-bae1-4580-a185-47cfd2c4180c", "comment": "Malware payload", "value": "996c01ac1f420e08907463c41899eb460fe4ce8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671218446, "uuid": "d99d28be-955c-444a-98fb-4499fee0764f", "comment": "Malware payload", "value": "3879b6ce6bf7ab0dd1d824a4f1861410bac307ecbf60602dbd70fec32fad7bdf9710aaffdc6833a66605d97868e69c8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671218446, "uuid": "8a101a97-cb22-4562-8878-24c43d476936", "value": "T1E70718C3F415B2D4C09AA2758E2152E176317C8A2B31B7EB1A90FBAA1B317F49F75710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671218446, "uuid": "f7498e2f-a917-434f-b100-9171558aba8b", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671218446, "uuid": "04f2ecfd-be45-44cb-8264-c47c55df8d87", "value": "98304:qJAytJIyPJPkWuFu+jyd96SREaM3lq7Xy0yNgLK3ww09fXcKk:qJD2wPdrgyP6JVHhwls", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671218446, "uuid": "8461e1a8-0402-4494-b7ea-c46891fb3e63", "value": 17630208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671218446, "uuid": "b1031c2c-cc9a-42b3-9b56-beb526ccbf26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671218446, "uuid": "8c061005-ff8a-44e2-bb6a-a9cd92eb9959", "value": "a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7f69162-7d2c-11ed-9db1-42010a9c0080", "comment": "Malware payload (RedLineStealer)", "timestamp": 1671186653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671186653, "uuid": "4fbc60dc-21c9-46ca-a6aa-6153871bae4a", "comment": "Malware payload (RedLineStealer)", "value": "450a09f7502f386d2a2be6c01d1a9f64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671186653, "uuid": "08b8a561-0547-4fc2-a0b7-84bd85adc006", "comment": "Malware payload (RedLineStealer)", "value": "f74d9e2d663272e4b2adf3483b814db642197362af9997698a5b76fe8a7489f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671186653, "uuid": "f4b2f88d-a90c-4d02-8c52-a8baed72e45c", "comment": "Malware payload (RedLineStealer)", "value": "9ecc8bd60808f1cec493f2f4101f679242adfc21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671186653, "uuid": "544b98bc-2c45-400d-b021-57e7f9ffda9e", "comment": "Malware payload (RedLineStealer)", "value": "341020ffb6ed3e0e5d9a317ff308276329c1b1046307d9c91c819f5be741054df99d543d517ba3e8a051907d967a96cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671186653, "uuid": "c238087b-4438-4f1d-8530-6a27a49552e9", "value": "T11B74F111B2B0D471C18F46348869DBD85A7EFD314E72648337357AAF6E30B50AA6B34E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671186653, "uuid": "c22f4c5c-90a4-488d-8924-f4772f8216f8", "value": "b35462da489bc13bae884e55b5227599", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671186653, "uuid": "9d9cdee1-363d-40c4-b703-77cd55b0d315", "value": "6144:efkfLSqcQb8EOsCcUZ/f4A8LfyVgl7A9nOtythw0Pu8qMrc:efkfeqxb8EOgUtxCq9nOUE0u8n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671186653, "uuid": "18f52d08-9f3c-445e-a528-79b1b1c2b2b5", "value": 355328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671186653, "uuid": "7f3515aa-4f8f-4451-b04b-2248838c8f99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671186653, "uuid": "076fe292-473b-46d5-a61a-6a69e9093242", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3467556-7d6c-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671214133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671214133, "uuid": "1fbb920d-b400-4122-b942-a5eb5fed611a", "comment": "Malware payload (Smoke Loader)", "value": "2a7d73ee42b1c0d4669cc81800c605f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671214133, "uuid": "ef444cfd-5168-4faf-ae7e-bc50ff866f3b", "comment": "Malware payload (Smoke Loader)", "value": "f74dd5fa6d702e49c5015da44a611dade59605d2eed0438c5fa58b189a27bbf7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671214133, "uuid": "248644cd-ab69-4122-af34-c2ad17f320d4", "comment": "Malware payload (Smoke Loader)", "value": "d9d66291ca43d0d45914f3e034ad7b32ed106978", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671214133, "uuid": "4d6bc35a-7266-4ab6-b9b5-b1e7b651ffc1", "comment": "Malware payload (Smoke Loader)", "value": "5bf42f419b41f272f583cabe58e1c5b197233416344a536f9cf51d7befef70d20ebd7156785e7ea93d446b0d7ddc3974", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671214133, "uuid": "8b6a215c-22a8-4c48-971e-f2f2bb55bbcd", "value": "T18124BFF127A0E87ED151E7308C1996E5953ABC215E22A9F33A08663F1D702C146FE37E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671214133, "uuid": "353df6cb-275b-4958-8808-9970ce6c7f10", "value": "3670997c8c2669588bad5b8c178dedd4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671214133, "uuid": "dfa6c0e6-cee2-45f8-9239-266be8079ef0", "value": "3072:MJquEydLmyjD0RErZahFyI81VCv60LszWVaNx40zwUzQRKF+:gq78LnjHrmk1U60gzVx40M2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671214133, "uuid": "8746a025-217f-40ae-9ad3-a3d3e7a206aa", "value": 219136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671214133, "uuid": "27d82d91-6d6f-4503-9bf1-8905ee973294", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671214133, "uuid": "557ef5bd-83b5-40c4-a693-2ae3436b5326", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b7efa0f-7d14-11ed-9db1-42010a9c0080", "comment": "Malware payload (Mirai)", "timestamp": 1671176297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671176297, "uuid": "425bfe89-a62a-449d-b053-fac6d1a2eab2", "comment": "Malware payload (Mirai)", "value": "fb51cedc358c43f00d22257cb364fcbd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671176297, "uuid": "8b64e4e0-ae8d-429d-858c-0643be350f72", "comment": "Malware payload (Mirai)", "value": "f7628401e0e14877ad553bb428e7eae8a9ae33e603d13d173c5baa65c17b738b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671176297, "uuid": "64a9c100-d4fd-4c59-b5cb-84eb6b340eda", "comment": "Malware payload (Mirai)", "value": "b4282a479a504aba5cd30ba58bfdd311bc81205e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671176297, "uuid": "c3e25701-f9e5-4f01-92d7-c21e3a1904c5", "comment": "Malware payload (Mirai)", "value": "80f0682f2b6530772f54611298fc028f571442610cdf38d0b2de8d118473c4c204f625a2e7701d120e95b30b4fde7b34", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671176297, "uuid": "e28f12e9-cf29-4f71-93be-a2861a4ce1d4", "value": "T193D34C46FB418F13C0D51779B6EF42453322A795A3DB73069A285FB43F8669F0E23A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671176297, "uuid": "7427652b-5301-41f2-9c47-d40b6bab7967", "value": "3072:BxioDMQI5nrIaO4nt3qZg2IWu6b4MX7LkDM/94PmPw/t93:DioDtI5r/nt3qZgPWjHX74DM/9YmPw/f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671176297, "uuid": "03028ab3-8c74-4a99-b838-0a9b9cb1dedf", "value": 135877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671176297, "uuid": "1d613f1e-3a43-41d9-8b4e-7ace31d8bb3a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671176297, "uuid": "d0a58f78-3acc-4895-a194-7ce32104bb3c", "value": "fb51cedc358c43f00d22257cb364fcbd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8498dd7-7d40-11ed-9db1-42010a9c0080", "comment": "Malware payload (Formbook)", "timestamp": 1671195297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671195297, "uuid": "ff0eb053-038b-4011-87f0-9a22460de679", "comment": "Malware payload (Formbook)", "value": "46de6e3ccac76d6d9c4c3e4919b7e135", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671195297, "uuid": "2c9d6bad-04f3-4db2-8c3f-57e40bc55f12", "comment": "Malware payload (Formbook)", "value": "f77ffc2cd499f6b74149242e2a0e5694a9f684afbd1e335f9d3545e6c3a40651", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671195297, "uuid": "e02d8edb-3f5a-47a7-a9ee-b328095d04a9", "comment": "Malware payload (Formbook)", "value": "6160a57b6d276e5277415dae6f657078d7f6065f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671195297, "uuid": "6d31900a-d709-404c-b7a7-364301cf7d56", "comment": "Malware payload (Formbook)", "value": "a5acfa0392145cfbae785bfd9465c7cd205a0f95a268f1b0b2eea2fdf5940cd149efdd5ce038f824ba775d7d2da1f9ce", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671195297, "uuid": "99d95545-98f6-4c34-9f61-697b352e3931", "value": "T1BE94230A11C610EBD4A4493048FB87F9FBB7820815BE969B7F9C5FA95F379D04D0A346", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671195297, "uuid": "b2324920-6457-4f1a-b99e-151099be2e7f", "value": "6144:Qkw5Ozbc0itHVpknYIuGGzQe+rnqLG529GmuVyvp0csCAFSu:WoyBMnYYHHb29BuVyvqh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671195297, "uuid": "59408519-d822-48af-9962-bdc06aa142f4", "value": 409600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671195297, "uuid": "1dbe18a8-efce-463b-8064-37f0502043ed", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671195297, "uuid": "b4ee1bde-17da-42fb-9e89-772e310851ac", "value": "Outstanding SOA.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ba51a9d-7d59-11ed-9db1-42010a9c0080", "comment": "Malware payload (Amadey)", "timestamp": 1671205826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671205826, "uuid": "b86aaf5a-3357-4807-b25d-36f2846bba2b", "comment": "Malware payload (Amadey)", "value": "8036eabff51b228ee3dc8407c86b91c6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671205826, "uuid": "62d76eb5-46f1-48f7-9d3a-370afcd8c325", "comment": "Malware payload (Amadey)", "value": "f9bcba9f3dc1e9e42cb9bbf2a28882d930912fbb9abfb6d49e9fde19a710c138", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671205826, "uuid": "ea325406-9717-4d7d-92c7-0ae9e0005c54", "comment": "Malware payload (Amadey)", "value": "51b1bb90183363a96f7ef59ac9b21b23c71d340c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671205826, "uuid": "188a7251-63a4-4305-85d3-feb9d3db7cd0", "comment": "Malware payload (Amadey)", "value": "e58510726e8a367ff8bf77e2c45817d3c22f2d57bc2a85eba3eff897ff649787bd4a81a64487b985152c5fd261aee058", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671205826, "uuid": "38b1085f-e824-4184-85ab-3821e1485550", "value": "T16F54D0F06690E47EC111D730491596E8AA3AFC219E61A6F36B08372F5E306C096FE77D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671205826, "uuid": "76c86530-413f-4dba-827e-036ce5222ad9", "value": "2cc3e4b8a374ca30888470c0a531eceb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671205826, "uuid": "4090b302-2af6-48c2-ac1f-14736c99757e", "value": "6144:TcL5uuA512yHfKo2UpXyxpyELvEaqw90NNgzviF40M2b:TcIDb2RqZW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671205826, "uuid": "8c51d895-2695-46fe-9ee5-ef683a8c9e50", "value": 280064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671205826, "uuid": "c72513ed-d189-441c-800a-2c2665fe0100", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671205826, "uuid": "2b0a6bae-1be3-4935-b6a3-8bb9e7b90a21", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d892137d-7d43-11ed-9db1-42010a9c0080", "comment": "Malware payload (GCleaner)", "timestamp": 1671196586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671196586, "uuid": "006d17de-bf37-48d6-b655-623995fc70e7", "comment": "Malware payload (GCleaner)", "value": "e0eaf2d8cbc6c9b489a7681353f4fc2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671196586, "uuid": "3d7240a5-85df-4ed9-9ffa-382b46ecefb4", "comment": "Malware payload (GCleaner)", "value": "fa4d30bba115d2da6f10e829c4305e5b3cfb83920e626be6c8611d5512eb8750", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671196586, "uuid": "20d42541-08d5-4910-a65f-ac694b2f390a", "comment": "Malware payload (GCleaner)", "value": "c6c1cc9941c6b80b931b3482da9ae35f2a297496", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671196586, "uuid": "844c4787-14c8-4899-a861-a1847ed9fd7a", "comment": "Malware payload (GCleaner)", "value": "0e4e816dc485f54df27ee6ef35485e487434685abe683ec97ac932c632525ba7f13a165501a642fab0bdf3c6f03940ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671196586, "uuid": "a2c9f1ac-17bb-4649-b4f6-f0864b56ef80", "value": "T18DC523BFA54480B5D0F306FE382A0D6069EAAD23A970D48E37C9BF57B3F39C11916645", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671196586, "uuid": "d6762204-dfbd-422e-b2a7-3a0347bef100", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671196586, "uuid": "dcb90c9b-1241-483f-990e-54880ac871d1", "value": "49152:4pUCZ0hxcSVD/q9drfSW8UftPkMep9w+qifeOCgSY/imD:4pUCSP/q/JhlPkpYifcY/imD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671196586, "uuid": "848c1bb2-855f-47fb-a541-2412aa15cf43", "value": 2572066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671196586, "uuid": "56c50e7c-b16a-4bd2-a2a9-11d9fc794599", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671196586, "uuid": "117a4ec0-0cf2-4b42-99c9-e09021f273d6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e3e4291-7d4e-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671201213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201213, "uuid": "35da44f4-88c6-4fff-a685-d42b3284809f", "comment": "Malware payload", "value": "6480a9c55cee2aca22ed89e351066d6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201213, "uuid": "fad1b6fd-4d96-435a-a7e0-23916f965c47", "comment": "Malware payload", "value": "fa7378e0cfb14dd80a72c29d787d670725bcaed8eb0040e983f03b89282ff73e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201213, "uuid": "069da41c-565b-41fb-8602-7363b2e59227", "comment": "Malware payload", "value": "ec9a9d1c8906950c0d3eae63a2e08acd289b0dfa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671201213, "uuid": "70c50ba4-98de-4f52-8705-cf68eb3f5af6", "comment": "Malware payload", "value": "3a178c6442a9d2a9b293b4e1ba4fd0ffe7b1737d78065912dc049cacf811226c0221219091bc615a909308ea4d1cc9b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671201213, "uuid": "8c9625f4-c9e1-4df7-bdc0-864d2049a08a", "value": "T18C022B26679D5B77E9AF4B339DA323401328E3520E5BC75F2BC4150FDE07B484A93A64", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671201213, "uuid": "f746233b-2c44-48f0-873e-ab874f066299", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671201213, "uuid": "f087bb7c-0c77-412e-bb61-6d0861ae4f7f", "value": "96:ufU1+dsKPzBcCP1XOeOVtlgBDihPj2Qxx59GHVnXaJCrw+xBskMrb38xdY8zNt:ufU1+dpDpOlsiPbxx5o1KJE16ox+G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671201213, "uuid": "5b8af44a-52d5-4b83-aada-d3ba33c4956a", "value": 8704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671201213, "uuid": "efa83339-7816-419a-9149-a1e45440b678", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671201213, "uuid": "446925f7-6815-4834-ba21-1634532206e6", "value": "SecuriteInfo.com.Heur.MSIL.Bladabindi.1.22234.2024", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d96b39c-7d35-11ed-9db1-42010a9c0080", "comment": "Malware payload (RemcosRAT)", "timestamp": 1671190286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671190286, "uuid": "4a1e57e1-894a-43e5-b15e-074738582e3f", "comment": "Malware payload (RemcosRAT)", "value": "37ab44b9da597829adf19a17572f7983", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671190286, "uuid": "98279c9d-bb09-4a31-b559-02eb4fd5fe37", "comment": "Malware payload (RemcosRAT)", "value": "fa965dc6edbb0e244cef4ecab1dabb2d04c9c174e42ac25c60f463237bcea16b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671190286, "uuid": "96576f75-52cd-401d-8f0d-87a7164e6b35", "comment": "Malware payload (RemcosRAT)", "value": "6351ff3af7badcf5be2c492d05a547fe59a4d50e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671190286, "uuid": "70c65fe4-4c9c-4bbe-bc86-8455e12c660e", "comment": "Malware payload (RemcosRAT)", "value": "65ffa9c7b1f7eda369350e6fa8653554a569677123f447281e7091d3493323e070db01538613d1bacb9b5360995bb6f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671190286, "uuid": "65b4c9c3-5668-4889-8c0c-5bca3231f169", "value": "T18BC423916A45C0BBE6550AF488B9C3B3C5AB729208CB743763A01F7C69B53CE7F43612", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671190286, "uuid": "1dba60c2-64a8-469f-9212-a6d16adafecf", "value": "ab6770b0a8635b9d92a5838920cfe770", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671190286, "uuid": "0a6f9d66-f05c-4178-bf58-5e74639dd5f0", "value": "12288:glDm7D8rRGCfrqnAaOsvnzsmMulbXsRoLSQ3:glCfWlGnAan5lbXMHQ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671190286, "uuid": "21fa9178-6918-4202-a0db-da90d974537b", "value": 558718, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671190286, "uuid": "a136ae36-b17d-4629-906c-8b9c58c0aeb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671190286, "uuid": "2fa736ef-cd98-43f6-b17b-9fe3dcc1586e", "value": "RFQ.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa98259b-7d5a-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671206522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671206522, "uuid": "6850bc2d-3e5f-47da-a276-7db911c5920d", "comment": "Malware payload", "value": "c88c6be72cc1854ecb51d4be4e2f29ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671206522, "uuid": "f85a1cb3-9e7a-4565-bb80-d3d7c6b08b0c", "comment": "Malware payload", "value": "fab302f08109cac00c44153332ff23fd29ac92897f89419efd13bac0b1806584", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671206522, "uuid": "d4bfc051-bbf9-4aa1-b7af-2183365e54c4", "comment": "Malware payload", "value": "4274255949593a6f9945e1a9ea97926354307c77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671206522, "uuid": "a4f2bfdf-7c93-46c2-bb4f-6d34daefbbde", "comment": "Malware payload", "value": "c857043ba70e10fbf7a2e12b2a2537f706a65c9de34714e7ac60d9d232409cadedd392e5cf992cd80532cdfe182e0e27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671206522, "uuid": "c3ff859d-ad7d-4799-970c-4f05df7cdd25", "value": "T1B1B522BAA95800A2D1770AFC7C365C7055F3AE076E38DA5E3B487E8F37F64D24526206", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671206522, "uuid": "d0b804dc-dc14-46a4-b950-d813dde1d7a1", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671206522, "uuid": "6ac13d62-301f-4bb4-b0e8-4e035c8a6f1b", "value": "49152:0p2PaZg8KhH4ZdyWi6n2EhE3PIulo7oG4siU/u93ZSeOCgSY/im/:0p2gg8KhYbyWi6nZKPFlfG4b93UcY/iy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671206522, "uuid": "12f200c7-7077-43d7-a9f2-6ea8c579783c", "value": 