{ "Event": { "published": true, "date": "2021-11-03", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-11-03", "timestamp": 1635984181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "9d0338b3-d2c1-45ac-87f2-3596d3570808", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2c459f8-3c8a-11ec-843c-42010a9c0014", "comment": "Malware payload (IcedID)", "timestamp": 1635932748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635932748, "uuid": "8526367e-29ee-4219-b1f9-e44356cc57f5", "comment": "Malware payload (IcedID)", "value": "612dfefb5473dad28e6da06550442a7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635932748, "uuid": "84509150-4fa8-466e-a30b-07b8aef42e43", "comment": "Malware payload (IcedID)", "value": "001153b7500bc0d49075d06a77958864f64aab5df98241577db6234f2ba8fe4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635932748, "uuid": "b813b5e3-d57a-4ee8-a6e2-34a57feca0c4", "comment": "Malware payload (IcedID)", "value": "c7ca7ae40969a7ab02cf772147c150715833ca80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635932748, "uuid": "39d48eb6-7101-4fc9-81da-2862233a7d8f", "comment": "Malware payload (IcedID)", "value": "d397a48a7b97a8fcbb1cb87e4739121b41756dc0ac1183a061f0cd56d2980d3ffc9f7ad4369d31f30baec160b4d06484", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635932748, "uuid": "a78bd678-4dd5-4ff9-b690-3108c79bf3f4", "value": "T153549D10A7A1C034F4B256F885B6A369B93F7DA16B3850CF13D516EE56386E1EC3134B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635932748, "uuid": "cb13b828-4f4c-4fae-a782-2ac385425210", "value": "7e51d9833813c1a3fb57baba54855909", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635932748, "uuid": "91eaca5b-1ee6-4602-be52-96db30aeb996", "value": "6144:VzkaJEW2xa8TAymVZKEzs4Fvz+ZwvHWvDo0:Vo6H2xa8Ey9Ezs45swv2v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635932748, "uuid": "197e7c0a-9ab7-4da3-9fa9-6033253babfa", "value": 295424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635932748, "uuid": "05185307-f192-4818-86c5-25ca7f2677eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635932748, "uuid": "8c481eaf-af31-41f4-b849-246ef420d7ac", "value": "612dfefb5473dad28e6da06550442a7c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bb42ff3-3c88-11ec-843c-42010a9c0014", "comment": "Malware payload (DCRat)", "timestamp": 1635931555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635931555, "uuid": "bee5ac6b-7f25-4805-b06e-368acec2427f", "comment": "Malware payload (DCRat)", "value": "a6e9c7d79d991533cd2bb425dfdbb0d2", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635931555, "uuid": "170dbf50-daaa-43fe-ace4-858267bbc798", "comment": "Malware payload (DCRat)", "value": "0052b3a401ac850dae74c63f6efd7e57755c446de19bac1a251cdceabb51b46c", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635931555, "uuid": "1260fdb1-6757-43a5-a529-5f99153c3ddc", "comment": "Malware payload (DCRat)", "value": "fe2db2c3d8da3abaad4be4ef66e2032329c5990f", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635931555, "uuid": "d8a1797b-ea99-4de6-9506-24e793c60aa0", "comment": "Malware payload (DCRat)", "value": "15f024f5e95b7915d6f42119154ad27aaf833efbb9b3e625a0052216af11e7131ef106f3274ae03101edd2af28399521", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635931555, "uuid": "a75c1836-3680-49a3-905d-92434c3109ac", "value": "T1B7152812BA84CE02D129163BC5EF405847ACFD017A62DB1A7EAFB76D24517A75E0E0CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635931555, "uuid": "2c860edc-3fb6-4d4f-b2d7-98f6a643a299", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635931555, "uuid": "6e04f3e2-3664-4bf8-83f6-6662a815ed4b", "value": "12288:p32kv/vviribHXifiyINTi/l6Fn61bxJwsVzoEubIXqn4:12mv/zOivA96Fn/sVFaIX+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635931555, "uuid": "b8953daa-5eeb-49c9-a6d0-d1ff59ef1ca7", "value": 934400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635931555, "uuid": "335714f3-dfc6-4445-914e-a0324e89a629", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635931555, "uuid": "dd764140-2588-4e29-b8ed-d743dfb3ac2f", "value": "a6e9c7d79d991533cd2bb425dfdbb0d2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "106a215f-3c5f-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635913953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635913953, "uuid": "757004a2-2e65-46cc-8a98-e4ab772da830", "comment": "Malware payload", "value": "717fcad429644ff0cfbc31065273cd90", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635913953, "uuid": "c210f9d6-e1d1-4c78-af90-88ebda67e55f", "comment": "Malware payload", "value": "011098b260ca9ea420168afe75ccc0a0d60a4335ad007b6371004fb5065dc04b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635913953, "uuid": "8c34b66b-7533-4e39-9ea7-274c73ca9c2a", "comment": "Malware payload", "value": "2145a710f425f847c641427f7beaa41983be4f23", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635913953, "uuid": "05482aaa-57e4-4a06-a9b7-d3701fe3b213", "comment": "Malware payload", "value": "0013595db35bfc28ba9bec67d2e594316349104a5f5501164d46c6ba3fe0b9ac6f7a0eb1ba56b2ddcb0ce455633e84b7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635913953, "uuid": "bb133aad-5cda-4c51-97ac-6d7e9efefeb6", "value": "T198D6330A6C56D8E6F816083106E9DFFA46E72DA2C7D42D67CFAF32E50972E49C50D630", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635913953, "uuid": "0909619f-e1e0-41db-bee1-287bae27a8ca", "value": "ffe3cc63e5a1efb4d2f4cc004c584646", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635913953, "uuid": "03d3301e-15f4-4630-8a44-fa9562de58c7", "value": "393216:2pSTuSrp5EeI1xhoJPagWIw1/NqQOXZpKDqpSR9mTRi8:u1Sj3AAPagWIw1/fuSRGi8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635913953, "uuid": "f38ccede-a1df-488a-9010-5bd838ca6e8b", "value": 13098849, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635913953, "uuid": "ceb3a583-5664-4110-8bdc-47d9cf387390", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635913953, "uuid": "1522b9be-9b41-4230-bcf0-d1c2b27fbb49", "value": "717fcad429644ff0cfbc31065273cd90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be85fa04-3cb9-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635952900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635952900, "uuid": "8d478f39-0edc-466f-ab6a-2c16d5ae2555", "comment": "Malware payload (Mirai)", "value": "6fd02179026255fdc7a865ff0d61eb80", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635952900, "uuid": "f2bde921-8ba5-481b-88b7-8128be3ef884", "comment": "Malware payload (Mirai)", "value": "018ba31da9f23190bbb65f9905043c69ffe9f899df2644ea1a7c1238747d7f43", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635952900, "uuid": "a0855847-9b54-447f-80c6-8201e40391ce", "comment": "Malware payload (Mirai)", "value": "cc9609e4194b0cca956297ab3640202438eaa165", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635952900, "uuid": "bf2f00ef-3cb8-4b9b-ac1a-0cfa2a1cc23f", "comment": "Malware payload (Mirai)", "value": "46a26ba958c4bc7482ec5f33c544e505c3232a36761260c58fabbba06b17898dcee1a7b2c1c58bbc37fd21a8e20b4760", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635952900, "uuid": "6454014a-cd2d-48bc-8915-96094f04d24f", "value": "T1FB64D086EA00BF75F4C151B9FA5F034973738BACD3DBB211E6149B24368A64B0F7A185", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635952900, "uuid": "036f5d68-1e7d-42be-a545-a781507b4215", "value": "6144:2IIKXhZtL7jOTyIG87XyBa77oNsKqqfPqOJ:ZTj8w6yBa/HKqoPqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635952900, "uuid": "3ff8057f-c540-4f83-b57d-f381d8985099", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635952900, "uuid": "0ce0e5d1-aedc-41ea-8d52-96c7bd12264e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635952900, "uuid": "810d32cf-adff-40c7-be28-21d52c976e15", "value": "6fd02179026255fdc7a865ff0d61eb80", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0521470-3c9e-11ec-843c-42010a9c0014", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1635941253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941253, "uuid": "a3ebfa1b-c083-46a7-90fb-45883e98e2de", "comment": "Malware payload (AveMariaRAT)", "value": "ec46f95f234b89325e198104d1887b1c", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941253, "uuid": "c222aebd-74ef-4925-a78a-d884e46e67ff", "comment": "Malware payload (AveMariaRAT)", "value": "01bbef21bea94b6ec60c739df3e40e887cf0ea1df7ba2f1678ce708ba10a6203", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941253, "uuid": "70ae989d-5eb3-4c49-8394-9fde927f181c", "comment": "Malware payload (AveMariaRAT)", "value": "d0600cdb17f86f31eff130d029a87717fde2cc7a", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941253, "uuid": "3675560d-8e6d-4012-8141-f78c6c45c114", "comment": "Malware payload (AveMariaRAT)", "value": "cd921ec33e9e8c01de42d8872197d69624b738aae072a1aafc698e9ded6300438c370e011600abb899aec7ce6f82858e", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941253, "uuid": "6775ee4c-23be-4b1a-8c5f-0ed2cb85465b", "value": "T15B25B30C26A19487C0DD6AB06E5DE77B17222DBD6721C63630F4BD5F385A3A71E2183B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941253, "uuid": "9b12191f-10fd-44a5-a6cf-63fc835772d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941253, "uuid": "7b2962f4-4029-427b-b383-eefa774be163", "value": "6144:KMs+2EfXXT4uWtf5YTZkUPTUTsTlNOsk4F8d5JF4Nydla+4dZN0lTwI:Kk/DeV5YTZHPTesTW5JF4MN4dU1wI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635941253, "uuid": "41b91e35-b213-4967-ac53-b894a0f48794", "value": 963072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635941253, "uuid": "dbf9602b-d804-47c3-a4b9-6a7d8195b341", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941253, "uuid": "dc3dc3e2-badd-4026-9fbe-d7c5a4ee4498", "value": "ADJUSTED PO3917NOV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41f2e6bf-3ca0-11ec-843c-42010a9c0014", "comment": "Malware payload (Kimsuky)", "timestamp": 1635941954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941954, "uuid": "5662852e-cdd1-48ed-a5aa-ecbd4c35d3db", "comment": "Malware payload (Kimsuky)", "value": "c7fbffb557c2006fd3316470e0c763d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941954, "uuid": "4ad8ba6e-2d4d-435c-9741-bec1b4fc5333", "comment": "Malware payload (Kimsuky)", "value": "01c73508c658180fe42d7adbfef22f00344d8e7983e0e97ad8329e40adccf47d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941954, "uuid": "19bced34-eee0-4323-baae-b1dba44d9a5f", "comment": "Malware payload (Kimsuky)", "value": "91baee426bab2d9bdb20e0a6a50d559b8537f924", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941954, "uuid": "62228a00-55cd-4b15-a2cb-ea89a6654905", "comment": "Malware payload (Kimsuky)", "value": "55b9bffc01cd625f73c253aa1332130ce6cef5a992766a4e6bd7a7386565a3db496eebfac89edadb65a5764830b4db95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941954, "uuid": "868ec04d-f189-4c95-9961-133e419e3fac", "value": "T1C8A44B2D59A5027DD0BBD178C5974983F675380A23BADDAF03C042B31E53BE1AE7A718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941954, "uuid": "1ff3ed14-2958-423c-8182-b3a774e5ce46", "value": "135958949bbabf35c044a2b7dd89f880", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941954, "uuid": "346f326d-2b34-4434-9d6a-bbae572b1b03", "value": "6144:kE/Np5M0cqbMwItoiwEW9m37Z1BsJOtYVOPv7O9oh/xB4W58lisn2:XMSiwEJ37ZbOOLLO9o6W58d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635941954, "uuid": "b000a63d-b16e-4cb5-8bd1-67fc8cd75b3f", "value": 485888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635941954, "uuid": "ac382895-984f-4e3c-8e38-f44811eebebe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941954, "uuid": "215b04f1-0059-4f11-bc95-7fd7bceb6dfa", "value": "01c73508c658180fe42d7adbfef22f00344d8e7983e0e97ad8329e40adccf47d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c650fb1-3c4c-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1635905786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905786, "uuid": "6e4b9555-3dcb-4109-8340-087499ad90ad", "comment": "Malware payload (AsyncRAT)", "value": "451d77631aab139fb137b12dd710b244", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905786, "uuid": "0daa2b23-e022-4bd4-90c0-a996daaafc28", "comment": "Malware payload (AsyncRAT)", "value": "01db14125d7064a1ecb9e3b2c511c97bb234cd7a6aaa413ca3efd834a287947c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905786, "uuid": "2020a221-64db-4ee1-9b59-c3be81e3a1da", "comment": "Malware payload (AsyncRAT)", "value": "5459a53bd3d379d424b2346decf651ba0507a9fc", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905786, "uuid": "1abb6ff3-ddc2-4bdf-81e4-b36cb258d164", "comment": "Malware payload (AsyncRAT)", "value": "0b1514d78d78e7a023f5e52fa18452c0b1ea81b4967147196dc88c0ed19ee0ff76185e3bb950e1cea64bdc2514ea7607", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905786, "uuid": "be7ee62e-3bd0-43b1-89c2-6bbd1dcb5051", "value": "T1B7151B3178E8788CE9D5483044DD6D520DAEF9733D9AF15A94E2AC4CD0731836DAEE2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905786, "uuid": "c5a74b13-af78-4fa3-8c44-08b0e2b71f37", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905786, "uuid": "7254b3a5-274b-4724-91ea-a2f0f46e33f9", "value": "12288:IFGKZCc1A/W9bRZ9bRoqJFTPruUsKb2cThQlMVVRk8251sUX7sMsrQ:IQKEcTtDtoqjbFThSMVVU51sUIDU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635905786, "uuid": "78ff6490-d2cc-4119-9a52-711a8ed86c96", "value": 924160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635905786, "uuid": "eb5adadd-f4be-4354-b95d-73e313f7cf96", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905786, "uuid": "bf48df12-5147-416c-80a7-338ec714bb72", "value": "Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e03d4bd-3cc5-11ec-843c-42010a9c0014", "comment": "Malware payload (Hancitor)", "timestamp": 1635957919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635957919, "uuid": "537c6a1a-1a55-4581-860a-c16384eb0de2", "comment": "Malware payload (Hancitor)", "value": "5be18cbb1860b0455aea51a7da859913", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635957919, "uuid": "efea2e0c-87b1-4bd4-ae3b-760539762105", "comment": "Malware payload (Hancitor)", "value": "0200a1a5dce110faa6c60d22bc1b426b36648a4c58ec9285f8bd41b77a62cc57", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635957919, "uuid": "b03931f0-d8b5-476f-abbb-deb2c9c5db1d", "comment": "Malware payload (Hancitor)", "value": "2faa9403ee58d08be028718d00df0142509d6848", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635957919, "uuid": "86e889b4-5f98-4744-8db5-1c9fd1aa9334", "comment": "Malware payload (Hancitor)", "value": "a8b78756d3bd75f1763c70dd07cd9fe442b4979c6b55f0b9970f16179be3e1c19344052a0d7dd48f675a57323bafb221", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635957919, "uuid": "22cf0634-f644-4bb5-bf0d-9bed6dbc5fa3", "value": "T115C40103F9959F57E51BC3B87E628C696B6DED494B08B3CB10317F0EA7B43609C4264A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635957919, "uuid": "c9935748-66e3-4abd-b6db-8ca0cb151f3f", "value": "12288:GV9iQsDr8NP0tEILt/5J0RiCFNpQU0czB:GVXkr8N8nLl08CDkcd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635957919, "uuid": "e39ad880-d641-441f-8bbe-59fb1208b1a7", "value": 589824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635957919, "uuid": "32cd509e-51ed-428c-9a6f-9a40b34f1cf8", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635957919, "uuid": "60e46c0e-e08c-424c-96ad-62a49576d476", "value": "5be18cbb1860b0455aea51a7da859913", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8f4e289-3cd9-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635966742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966742, "uuid": "07d8cbff-d54a-4b81-addc-cb56fbb7ce5f", "comment": "Malware payload (Loki)", "value": "e4627d977794afa42fa16138c7fa8a6c", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966742, "uuid": "06579823-a2dc-45fa-8893-0540cc37ccea", "comment": "Malware payload (Loki)", "value": "02163c0d23dc9c57a55417f518c12279305ef96fa4a88e2fef087e68db9ded8e", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966742, "uuid": "3d76e2fc-40b0-4582-8c82-ece6563cb2ad", "comment": "Malware payload (Loki)", "value": "3bdb91085d6b8e124d079e12cfdebf8a34dac3cf", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966742, "uuid": "f1ffe690-5ab2-4c6d-b273-882e949b4937", "comment": "Malware payload (Loki)", "value": "7cfe794ec8cb1aef51febb543e99c45127cd800d0a2e2fc6afdbf1009802686878443a4cfb5f3e6d990308118a41b058", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966742, "uuid": "c4a85832-5c99-4c38-971d-74c354c60d33", "value": "T1E21412273694C1EBFB759B702005BB51AE03AF7D5E472F4782C27F6609BA1A49C22317", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966742, "uuid": "4a050620-3141-40e0-89b3-b519ed2b67db", "value": "3072:AkFzrMheaUFFKCVhudPhx7XKQiznHPM3kgstH5/ZKyPkdKxFhhtrx4mUpM9Yu5mZ:FkeFYI+PhBKFANsTZKyRFtl4mU2H/I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635966742, "uuid": "762663d4-1dce-4f1d-9c47-476e9f42cd02", "value": 190888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635966742, "uuid": "ba945d24-fc17-42d3-a114-d97c717d50d3", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966742, "uuid": "d646e379-0654-453a-93d7-2f77a30c0ead", "value": "MV BROAD GLORY.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0625ce02-3ca4-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635943571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635943571, "uuid": "755ec30c-6f9c-4375-b13d-35905cdc47f3", "comment": "Malware payload (Mirai)", "value": "077d2b336f91e8060a52dabfb8221689", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635943571, "uuid": "8fbcdb7e-f7c9-465c-a961-ebf259b40bb0", "comment": "Malware payload (Mirai)", "value": "02cee28656ba226b64cef6e0daa9d4bfac2f7dc8c0f0a756f714f8dcd979a1b8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635943571, "uuid": "09b90568-966b-49fa-8a98-47a563739859", "comment": "Malware payload (Mirai)", "value": "493bd4f24f9441468f00b2847c8271bbeb5bfe2f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635943571, "uuid": "69305b4a-be6c-44e3-8b0d-4476680dcb37", "comment": "Malware payload (Mirai)", "value": "500b6ef2d5c6e4affc189aa28eb26a4e81ec3069daa2c48a381a0425edda894e766814e0e45e6c43e8620d4dbb532275", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635943571, "uuid": "b8938313-cf27-4718-898b-9abc5bb53d16", "value": "T1E943199178D19A16C6E423BBFA6E40CD332563E8D1DF32179D212F1177CA82F0DA7A91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635943571, "uuid": "47c97099-7560-4a04-80ef-c2b4282fafb0", "value": "1536:EaDIpuRZhJRAAMA+xVZtWaWhK3+y6MdD:EaIe6ZtWhhQ1dD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635943571, "uuid": "d549277f-8415-4047-96c5-6e6dbfff5f73", "value": 59988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635943571, "uuid": "b66dfe51-6b37-4134-b932-0adf5107863c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635943571, "uuid": "2d889ba8-f675-4ea8-9a6e-e26e6876921b", "value": "077d2b336f91e8060a52dabfb8221689", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a1d08b5-3ca1-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635942289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942289, "uuid": "b371f861-b6ac-43aa-bc79-9a6d929ea883", "comment": "Malware payload (RedLineStealer)", "value": "5faabd13262768f267fed99beb1ad98d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942289, "uuid": "830aee36-7bc7-4dad-9068-0483c7558cc8", "comment": "Malware payload (RedLineStealer)", "value": "033d13c261c0a0512fe11fb30b217f7dc75a9d61f907beedd2565bbee7069918", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942289, "uuid": "c8cd374a-e07c-43b4-a997-59f9f783742c", "comment": "Malware payload (RedLineStealer)", "value": "915aecb019c109cf69d0607e3c8e7109b1466509", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942289, "uuid": "7cc96d0a-8325-42c0-8f50-6af52d7b9d83", "comment": "Malware payload (RedLineStealer)", "value": "321962815cb165d6c64fc0d6e5e3d178d099543954dcc4f7674126b792d4618e0c4f90e3c3dda04b1d3ce2ad7ab80e18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942289, "uuid": "1272401a-885a-4133-9622-d27c5ed03b04", "value": "T13C548D00ABA1C035F4F252F889B6A3A9B93F7EA16B3490CF12D516ED46746E1EC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942289, "uuid": "a54c7baf-9a9d-4fd9-b06b-adce0d37f5a8", "value": "59ee824971f432b778ca9bd24dd5ed5f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942289, "uuid": "8f769e8e-350f-424d-81b9-54196044ddb4", "value": "6144:Eak87xG3Rt2f7PBFxx58YXAbBSrDmltDhY:E587xG/2FFxx58YCBSrCl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635942289, "uuid": "6fe7cd47-eb6a-431c-a8dd-4abc3a22e68b", "value": 296448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635942289, "uuid": "2fba9ce6-d6a9-4555-8824-1d20886a7938", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942289, "uuid": "0bf02db7-e04d-44fc-807f-aae13e297313", "value": "toolspab2 (1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4417f495-3c88-11ec-843c-42010a9c0014", "comment": "Malware payload (a310Logger)", "timestamp": 1635931649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635931649, "uuid": "c6c2f3d0-552d-4bf3-b1d8-332b8e000dc4", "comment": "Malware payload (a310Logger)", "value": "b741d275962b6a594401b03e6f8c258f", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635931649, "uuid": "559d5dd2-4894-47d7-bbf9-b165f6a57158", "comment": "Malware payload (a310Logger)", "value": "039676543cb62a651daa0570029334af7e19b6c2f2b5b3a083f1a7d6ebd3143e", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635931649, "uuid": "9e103196-5b78-4244-8257-578b870e8015", "comment": "Malware payload (a310Logger)", "value": "f69fc6c731cec9c189972d646f98ffd142e69610", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635931649, "uuid": "ed8304c8-c60e-44b8-85fb-ac245570e93b", "comment": "Malware payload (a310Logger)", "value": "01c1b8523c7c4145b91dd4acaccf1e890be06c5196b6c60679bd7515cedbeaabe4e8d51ac1c1eb4db5dd4957d9f81fb6", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635931649, "uuid": "34710439-8f04-4be4-82c4-38823ecc65fa", "value": "T1F1D4F186761D8BA1C76CBBF5649A9360BBB47D3A5103E61E1DCA35CA58737808F30E43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635931649, "uuid": "390c84bd-0f9a-42fd-9aea-82da0a397486", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635931649, "uuid": "6378b40a-9ace-4afe-adfd-2d47f202b82a", "value": "12288:j+Ibw8eGrrtoynOzOksW6E4fBeSoPwliwCUG6jNc1:jhbw8eGdoy4lsq4BeSAsiwCGjNc1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635931649, "uuid": "c05afbd7-c6d0-4fc8-a507-bbe40637a49a", "value": 633344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635931649, "uuid": "162eab44-a554-4605-8a5d-b249f0d2df5b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635931649, "uuid": "32e6623d-9c92-4283-94c4-45dd35ad21d1", "value": "Burgan Bank Hesap Ozeti.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86c3d274-3ca0-11ec-843c-42010a9c0014", "comment": "Malware payload (Kimsuky)", "timestamp": 1635942069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942069, "uuid": "149b6173-5fde-451a-954e-e6b517c7f12b", "comment": "Malware payload (Kimsuky)", "value": "2a9085b66c03ef878a2dd1fe9dc1d5f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942069, "uuid": "f1637815-8b69-498c-8048-49dd464d0e8c", "comment": "Malware payload (Kimsuky)", "value": "04c915603c933f1acac67780702bfe416a8b946da5d63f0043efefb12665ce6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942069, "uuid": "6771740f-4279-4d6a-88a8-88c75f26fafd", "comment": "Malware payload (Kimsuky)", "value": "99a7d7ab6c07b5b0f096be0659cf62f77778c45f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942069, "uuid": "51f1e57c-9b98-40b0-85ef-703addc1bf20", "comment": "Malware payload (Kimsuky)", "value": "9dd9ebce0743c355bdab5a955af9106dce383e6286f88d021dd46748fcd45c8add8ca40234d663059df408279c3d87b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942069, "uuid": "210316c6-2416-49d7-a23e-cf3898e442fd", "value": "T1B6647C59B3E944B9E477813DC9574906E7F2781A0771DAEF03A0425A2F237E09A3FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942069, "uuid": "d28baeba-129c-4d2e-bc3b-43b929f09294", "value": "77b34438da1c6957e5e5dcccce760d8c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942069, "uuid": "dc64af48-0955-4230-a3a5-9f44d0756642", "value": "6144:8BdslFReQ7QW/YzrQ3jx0+PZbbducCNSohL4p3:8Bd8FCW/EUTxRbR5oE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635942069, "uuid": "9d54c4bd-a831-4de3-8b92-bb93488cec1a", "value": 309760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635942069, "uuid": "e7aa110d-6176-416d-9557-0fbe417142ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942069, "uuid": "22250b26-982d-4ca7-9265-6c14aa36b5ee", "value": "04c915603c933f1acac67780702bfe416a8b946da5d63f0043efefb12665ce6f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05bbb29e-3cc6-11ec-843c-42010a9c0014", "comment": "Malware payload (IcedID)", "timestamp": 1635958173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635958173, "uuid": "dea9a090-9f80-4da2-8be6-6b3680d37acd", "comment": "Malware payload (IcedID)", "value": "628b068ebb6c34efd8b4d21d4f4c7723", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635958173, "uuid": "9fe2cca6-6289-44d6-9145-75abb50a335b", "comment": "Malware payload (IcedID)", "value": "04d14e3e9c577b0fd56c1c63a6c9bdc5220db0b6af8d373831da2a3a79c45881", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635958173, "uuid": "77d66375-7287-4490-a2f5-7074461bae8d", "comment": "Malware payload (IcedID)", "value": "957bb67a89b7009539ecf2ac61ce83daf497a464", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635958173, "uuid": "0447b039-09ef-4bf5-9d41-7addc72ed7ae", "comment": "Malware payload (IcedID)", "value": "55f2f7eed639409cbf289e272abb87f94746f86c1a5f362465b959331e86e66226d510b6805f5a030793584883303b9c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635958173, "uuid": "434788c5-b49e-42d9-a34c-5367c47dffc1", "value": "T1B094F92D9412519BFCD34C34C5E8BBA6CB9379398E3AEAF62CA0C1707D34151AD5A363", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635958173, "uuid": "dd6d5166-665b-4482-8a96-24e4bd079e2d", "value": "12288:FJJl5XrG1wZ0OWt1J9JYPlEldxAaCActqm9bAfqb0PvrlwRF2UDLL2:bvaQc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635958173, "uuid": "3088046b-02dc-47f2-a3fa-2affa4a10161", "value": 412672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635958173, "uuid": "6bd56e42-d699-470d-9414-8e310198f382", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635958173, "uuid": "5f5e0263-8c31-4123-b4fa-89325f041ecf", "value": "628b068ebb6c34efd8b4d21d4f4c7723.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d684c88-3c70-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1635921491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635921491, "uuid": "67c8a0ae-c00e-4ce1-95e6-e4311467c372", "comment": "Malware payload (Dridex)", "value": "714ec60e49365ccc923931503bcaaba8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635921491, "uuid": "154fb39b-ba8b-4a00-9dd9-20e1cf93cbfe", "comment": "Malware payload (Dridex)", "value": "05030d3ace13d511490ced71068eabf297d9ce27d8c10889be3cb4d036006403", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635921491, "uuid": "d7d27d32-7448-4a11-bc71-46fc5b176eb4", "comment": "Malware payload (Dridex)", "value": "28052125790c6ca8deb6aecbf189d384e6c81cb5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635921491, "uuid": "15ad0058-391b-4c13-a80e-8203b549ab7f", "comment": "Malware payload (Dridex)", "value": "f228c404cc6c8b8069e225a984c22dfaa2fd3dcf57e9f48ecea3286a0f707c1f296f4d11ee5095da22f804881213613d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635921491, "uuid": "55a3a251-7402-4dfe-af4f-9ca7ce29ecae", "value": "T1EC83022D12E9A594D361EF3C5B0918F36C7137978F0027CB126EAAA8833D0635F0B25B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635921491, "uuid": "a674ef73-ae4b-4402-854b-42425808e50e", "value": "1536:8CWjPrX6Q3cWViBN3yKqxyeHw3vRMgF3oKy5hFQVKdcnbfKlvvKPre4g:83fqmc3/q0dfaguKyCKObayzeP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635921491, "uuid": "71a4646d-42ab-410c-a02a-48be79c41f0f", "value": 84712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635921491, "uuid": "c8ea74d9-17cf-41ef-bfab-f3e70287b442", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635921491, "uuid": "d342b6b4-c0b9-41c5-a48e-23065932bfbd", "value": "inv_078779.