2424287, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671206522, "uuid": "2a5fdcb0-b77d-46bb-bd99-9dab4536ff56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671206522, "uuid": "f28ae57a-dcc5-493e-9389-7ed29ac48217", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a84d192-7d00-11ed-9db1-42010a9c0080", "comment": "Malware payload (Quakbot)", "timestamp": 1671167464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671167464, "uuid": "1005f5bf-cac1-4f2e-873d-80464d9cbbfd", "comment": "Malware payload (Quakbot)", "value": "ffd52a875ed2a58e68d397b2a4e577b3", "object_relation": "md5", "Tag": [ { "name": "iso dll", "colour": "#AD733D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "sample", "colour": "#FFDEB3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671167464, "uuid": "b722c9c2-de29-4ddb-a5c8-fb713569788e", "comment": "Malware payload (Quakbot)", "value": "fae94575771681fb3938fbef2e6ec26ca66587e605847fd0df49dd16e995f7ed", "object_relation": "sha256", "Tag": [ { "name": "iso dll", "colour": "#AD733D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "sample", "colour": "#FFDEB3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671167464, "uuid": "b0306e13-5999-4d81-9d86-5c6d08cb1b26", "comment": "Malware payload (Quakbot)", "value": "2071bcae9cb7683145ac2511fbc82815967d8b32", "object_relation": "sha1", "Tag": [ { "name": "iso dll", "colour": "#AD733D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "sample", "colour": "#FFDEB3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671167464, "uuid": "8611c253-a414-427c-b7a1-01a3c5a59dae", "comment": "Malware payload (Quakbot)", "value": "e14149d1b04322d1681d78c2256270051c399604e0549981ff9f194fdffd8d2130dd5e600cfec669bb265316b6353c15", "object_relation": "sha3-384", "Tag": [ { "name": "iso dll", "colour": "#AD733D", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "sample", "colour": "#FFDEB3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671167464, "uuid": "5ed0b65c-c462-4a6c-a43a-d6a1f3e912d0", "value": "T157D4232279B6B3F2D1B69AB074355C5006768FC4FE5F1606682F79B2B030E1684BD8E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671167464, "uuid": "82494bf8-0f11-4f1c-8fc1-3124c17e6904", "value": "12288:dVKEpUvLqK+d8z+Sc9x/ES9rFjAtNWx/xCDjU9491lPMu30DQbYQ5CVYQ5CC:xUjFtWxBFjA8pCDjUaUu30DQbuj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671167464, "uuid": "11410497-f0e6-443b-9617-417040dd0bac", "value": 643942, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671167464, "uuid": "609db4c2-d55f-4ff6-98a4-0f80cc1be2d8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671167464, "uuid": "43afcab5-f090-40a7-83c6-b2530f7d120c", "value": "sample.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54c652ee-7d18-11ed-9db1-42010a9c0080", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1671177897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177897, "uuid": "00cbc41b-e041-4e6f-a363-d7f76b9e291e", "comment": "Malware payload (SnakeKeylogger)", "value": "9f946d91031d5d2aec7834169d1772ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177897, "uuid": "7cb85edd-3f3c-4872-b853-e2ae03432b0a", "comment": "Malware payload (SnakeKeylogger)", "value": "fb27645c5ba18a9e7e61876df54e4220c89cfdea419892dc08c32a9a7fe9b443", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177897, "uuid": "4db86e79-df12-49ab-bacb-785cd2765037", "comment": "Malware payload (SnakeKeylogger)", "value": "ffee5e8f46fece0ce13cc7357f1bd57f9f8bc85b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671177897, "uuid": "4a2ad1e6-4603-4e6a-9538-9b916089cd05", "comment": "Malware payload (SnakeKeylogger)", "value": "b7d96b9ccc7dd36cc5436ef8b8aee1aa74fd057650ee388e07d1c31dfd2438a5773bbbb529f20d9864e93cba769621b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177897, "uuid": "4cadba44-683d-4d05-a6db-f61a17cf61f8", "value": "T1DC44127496C184F3E413AA738CA6D759FAF2CB08586677EF6B10EFF9562288144211F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177897, "uuid": "edc175be-ba5f-490e-af98-606b29337f8c", "value": "97318da386948415d08cef4a9006d669", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177897, "uuid": "48e3011f-c069-4c9b-b9a9-f7f365e3608e", "value": "6144:rkwFek0YXuIbkAtqaHk1nWqVY7mUvZ8U+kYvG0QW0vTgOY5r+:na47qN1WqV5UvIf08OeK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671177897, "uuid": "31a31029-d631-4e86-b1aa-24eb26f34ef9", "value": 262694, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671177897, "uuid": "0e225e20-3066-4d14-aabb-648c0bcc6de6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671177897, "uuid": "efb77bfc-d9eb-444f-a82e-44b42ecd898a", "value": "9f946d91031d5d2aec7834169d1772ec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b045cd1f-7d48-11ed-9db1-42010a9c0080", "comment": "Malware payload (RedLineStealer)", "timestamp": 1671198666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671198666, "uuid": "ff7a765c-3621-41ec-bc35-08ec2f6ada2a", "comment": "Malware payload (RedLineStealer)", "value": "85a61249fb0bb77bf47b7fa938ef6f64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671198666, "uuid": "7420a335-ba51-4398-9412-a24196069daa", "comment": "Malware payload (RedLineStealer)", "value": "fb70a80928b0a347337c47d72e7f2441dc445463d91c940267339a6813a5fe7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671198666, "uuid": "aad4a2c2-de03-4c46-8d9b-8f3c5bd459bd", "comment": "Malware payload (RedLineStealer)", "value": "8ee9320e96723c3477d4b3d1f99ed0d9a3c4924b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671198666, "uuid": "da2f8f2f-0ea2-4440-9ae8-dafb8f9964ff", "comment": "Malware payload (RedLineStealer)", "value": "6e1bbe04bcf48c8b02a34d40d33ee057e86d4e8c21186ef25fea69248eb1f5cc6cddedd569e9bddd534a23c83c71a440", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671198666, "uuid": "0e793a13-a4a9-4b55-a450-8a527d910efe", "value": "T127B4CF113BE0D036D2A335328E6AD277A6ADB8315F25478777D0173D6F741E1AA38B0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671198666, "uuid": "df4213e0-e494-4498-a1fd-2d9274bbc7b7", "value": "4b38cf184f731a47b62d0ce56b793831", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671198666, "uuid": "3d48cbf0-2ca6-459a-ae47-ab203b7eafe2", "value": "12288:fKHek0TjkkEESWkP9NjqxqUrZxWty8EUBvtiTc:yKMnP9YnZws8HvMc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671198666, "uuid": "b751fca7-0c2c-4d4d-98b9-cd6e7774a57b", "value": 535398, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671198666, "uuid": "6fd3c0f5-693d-48d8-9e29-be63d771b09f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671198666, "uuid": "ab4cc094-a83b-4ed8-be11-08ad89ba4c5a", "value": "installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20e737ab-7d15-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671176521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671176521, "uuid": "8ab375ba-486f-4a16-a133-56d968d57398", "comment": "Malware payload", "value": "42d95b1ec3c9b4ec7c0d264a06ca7c6e", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671176521, "uuid": "f2b1e4b0-0748-4b7b-bbc6-2b4bfe50482b", "comment": "Malware payload", "value": "fb77a44bb2783a0c7424e4b6559755d7a1b3ba24a60d8798fdf6e18dae3d21f7", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671176521, "uuid": "597c703c-f3c7-42ac-afae-41949f36c536", "comment": "Malware payload", "value": "f22a60b6ef16470401d9311f5f59eaac29db23d5", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671176521, "uuid": "d405d6a7-78d1-43b7-86b8-539443c0d2f8", "comment": "Malware payload", "value": "819d29ffac740169c28549c3f856ca1a0bbb68e201b6a277a10455924e69a24fb45539fa21b38fcf930c62109dac21f2", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671176521, "uuid": "f1ee7b0c-347f-43be-a13b-aeb7a0540407", "value": "T1B02122141EF60324E7F29B396DBAB301893B7C59EE129FCC014092882824621E4B8F3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671176521, "uuid": "6e7734f9-f332-4038-896d-fba8907837c6", "value": "24:8J/BHYVKVWf+/CW6+Oy+RFf2rUMkWh5/mk:8x5aZy+RYrHXV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671176521, "uuid": "24d10337-5122-4406-9bff-718a52a56a2f", "value": 1360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671176521, "uuid": "b92d1fe6-ca72-40cc-ada5-2ab918fd2f69", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671176521, "uuid": "017cc2ab-d734-4a93-834c-251e9730a4c6", "value": "order.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b901d11f-7d14-11ed-9db1-42010a9c0080", "comment": "Malware payload (Mirai)", "timestamp": 1671176347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671176347, "uuid": "8e07b6a5-18d1-41c7-add1-1cc436ee8151", "comment": "Malware payload (Mirai)", "value": "926ef8772bcddc7c7b404308aa8a5200", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671176347, "uuid": "7a70996d-880d-4d71-a7bc-88bc76e709f6", "comment": "Malware payload (Mirai)", "value": "fbd862dbf6718c963aec854d751e7ca11ef07397c0981bebabc522f053649e83", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671176347, "uuid": "e369b829-9598-495b-b026-4886d09897cf", "comment": "Malware payload (Mirai)", "value": "6aedb8a5c57bedaa327a474a99db6c2f2bd68deb", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671176347, "uuid": "a4721e23-cfd6-4b0d-8e06-f606d6c6049f", "comment": "Malware payload (Mirai)", "value": "e568b1a3d85698bc6c0d5b51e67797d2b59b502e8f6169ca29fee84b756b4e41abca0d179c6c9267116c3945d1a036fd", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671176347, "uuid": "c80f8196-cc7c-43da-bb9c-90537d45b0a8", "value": "T1DC431917F94685FDC089C234177EBA3AE92331FE1229B26A67D4FB263DC6D611E09C04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671176347, "uuid": "a8562644-4eaf-4c08-aaa5-7032479c4fc2", "value": "1536:1XIY73si3qEToSRhIN2Q/K6C8u50pfEHwNLW:2Y7H6ETRhI3/Kn5qEHw1W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671176347, "uuid": "15fbadb5-2bbe-4b8d-90b6-ca582a23bf90", "value": 58480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671176347, "uuid": "f308c303-3a7f-4efd-a017-b1141bb0a863", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671176347, "uuid": "667199cb-6304-4901-b55a-356db8e5d1a1", "value": "926ef8772bcddc7c7b404308aa8a5200", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d372ca79-7d71-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671216335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671216335, "uuid": "f4ab3b0c-dd81-49d0-878b-747b5e2ac44d", "comment": "Malware payload", "value": "8af530ac70890e15e31d94afaf52f5c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671216335, "uuid": "a22a6c72-360b-4355-a663-6f741038cc94", "comment": "Malware payload", "value": "fc03d95248c90aade5b63dcc50fe15a1b76e713297e03131e9aa18ee82731cdb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671216335, "uuid": "f9bf48c6-0f57-4fbb-bf5e-b94babe5246e", "comment": "Malware payload", "value": "6f4d358f0e0b8935fe59bd396b77e7a845a7b0f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671216335, "uuid": "0e71f1a1-2773-415b-b4c6-b9544437dc04", "comment": "Malware payload", "value": "a786ac767736e10b22ca9a532ada7636b2e0979db36e52e7a42d169f71a5c9cbc710ba5ed6d45bdbdf1c57306eabe8ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671216335, "uuid": "14aeb86e-ca6a-4045-8313-fa64abf2282c", "value": "T1D4B523BFE6058539C0F30AF43826AD2151E6BD136A68D58E37983FAF7BF94D14906312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671216335, "uuid": "690995e4-be2d-4e11-a683-9de8d23c591c", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671216335, "uuid": "7ab5f6c6-2624-4f05-bb29-bf931fedf60c", "value": "49152:wpDwST6/y20bnqImYCNAu80cTAU4aYdtKEMKw/IuhosJqGareOCgSY/imL:wpEQ20jqmW80wAUFYdtKVquhosM9rcYd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671216335, "uuid": "c40ba47b-7974-4f32-8014-d4aa146c01c3", "value": 