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63fc801a-3cc4-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635957473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635957473, "uuid": "256c2145-7884-4cee-9824-eddec049f232", "comment": "Malware payload", "value": "2c4eeca0053bb12d16a5acef0ab6bb18", "object_relation": "md5", "Tag": [ { "name": "CRMP", "colour": "#AF02CC", "exportable": true, "hide_tag": false }, { "name": "Dragsteal", "colour": "#A5F30A", "exportable": true, "hide_tag": false }, { "name": "SAMP", "colour": "#C06F87", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635957473, "uuid": "52ca704f-2dcd-466e-a249-8e7b078a12bf", "comment": "Malware payload", "value": "05588da45ca28c46edc5d91d60bd8770e36e543c085b544742241c2c324163f3", "object_relation": "sha256", "Tag": [ { "name": "CRMP", "colour": "#AF02CC", "exportable": true, "hide_tag": false }, { "name": "Dragsteal", "colour": "#A5F30A", "exportable": true, "hide_tag": false }, { "name": "SAMP", "colour": "#C06F87", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635957473, "uuid": "632abbd3-6d96-4134-877d-e2c2a7eff1a2", "comment": "Malware payload", "value": "4d46874d6f1f9e3fedf78573f3f2d43fcd378cb4", "object_relation": "sha1", "Tag": [ { "name": "CRMP", "colour": "#AF02CC", "exportable": true, "hide_tag": false }, { "name": "Dragsteal", "colour": "#A5F30A", "exportable": true, "hide_tag": false }, { "name": "SAMP", "colour": "#C06F87", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635957473, "uuid": "9cf28333-8c18-4b97-b3ff-e33a6343f24d", "comment": "Malware payload", "value": "c0902c9cfa089a4432e421520499fb2ec1ba69b9c4138991827f42f16a04123c6647e42aaef8f30c00af5c76fd512712", "object_relation": "sha3-384", "Tag": [ { "name": "CRMP", "colour": "#AF02CC", "exportable": true, "hide_tag": false }, { "name": "Dragsteal", "colour": "#A5F30A", "exportable": true, "hide_tag": false }, { "name": "SAMP", "colour": "#C06F87", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635957473, "uuid": "1a4908bc-1dfb-4914-a6cd-c4cd3e794e60", "value": "T13182F2D57A74FC2A32FDC4F61D4E2E5019CD69F1841B781972D23A888F3263923A8D8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635957473, "uuid": "71377c32-f0a1-49e2-b95f-b161c47408e9", "value": "384:F0icFxNqrqi+ACsQ0a4U8aKovd5k7LiWMCar9d5leVGHyJ8HeL:F0iixNbVACsQ0a41aKpMCar9d56B8+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635957473, "uuid": "f4f70b17-c3ab-473b-a641-1c28968a377e", "value": 18597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635957473, "uuid": "4182207e-2e11-4819-85a0-e3e1df91ff77", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635957473, "uuid": "9fe04089-c317-4fe5-b24c-35391d28e9fc", "value": "pklad.luac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffd87915-3ca3-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635943561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635943561, "uuid": "73279180-1c67-493e-a285-22012574c345", "comment": "Malware payload (Mirai)", "value": "ccfa8fe975750efd8600513653a258ae", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635943561, "uuid": "aabb1a34-202b-4f0a-8ba4-1572cb435aa1", "comment": "Malware payload (Mirai)", "value": "05c68fdb549edb3a24e0f5f637ce35df0b0ac3ad6f480027cc88c9dc27e9163b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635943561, "uuid": "f45466ae-123e-40ec-bfb4-ec4886a7bff4", "comment": "Malware payload (Mirai)", "value": "af629448026c78c1c2606c2afdc4ff8f986181bb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635943561, "uuid": "5716ff3d-7d09-45ab-8580-fa0a26bcb1bf", "comment": "Malware payload (Mirai)", "value": "76fe0e4df2c23459f7fa3025c376cf69020e0b9a39fa25b0701f2b1d960861a049ed80461b9916a4ac65eb91adf65c9a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635943561, "uuid": "afb40e61-428e-4289-aca5-e34d10169a91", "value": "T15873B309BFA50FB7EC9BCC374AA92712248D651A35A93F35BD34D418F25B21F19E3860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635943561, "uuid": "bcf3b25e-0b83-41b8-b1c8-ba309024b6d6", "value": "1536:aHJtIFGq1QDT+uDEQhKvt191Yi8ZNFDGT:aHJtIMZT+UEQPi8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635943561, "uuid": "00495816-9a29-4bd3-b656-237951109a82", "value": 76904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635943561, "uuid": "95d28be2-e09b-4c8d-9900-11332e1d7080", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635943561, "uuid": "bd4a8c1c-12a5-42e6-be39-58c4625b286a", "value": "ccfa8fe975750efd8600513653a258ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71624053-3c77-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635924424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635924424, "uuid": "6f603d3e-1365-4f0a-a6d4-2cc1d9ba7c04", "comment": "Malware payload (Formbook)", "value": "9296f028fb346722c7632fe27d160ad2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635924424, "uuid": "2dee1134-4b50-4052-a575-03584af89db8", "comment": "Malware payload (Formbook)", "value": "05d5b977ea607673e5be640c0a73fd382e02eeecac8e91ac7e3e36bd334e32d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635924424, "uuid": "13bd6591-ac93-45db-884f-5d8181a22b9c", "comment": "Malware payload (Formbook)", "value": "810fa71015db69867760c5780bfab35f000758cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635924424, "uuid": "9c3c3d65-3688-44b9-bb94-55ee0dd9cfe6", "comment": "Malware payload (Formbook)", "value": "d8b582e46c21d90f93f1aca68bc7f034d0a736fd5ed8d5ef0282b3c6ce571f99acbc8ce994da194fab849f2056a247ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635924424, "uuid": "a178e9a6-0551-4820-9a36-e3ad05e5065a", "value": "T1BD054820B75D49C9C6FD3734CF25D1B017A16C6E2A10CA1924F43DFBBABC61366316AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635924424, "uuid": "18af082b-a462-492b-a77a-7b58cdd83f88", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635924424, "uuid": "d0d44517-7673-472c-868b-2070cd371556", "value": "12288:GkkQO+eqWyyGP50vTgVA1eyuF7EzqZpJoLT2R0:7n1VyhT6A1eyuNNZpuqR0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635924424, "uuid": "785c6694-c0b4-4634-9537-c6520ecda3ca", "value": 797696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635924424, "uuid": "5ee5e19c-b76e-4984-ae3a-e11bc416f7a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635924424, "uuid": "f77a9eba-9f29-4669-81c4-f5ca3ca6127c", "value": "DELAY NOTICE - WAN HAI 261 S321 - SO 3110.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f17a8bc8-3cdb-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635967588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967588, "uuid": "b04d78e8-3632-48db-9986-e34c1bab9443", "comment": "Malware payload", "value": "10143127f2782c986b98dd92186ef7bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967588, "uuid": "78f61689-4e2b-45f2-9a38-01c5b1622f0c", "comment": "Malware payload", "value": "06772cfbba2b0961ed2e14bd910c79219ae41cc3805bd876b2a81067bb5714ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967588, "uuid": "4c16acb8-e9a2-472f-bc0a-6a2473d9553c", "comment": "Malware payload", "value": "44f10fa65a61f4310f67c86cfffca671f461909d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967588, "uuid": "9730cc83-7895-4af9-81f1-31a98d514ec6", "comment": "Malware payload", "value": "9dd8374ca2ce0597b56fcea8fbaf6d17cadf0c3c48d6a35358829039a7c85b3dd7b11e10e19de7e2201c8bff1a3c44aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967588, "uuid": "3aa34176-071a-453d-aceb-35d200ca2c89", "value": "T151A4D000A7A1C036F1B652F84AB69379B53F7AA06B3490CF23D166EA56756E0FC31347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967588, "uuid": "3012e5bb-32fd-4642-af4c-c73ffb1a7a04", "value": "e024db68009cf7f32dd817cae1867bf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967588, "uuid": "7c583c7e-0fdd-481e-89ae-9a7a6b10bc6d", "value": "6144:YAkGBtP/zDNl7/3ob52jB+duzGlslJ5CCyi08oJra94IE6GrLaiDfvLjAE:Y3GBlzD85OvzGalpoJra948GrLaGfvj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635967588, "uuid": "4b39c468-df8c-4b96-83ac-9f4ed59000e6", "value": 478720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635967588, "uuid": "bd0453f6-4b89-4afb-8ff4-14b12d988aa7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967588, "uuid": "a20eaef9-5ec6-45c0-a5c2-d4e3f29fe683", "value": "10143127f2782c986b98dd92186ef7bc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea54b4c1-3cd9-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635966717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966717, "uuid": "9625be94-7a0f-449b-85c6-6d0376cfff4a", "comment": "Malware payload (Formbook)", "value": "7f14e5dfe7ed85a86fa0949d575da870", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966717, "uuid": "88af63b0-7aa0-4fbc-af86-83773bf13659", "comment": "Malware payload (Formbook)", "value": "070c1eab83615ce456c3756b4c863fcdb6612c816c5ab72a341e0282caf9372a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966717, "uuid": "d82cf8f9-e2be-4f9f-a396-728297a7fc71", "comment": "Malware payload (Formbook)", "value": "ae81d2bb404ddcefd6fa1e9e14c580f9a57eb1cf", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966717, "uuid": "512ca107-1685-4d46-8a3c-44b31bbfa98e", "comment": "Malware payload (Formbook)", "value": "0ebc1bde2a2ac95169f6b50ab088473bb07ef77dd3e96d2783d80ef37a127f338f99053e015c670400e7bb82b2326e5a", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966717, "uuid": "32546f71-558e-4e76-be0b-9eaea477a0ed", "value": "T11214121821A57DC2FAA3B3344393AD24724ADC13ADCD86A9C0B53EFD417358227BB764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966717, "uuid": "46bc063a-f251-48ff-a66d-e974075bed45", "value": "6144:rmZ1zyWowywWbpfOuSUCGoDn3bM6IqeSRv:rmLOWoMipWEoL3Yhqht", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635966717, "uuid": "392c524a-5d31-4925-8088-27e9ff9abbf5", "value": 206664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635966717, "uuid": "d784270a-83e4-475f-bd0b-a697d14f7d6b", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966717, "uuid": "c1a65cda-b5af-448c-b601-7171675ce748", "value": "Payment Notification.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40c062b1-3c7a-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635925631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635925631, "uuid": "94855103-b967-4af9-8a10-6ae46942f460", "comment": "Malware payload", "value": "6b7aaaacd33b8da0c8cb4a43d60259a0", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "SpyMax", "colour": "#69A5BC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635925631, "uuid": "02f8867c-ed84-4825-9190-7a55742a8394", "comment": "Malware payload", "value": "0789ba70eded09fe4bc03e94c621c1564383368c77e4fddfcf22a5b9b4819d05", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "SpyMax", "colour": "#69A5BC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635925631, "uuid": "ba0a285d-e61a-4e20-bb1d-a8db56f681da", "comment": "Malware payload", "value": "ee9e8be410a240c5a0a7b30d46d45320227c98cd", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "SpyMax", "colour": "#69A5BC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635925631, "uuid": "ff9bc7e4-9151-4fbd-85d6-988cd472356f", "comment": "Malware payload", "value": "39124569765a595de3736722b094ea002d48833a21c99d8e4d7cccf0c356d54f23f20b0cea1ba737bca70b80ded2f0b0", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "SpyMax", "colour": "#69A5BC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635925631, "uuid": "41dd0107-2630-4add-bbfb-9bf8d8268b3f", "value": "T192B63343F75594AFC9F3A336493292220242ADA6AB9387875D68333C7C7B6D05F86DC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635925631, "uuid": "1ddd7a40-53d1-45d6-9739-274a9a340406", "value": "196608:Wq6npBqK27xAxSQmwiOfiAAFskZXvYWgwJwW3pbkJ/J3gW3BvdaCAnfzlGUT15UN:WqopZqxAxSjBOfn0xQWHN3pbk9vBvdDt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635925631, "uuid": "67a5ad9e-9a71-43bb-add7-a227f35c653d", "value": 10484736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635925631, "uuid": "6bb7bd90-a6d8-4589-a24a-234a212d4bad", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635925631, "uuid": "622c1ea2-74e7-4d6d-a39a-3c7960058c55", "value": "0789ba70eded09fe4bc03e94c621c1564383368c77e4fddfcf22a5b9b4819d05", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e55a52f5-3ca0-11ec-843c-42010a9c0014", "comment": "Malware payload (Kimsuky)", "timestamp": 1635942228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942228, "uuid": "baa961b9-8876-4e97-9c4d-7ff23b01fa17", "comment": "Malware payload (Kimsuky)", "value": "1dcd5afeccfe2040895686eefa0a9629", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942228, "uuid": "de5d6b67-c2fc-487e-b045-c37b989e1d4b", "comment": "Malware payload (Kimsuky)", "value": "07aed9fa864556753de0a664d22854167a3d898820bc92be46b1977c68b12b34", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942228, "uuid": "3753d25d-2b0c-4c4f-9bd9-9a053a1ba13b", "comment": "Malware payload (Kimsuky)", "value": "40826e2064b59b8b7b3e514b9ef2c1479ac3b038", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942228, "uuid": "d728a7c2-c410-4f62-803d-fa41f2fc3ede", "comment": "Malware payload (Kimsuky)", "value": "6fe34bf8d67bfc31e06a32b84c90d12556cc7ac2f618d959be956a52c2b216fa7082e1f1b69da0c87a79f3e85b902781", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942228, "uuid": "f2ad8995-a864-4c55-abb7-13a7e7d58691", "value": "T192B36C107180C075C4ED6E3C45309A225B7E7F71DE386E9B53A842B99EB42C19F32E7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942228, "uuid": "da1eceb3-72b8-4059-8bc1-db73c6233d1c", "value": "712fdd0a975324eb988d3fe2289f686b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942228, "uuid": "bca47e39-53b0-45c2-a2e2-e6d348baa2ba", "value": "1536:l/0l6PfiD0DVZn7axI7+kt0DgFeVX8xzay482ewFp1A2NYLsWXvcdWeZlTm:RiQpZn73+kSDceVX8x6gEp1woWeZlT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635942228, "uuid": "20f0d4fe-b177-4449-87ac-2c23c4abf318", "value": 117248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635942228, "uuid": "e25e6edd-e08f-44d1-bd77-5c69ae267ffe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942228, "uuid": "6e5a330c-5390-4c9e-bac8-632c0264fd18", "value": "07aed9fa864556753de0a664d22854167a3d898820bc92be46b1977c68b12b34", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dc2ab0a-3ca0-11ec-843c-42010a9c0014", "comment": "Malware payload (Kimsuky)", "timestamp": 1635942027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942027, "uuid": "07777c51-22bb-4a70-be2d-582c7e62cd10", "comment": "Malware payload (Kimsuky)", "value": "5c373c2116ab4a615e622f577e22e9be", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942027, "uuid": "381b64e9-b1b8-447f-8057-420d8f6c232b", "comment": "Malware payload (Kimsuky)", "value": "0845f218a588f7619169787c4db69ce9de0c84143b100400b6476d7289a1c493", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942027, "uuid": "79ae034e-6be5-4197-9b21-5f9286446247", "comment": "Malware payload (Kimsuky)", "value": "ea940cc09b54b9ec060e65d9ccc3a00c3cb00921", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942027, "uuid": "d1ae4137-0f68-47ee-ab1e-698e78ae9244", "comment": "Malware payload (Kimsuky)", "value": "b4c3f627fa3f71c8e942504dbeba053c89d82a5496e2dcbc5ed56c880dcc9944ce3ce1b328b69c79f6a03a5206812666", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942027, "uuid": "0d416229-4da3-4045-be24-e63a39255567", "value": "T1DC64F72ABAD19036D57F437495F586D7A928B9633370D84FE3C60B4D4C22BC36AA131E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942027, "uuid": "d75f6464-5039-485e-be01-0535bf1499b8", "value": "23a7dbe071e826457a9ee2eac6296f32", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942027, "uuid": "e7b21cc9-52cc-483e-b9fb-c742cfafec62", "value": "6144:Y5KVAtFaFoGI0fJtnnDeCXhc0pASzJBjo:Y5Ky7aGGVznD7XFLJBjo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635942027, "uuid": "17ef6698-98b2-4eeb-8e07-a41c05c08bd3", "value": 311296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635942027, "uuid": "161cad76-3502-4ff3-9ced-815f0311b59a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942027, "uuid": "2da6bd2f-fca5-4afe-a845-1eaf26a4368a", "value": "0845f218a588f7619169787c4db69ce9de0c84143b100400b6476d7289a1c493", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa029bd2-3c9a-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635939685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635939685, "uuid": "fa50638d-5130-4471-a35c-6248e38990e6", "comment": "Malware payload", "value": "bc78239d2e7c13b2c1cfe293f96cf9d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sangfor Technology Beijing Company Limited", "colour": "#10F549", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635939685, "uuid": "da6bf066-17aa-47ce-8538-ac81aeade0a1", "comment": "Malware payload", "value": "0906ba839253f6921de2306b14aae0b6d630b3812a6fd24453b025f308289aea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sangfor Technology Beijing Company Limited", "colour": "#10F549", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635939685, "uuid": "bb8405d0-2e81-44a7-97e3-9c42f3fdde9e", "comment": "Malware payload", "value": "7c02be832e874125a39b23f149e8062b0f75146f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sangfor Technology Beijing Company Limited", "colour": "#10F549", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635939685, "uuid": "9f9ac256-1272-41fe-9661-1dd15f615695", "comment": "Malware payload", "value": "45966e34db61390d78800977c8e38d70746789ad3fe7ceeedda95abc7de0287d86df442a3caddda344d045c5a8e691c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sangfor Technology Beijing Company Limited", "colour": "#10F549", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635939685, "uuid": "057b1d1e-f1a6-498d-b853-1d6e24492498", "value": "T126A56B427CD47079E4AAA2368A7871B13770BD490330B7C32B19A7BE5E66BE01F76354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635939685, "uuid": "104264de-160d-4916-b9e3-1aae151dd73a", "value": "c7269d59926fa4252270f407e4dab043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635939685, "uuid": "bb82c85f-8fe6-46b8-aa21-8c93420b638c", "value": "24576:ngVAg0kj1c7SU6wgXh9qy0PD1zYBc6iUbZajn6Y1zLPDBjlmEgs:ngV10oe7SUfgx9j0PD1N6Yjn66TVjZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635939685, "uuid": "2b72e0b8-79e7-453f-8c3f-768b178ea9c7", "value": 2104664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635939685, "uuid": "2e19e389-d9ac-474f-9d93-ecd26b9817b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635939685, "uuid": "89ad98ff-6526-45e0-b58e-877410b6d110", "value": "0906ba839253f6921de2306b14aae0b6d630b3812a6fd24453b025f308289aea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f96ef55-3c86-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635930944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635930944, "uuid": "77b7539b-903f-4dc9-81a8-4d7334bc6068", "comment": "Malware payload (Loki)", "value": "de0d84612a5c512b891e1993c1405edd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635930944, "uuid": "35e0b449-fd90-4bb5-b66c-6fa9e74df3a6", "comment": "Malware payload (Loki)", "value": "094dcf113d1a6f542c3fbe11601d8a6f405e774e306ca5c839b66a7db9770aaa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635930944, "uuid": "ebb44f0f-b05c-41bf-b94e-0fb8943aebb8", "comment": "Malware payload (Loki)", "value": "8d746365adb4237cc7690fd682d6b744fbc88d73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635930944, "uuid": "813c8494-8ec6-4175-a109-d320bbdb4f2d", "comment": "Malware payload (Loki)", "value": "cbcfc5833f70f369b2721ab066cdc13f3fe7b1fc5530217d489ea0fe46ca1ac976145a30470365985eca35bb8b1a5858", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635930944, "uuid": "3e304205-4a32-476c-8893-37b75183bb32", "value": "T1ED84DF12356DAB25C76C73F160A693507BB86D3A6403E64E2ECAB1CE1A773118F34E47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635930944, "uuid": "39a3790f-fefc-4120-a2a7-dc8e0edac267", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635930944, "uuid": "3d7aa50b-f432-4de9-b13e-1be49578b714", "value": "6144:wv1WD7MbwN2s7GQfhd23RT9RnK4xAbO0PMwGqLs9H4t2pakIGx7AJ2YMDZGBPlTL:u2Ibw8eGdznKKAbOmGqQw2YkIeAJ2l8P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635930944, "uuid": "a58424ea-5f5f-4f08-855d-2c3b69fdf1cb", "value": 376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635930944, "uuid": "44993d38-6af1-4a23-b275-858f1b34a28f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635930944, "uuid": "c356666d-94e9-447c-b3e5-f64e631bfa98", "value": "NEW ORDER - WTCL01 - POR015409.