2422376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671216335, "uuid": "11358065-67ce-47ec-bf60-4c04a61cf9c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671216335, "uuid": "e78b6f94-cc5b-4d64-bd59-e8af09000a87", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2ed5c25-7d19-11ed-9db1-42010a9c0080", "comment": "Malware payload (GCleaner)", "timestamp": 1671178511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671178511, "uuid": "b9ed1a17-fabf-437b-ab9b-df49cc1e4a5b", "comment": "Malware payload (GCleaner)", "value": "934fac49241ca2f1ce4e3ab2017624eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671178511, "uuid": "b530aa67-d0ca-45be-98da-cc9e43b5516f", "comment": "Malware payload (GCleaner)", "value": "fc804297fcb9eacd603a26257679cd8723c39212cdebbd464fd5c4f897ecfd30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671178511, "uuid": "58e60739-b45a-430c-99b7-00ec6b64dbe8", "comment": "Malware payload (GCleaner)", "value": "7d3170507304e63ba023e6a588c0c0b503136eca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671178511, "uuid": "94c93b5a-1831-409a-a033-31004d256f48", "comment": "Malware payload (GCleaner)", "value": "514716b9c9d1bd8174fb0433c9913844c84f0499f64c2289cf81fa87f8f7bd8437816f46c935c50906be9c44a719ab55", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671178511, "uuid": "a9f73ac1-66c9-4955-b09d-9ced7f4ecce3", "value": "T186B5237EA85008B2C17796F43C219C6545FAAC2B2C21F58E7BED3FA7B7F69C04825509", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671178511, "uuid": "16bf0c07-1a78-44c3-8476-b43e6313f019", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671178511, "uuid": "58e7673e-802d-4f4e-a227-9b6dbf46d505", "value": "49152:YpRqYUxNlQfirUGp4XtVEmJTuB0b86jWfojSP4AdeeOCgSY/imB:YpRVS3YisnEmJTuk8y1jSYcY/imB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671178511, "uuid": "3ef5159d-1a68-4d42-939f-252a8009c832", "value": 2422768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671178511, "uuid": "1db8651e-9d19-49f7-91ed-95baf16077f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671178511, "uuid": "d447d668-7da2-4dd3-b13f-ae6b1ba91d34", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2c65cac-7d8b-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671227474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671227474, "uuid": "804b7361-e4cb-4790-b0b6-ad7044b12c4d", "comment": "Malware payload", "value": "6d65f4dc0b710e0bb994f7a79c29526d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671227474, "uuid": "2f7507f9-6191-443b-bcf9-e89b70a9fe63", "comment": "Malware payload", "value": "fd61726ec48ddfbe4a0c7fd1b36a84ef3e1e9d2c723cc77010eed2f287d50d0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671227474, "uuid": "3f3306c9-23bf-4409-b6ca-c26d60e7be68", "comment": "Malware payload", "value": "259d2edea39cbe4edf1d1cf0b967343c46a0fa67", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671227474, "uuid": "6b408485-66fe-44e5-a5a8-41859a573b4f", "comment": "Malware payload", "value": "e7ba50ecd7bf58700c9718e0c4883cc9080cee9c23bbab18d7e63bfe669360dd7e7a9248ca818e8a9b1dddd9210b01ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671227474, "uuid": "9427d4c1-ea61-4cc1-b2ad-b29b87a67e5b", "value": "T17374E0F037A0E06EC151D7304C1AD6D5457AAD604E6289F33B186A2F2D306D29AFE37E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671227474, "uuid": "3b91dd9b-fedb-4ed8-b3e2-c68d3b9d9e70", "value": "aa9c378109186462717e17e657d0c833", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671227474, "uuid": "1b5c7707-177e-4b7e-ba4b-32d845ddecb5", "value": "6144:3BE/LWTLQ5IvRvLF6Uogm3UAJXTNfe7cgHyW6pgz5rB4fU40M2b:3BWg0w9Ajp9Yv4f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671227474, "uuid": "0607d8bd-4df9-48dc-8597-8a68e1dfa6dc", "value": 341504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671227474, "uuid": "55a8c3f6-d801-42cf-ad64-4b5b2e5a57c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671227474, "uuid": "2db290f8-61e1-46c5-be21-4c9e48fc0c7e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92de258e-7d95-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671231688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671231688, "uuid": "50f49f77-b321-46ab-b921-9b7a415b6545", "comment": "Malware payload", "value": "86ffcbb52850be1f0b4ce22effed7b6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671231688, "uuid": "15a3ead8-3b4f-42bb-94d7-a3e7e03a60cf", "comment": "Malware payload", "value": "fd98f07caf7e75af61996bff9690a93520247c5f1fe9285bea764e32162acd76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671231688, "uuid": "ab0a563d-7939-4524-a17c-8fe0f82d89d1", "comment": "Malware payload", "value": "fd45c13f6f2f6e2741aef2766f64ee3dc1be175d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671231688, "uuid": "9fd1b346-2cdb-48d7-8299-749484d9afca", "comment": "Malware payload", "value": "8343685973e72cb481cb5cbcf5389f4cfe56bcfdecf715552e1c07f24829824a34f0480adaf0342fbbb2ae355d72c742", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671231688, "uuid": "34cca764-b2df-470f-bbe5-ef3e1f00a9c4", "value": "T146C523BEE14404B2E1F384F8B8609E3245E57D1B19B0D55D3BDABE9F73FA1C12A02256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671231688, "uuid": "2b4b5366-b396-4d47-a281-60ef006d8518", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671231688, "uuid": "94c6f556-f2b6-4159-9c2e-7fdce696a153", "value": "49152:opQlpll7XruZR6oan3W/5DG1GkQHgdyHLuQ4UPI+OpLteOCgSY/imz:opQlpr7SeoTS8kQHvFPGpLtcY/imz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671231688, "uuid": "a49751a5-4bb0-484e-89b4-1c34c763b486", "value": 2571547, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671231688, "uuid": "27c02e82-cf0e-465d-8cf7-871d05d14026", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671231688, "uuid": "23e68891-8a79-4494-bfe4-b8d16ac60fd0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23e74494-7cf6-11ed-9db1-42010a9c0080", "comment": "Malware payload (RedLineStealer)", "timestamp": 1671163212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671163212, "uuid": "40993d84-31c9-46d4-bca6-b294f6cfd068", "comment": "Malware payload (RedLineStealer)", "value": "6d3fba799241183ff775dcd8881a14a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671163212, "uuid": "8d656fe2-ae73-4d18-82c3-c04fc8be1668", "comment": "Malware payload (RedLineStealer)", "value": "fdb5a80b4548d2f0a1aa4c70a7f7371d560da3f71014e6cfa5fbc7770651939c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671163212, "uuid": "8c0038b8-8662-4bbc-8f82-e8d2b4497dd3", "comment": "Malware payload (RedLineStealer)", "value": "943b770c8a44d8962faeb1293ebe520a7075aefb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671163212, "uuid": "823863eb-196c-4ead-baa8-bc8c0f37281e", "comment": "Malware payload (RedLineStealer)", "value": "f7ec3dd3578ec8b20797fcd2d91638eafd39e3fcdb0cda345cc9b1b2417e739cb0a451859ce779a417234fed9cc53845", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671163212, "uuid": "8b90f33d-18bf-4fc6-bc6d-69ff71df2f94", "value": "T10094E0113A73E4E1F932C6704926F7F4666DB860BAE1DA33331AD31F99302938566F19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671163212, "uuid": "491a9ee7-21f1-4c01-a224-e97ff60d281a", "value": "2067eb05796787c0f2b3dc09403197ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671163212, "uuid": "ee89fe74-62b3-4b3f-a41b-175423fe5814", "value": "12288:RytTdB0jnrodv5GOiCDv0L4XpxnzpQ6ijqF:R6dBsodv5GwL+4vzK6Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671163212, "uuid": "e4bfdf16-09a7-4ee6-979b-72dae0b22ab4", "value": 443904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671163212, "uuid": "1f288c6d-b9fe-40a8-a9b3-6d42c3258f58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671163212, "uuid": "ba229df7-67d1-4fa1-a1fd-eabb9321f202", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e86909d-7d37-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671191308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671191308, "uuid": "dbb09609-80cf-4fe9-80bc-28e761115d8b", "comment": "Malware payload (Smoke Loader)", "value": "fae57d267d6a28961975a5b2c2580b63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671191308, "uuid": "5a6ca75b-a4db-45ab-a5b4-37c05f79e30d", "comment": "Malware payload (Smoke Loader)", "value": "fdd9ab25f8e8fbd822043715165127fcff91d8d36de41610d4e4bbb3f20a4958", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671191308, "uuid": "d37880bf-f3dd-44b1-9fc3-6097006c3ec6", "comment": "Malware payload (Smoke Loader)", "value": "cf51c008d82d7ebbe7d6522380b208c9fe9e9343", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671191308, "uuid": "e97d36fa-db45-4132-86db-71d1fb2907ae", "comment": "Malware payload (Smoke Loader)", "value": "2c20c124412ac3c3aedde10253301ba872a21b875bea177ae1a9e69ed13760941b0c6bc154f96260dbf2ab1dca1e0619", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671191308, "uuid": "dfaf7326-b2b5-44bc-b555-8a1529834973", "value": "T14424DF21B2A1C472C15F45748D6BC3E05A2EFD314D71AA8377723B9F6E306C1A62A74E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671191308, "uuid": "3f37b809-7d2e-4b1f-b663-737f9b40fc67", "value": "875e7ce4bbed8fa04d22755473fc97c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671191308, "uuid": "950e7e87-9275-44f4-abdb-ddaf7d75903d", "value": "3072:GwjfO9ELRrU17/5w9KD9BNxJIiCvA+xBLQ2mppGT8ucdIBSp0HtWqMPDcfuf:fjfDLRrU1009BbSStmcdW8qMrc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671191308, "uuid": "a6fbce3a-393f-4240-af6e-b248193417af", "value": 226304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671191308, "uuid": "8cf24e76-609e-4bb1-b6af-28ac75182ece", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671191308, "uuid": "07dd7a81-71a2-4c52-bcfe-b7314857e970", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f9bbe58-7d1d-11ed-9db1-42010a9c0080", "comment": "Malware payload (Smoke Loader)", "timestamp": 1671180036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671180036, "uuid": "a62b11e5-cde7-4d75-a68f-93623228ac01", "comment": "Malware payload (Smoke Loader)", "value": "c6d50f6a6122bdfd47d32ef5bf8913c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671180036, "uuid": "50938333-547f-4f8c-924c-49147a575693", "comment": "Malware payload (Smoke Loader)", "value": "fe3076bf188152126bad671d1c0a3a2e2a7790eec86be0405bdfd04552220531", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671180036, "uuid": "e25a0635-18d3-4745-8cf3-38b4f0274951", "comment": "Malware payload (Smoke Loader)", "value": "072b0f6af9f4827b8c35d285849397862ca4c589", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671180036, "uuid": "ef3e833d-e700-4e28-92a7-f1b51ba23d0e", "comment": "Malware payload (Smoke Loader)", "value": "5e9bb269800720c8c63666ac24b7ba6ea8ebffe0fc639bb4aac6b2b1d1e9bc17f90d8d325e5a37ec97b021df278de1de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671180036, "uuid": "55a7880a-4fbc-4dea-b098-4408cb6870b6", "value": "T11E34CF21B2B0D472C19F06319869C7F05A7EFC314BB1565737356AAF6E30B806A7A70E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671180036, "uuid": "73977c4d-535c-4e6c-826c-857182b5fbdb", "value": "b35462da489bc13bae884e55b5227599", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671180036, "uuid": "0c76b471-9fbd-431a-8a43-6bd7fdd5b11e", "value": "3072:rj/kiOIQLUAnb3qocRQivsbt6X68sAe9IEqR4LQ2mppGT8b2k+PHtWqMPDcfuh:n/kFLUAnbaXEbte68XnJrtTM8qMrc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671180036, "uuid": "f1e76909-3195-43cc-9209-2970186a9a31", "value": 