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fc929dd-3cc1-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1635956231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635956231, "uuid": "8795f91e-e64a-4b4e-bdbe-0ea39ae8f3dc", "comment": "Malware payload (Dridex)", "value": "518e1933ece4d957ebe050645750bf40", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635956231, "uuid": "63bc8c21-ed43-4c71-81a3-eb7cc00c29c2", "comment": "Malware payload (Dridex)", "value": "095f83e97512fea78239a6bd94ae41a679b5de1c5c1cee61c053d691f9e7eee2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635956231, "uuid": "badc967d-4bdb-42b1-ada2-4be4440063c3", "comment": "Malware payload (Dridex)", "value": "ad628f72383c7e47e4a317b68026924b3a35460c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635956231, "uuid": "3ceb0b90-b67f-4931-9d2d-37dd1963552e", "comment": "Malware payload (Dridex)", "value": "319e2b9b33e796ae6e742680c9ab5c2ad95605f76846bc08018906d121d3c4aeb53dedd26c98632193ad6fef152c02cd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635956231, "uuid": "b57e83be-64c7-4394-8052-36c95e3844b9", "value": "T10AA4BF04D1EA0676D52B62FE71FF0CCA47104DF9B506AC84D3435A6A5B32FEC3A7A849", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635956231, "uuid": "2d14c733-f215-43bc-8640-615aac2111f1", "value": "ccdf79216449388cf5a36d38a385d866", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635956231, "uuid": "9f573bea-dbf2-464e-8a89-6f690510169f", "value": "12288:9ZKEZNxJPdthZz/MqmOce24Wqa+cKdDSFczjJgiUCeoCqoE:9ZKEr/1jhz17Px", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635956231, "uuid": "a3aaca6d-1fb4-4f08-8175-05942d3d2209", "value": 471040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635956231, "uuid": "6ee38d7a-c790-4e8d-bc01-ae3f34901591", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635956231, "uuid": "aad2af9e-5d70-4d15-848e-949296732a07", "value": "518e1933ece4d957ebe050645750bf40", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a966d2e3-3cd9-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1635966608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966608, "uuid": "ee2cf0f8-77fc-4f44-955c-070a0b9b009d", "comment": "Malware payload (RemcosRAT)", "value": "0765ff9e7e876b5d6836596fbffa4a4a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966608, "uuid": "3511b5ad-0d26-43ed-9bf4-7f6ed92f20a2", "comment": "Malware payload (RemcosRAT)", "value": "0ae519aa9b815512741d8a1acf34e8a6a4933b24d866c0568ad0f23d09291d6b", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966608, "uuid": "da53bccd-270e-437d-89f0-87ab881096bf", "comment": "Malware payload (RemcosRAT)", "value": "cec1b984c2a34bb7bd8956f1f7dfb5d285d4d1b6", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966608, "uuid": "c5992c61-93d6-44a0-808b-7237de638b7f", "comment": "Malware payload (RemcosRAT)", "value": "69c68795d0e115a1ee590f254cb2f90a5b3d3a97f416e2c3cfd1918d29c0b5d4cecd462f09b3f8721030a593f0ea2c25", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966608, "uuid": "13819f62-8802-4186-88c1-2b8401c0ae6b", "value": "T10E8556F0AD01D4C1F57E5B6AF2FD3A48A1343217EBC94A4A00E7E5951EF6A11B90ECC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966608, "uuid": "a2fecabe-fde4-4524-a8c8-dde1cd796d22", "value": "12288:A9rTBncu3wGo66QXdo/yPIhqNtjDmo637QLkLgyCpi+aFQF2i6lYw:AMuxNjXdoKr/uoS7Q4lCp6s2f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635966608, "uuid": "3cc827ae-7f6d-4b06-a3da-e1bef8c6c2c9", "value": 1753239, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635966608, "uuid": "06ff35c3-c8a2-4ce2-817c-f61dfe036104", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966608, "uuid": "77faa21a-4e73-4049-84d3-3042e02e16ad", "value": "F\u0130YAT TEKL\u0130F\u0130.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca212935-3cdb-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635967522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967522, "uuid": "00d068a3-8bd2-4719-b20e-68f3bcd9be33", "comment": "Malware payload (Formbook)", "value": "083754258b13c0a21e6e160042307b84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967522, "uuid": "79ba4b6c-ce8a-47cb-96ce-fa9a882bbe38", "comment": "Malware payload (Formbook)", "value": "0b87b9cdb75c353a3bb1be5c33882e5ae73baf7630fe08f7db720c4fbab97fd8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967522, "uuid": "768636d4-3c8e-4abb-9913-614c101c2cdb", "comment": "Malware payload (Formbook)", "value": "54c3b0fcaa0cee8fccc744764a65f653e02ff1d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967522, "uuid": "f1ae8de3-1a30-4306-a431-14ec58024c40", "comment": "Malware payload (Formbook)", "value": "b0283de2cc5108ef2e9a2cd660d0a4fd40ef4adf2bee958c7855228fc786a9fb45c9a5204cfcd6ef162524b11338b58c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967522, "uuid": "258ffa9f-43b9-4287-9ce1-ef3d4ade14e9", "value": "T12554120249DA9572D693D2321DBB72FAF33E455A0162370B07D06DBB3FB5AA7C518183", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967522, "uuid": "0be69253-117c-4b9a-bb78-d681b123ee9b", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967522, "uuid": "acb21abf-8d1f-471a-a9d2-8e36e519cce9", "value": "6144:F8LxBsfVXpaWpCfZw5s5KmwZ9VMyoCqWupnmkzfwK/9:/Zpow25Kh15zonmyj9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635967522, "uuid": "3572b5ff-3e7c-4863-9848-bc49abe75ed5", "value": 287047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635967522, "uuid": "a453b18d-2ad6-40c4-8c19-471b123e70ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967522, "uuid": "3389689a-d86d-4893-88b7-b11df2ffa1ba", "value": "083754258b13c0a21e6e160042307b84.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1279d549-3c71-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635921688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635921688, "uuid": "24a248e6-f368-4ecd-9610-373cbe901b27", "comment": "Malware payload (AgentTesla)", "value": "c3e7f57e2ca8bcb07464bacbb38331c3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635921688, "uuid": "4158dbec-780a-46a6-8914-104622147215", "comment": "Malware payload (AgentTesla)", "value": "0bec178f40b29d1579e22e3cc769578e038cf74f08e5087dec6137983e77ca45", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635921688, "uuid": "501f970a-4726-48f1-9c63-2ed61d2eaee0", "comment": "Malware payload (AgentTesla)", "value": "1df02d3fe27030706778e894d04854a37ec4df33", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635921688, "uuid": "a01c1806-7ccf-444f-b297-ead75132ebf8", "comment": "Malware payload (AgentTesla)", "value": "c42a13b3f09234892fff3f4f7be9f79578467ec7d80375f354e7b3311a3bb1d10d6208d639645f2940eb70abdce71d56", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635921688, "uuid": "15d12f73-29df-41e7-837d-cdbf788061d4", "value": "T1A7B4