232960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671180036, "uuid": "46a4f52c-c397-4860-b836-febfdfdbf725", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671180036, "uuid": "e06751e4-fa45-4d0d-bc86-52e81876aa2c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c09b069-7ce7-11ed-9db1-42010a9c0080", "comment": "Malware payload (Amadey)", "timestamp": 1671156944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671156944, "uuid": "fb481350-1b0f-4f21-9a11-5be81c6bbd17", "comment": "Malware payload (Amadey)", "value": "492ac4735dfc5723a817b72aa743c356", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671156944, "uuid": "87feaabd-17cc-4dc7-bb45-d135c52d7936", "comment": "Malware payload (Amadey)", "value": "fe34d279b90129e50db3a99f6fd5ce3ad2367b05afe3b3b2d2681ede2f96a6c1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671156944, "uuid": "494bee20-de13-4cc8-9f96-5c52d03b70b1", "comment": "Malware payload (Amadey)", "value": "dcec8b3dd26afce109743014bb76e7819006ad8d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671156944, "uuid": "16593839-0a9b-4fca-bfd3-d9b57b4f79fc", "comment": "Malware payload (Amadey)", "value": "5fab829c0c2636c15405ad886557892dc60e0b9fb77c7e8255f54a3132f7f96654d780dc56b3a58594ba22fff5ea58ef", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671156944, "uuid": "14e399e5-75cb-4afb-8d14-a5634dd5624d", "value": "T1D584CF017A73A4E2F971C5774826FBF4E669B820FAA1D5333709D71F99302938726319", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671156944, "uuid": "a54936ce-e542-4d00-b1d3-9cba3ec74b60", "value": "2067eb05796787c0f2b3dc09403197ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671156944, "uuid": "a45f9e85-1eec-4d45-b067-a2ecc3c8ae93", "value": "6144:zGY/7Lf8U4Ln4WIOyDrXUbc/oF3lTb1vP4o0iPvzpQ6ijLxQFiaI:F7oUAn4WI7obcgFV3lP4oxnzpQ6ijqF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671156944, "uuid": "23eb7cf9-9df9-4957-99d9-27cdb22cc7cd", "value": 381952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671156944, "uuid": "f05df1d6-ea0e-449f-ad42-12f88a91b91f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671156944, "uuid": "e78d49a9-925d-419f-a745-6fa893c25d9f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90d0f7ce-7d2b-11ed-9db1-42010a9c0080", "comment": "Malware payload (Amadey)", "timestamp": 1671186158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671186158, "uuid": "e7f29c79-655d-4785-8b54-2e0c2b759f06", "comment": "Malware payload (Amadey)", "value": "2985f2730ffc4f3588a17fad1e7d60b4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671186158, "uuid": "fac268b1-4343-4d07-8534-f22f23d05b16", "comment": "Malware payload (Amadey)", "value": "fee8358c18d8213b3402440a14e27a42843ebcb721d397c620484e107c11707a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671186158, "uuid": "6e89d844-5e2b-4f65-a082-598d1e56cb2d", "comment": "Malware payload (Amadey)", "value": "b14987dd2e15ece97b7db1c5e3ae1a9af839c7aa", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671186158, "uuid": "fdc2195e-45f2-4dc2-a1e2-e990b4084dd9", "comment": "Malware payload (Amadey)", "value": "203a11dba06e82832305d16251d08797fb9b0749624ccdf706a29cf7e9990106083a6c1d7c2ac06255d4ba467528a764", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671186158, "uuid": "b1ef65fb-0636-45ae-946b-bd10bb1dd971", "value": "T18E54E02172B0D032C09F15348867D7E45A7EFC315EB156873B762A9F6E30E90AA7A30D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671186158, "uuid": "57e65027-496b-4185-b285-6e614c258695", "value": "b35462da489bc13bae884e55b5227599", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671186158, "uuid": "19f5662c-f14d-4d56-83d1-926102873e41", "value": "6144:EdkgdLIM7GP1Rp6dliG46TTtwtPqNGFDtglG8qMrc:EdkgdcMSPJ6Xf46TTKPzFDSlG8n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671186158, "uuid": "0406b73e-3138-41b1-b24f-2521c358096c", "value": 293888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671186158, "uuid": "402326f1-eab7-4c06-822d-0238557b10e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671186158, "uuid": "260fe15b-e444-418d-8a51-8e62a62eece5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d8828f1-7cfa-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1671164892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1671164892, "uuid": "c82857ea-7dd9-4ac1-8f1f-bce7f9d268d5", "comment": "Malware payload", "value": "e139bbb1879cb7ff17bfddf56dbb2186", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1671164892, "uuid": "863fc32c-2f6a-42d2-8289-3f6913699ced", "comment": "Malware payload", "value": "ffda7e756dd083ce87c1dc9b9160e8223731dc35cdbf398415e8f1d8c38f9365", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1671164892, "uuid": "d3332899-2612-42b8-8807-54034f40d4fa", "comment": "Malware payload", "value": "033978ee9569ccd30afdd8f9635250e46a7db33c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1671164892, "uuid": "afb46c0d-e53f-40ee-84ad-6fbf214fbd8a", "comment": "Malware payload", "value": "0443e9c641dc4f4ba5af3930d1e8d11fb4c68b64c24d1cdd475fd685403111087e73797a5560d58061b1a4ffc51a4f42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1671164892, "uuid": "6a283e44-0125-41c8-971d-4947b0b10ec6", "value": "T1D4D35B2071C0C272D51510B647A6CF71493A7C382E269ECB6FC90AF50F79DE6D72A38A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1671164892, "uuid": "819e06cf-41f0-4f9a-8420-10f9e962ac85", "value": "adc0955cc8ee35b478eedc0c066bed22", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1671164892, "uuid": "92b78167-e86d-4188-ab0a-2395a2425f6c", "value": "3072:Ce1IPQK+pLqCi51n/mOJJin5wnl4+U5NP5:IQK+pL851/H7W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1671164892, "uuid": "35855575-bf25-4120-9c36-a196bd56590a", "value": 131584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1671164892, "uuid": "dc175426-901d-4624-b2bd-f335a28e9a33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1671164892, "uuid": "48d8f963-a3b5-4bbf-9903-6869e8788531", "value": "SecuriteInfo.com.W32.Injector.ESFO.tr.14849.13739", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }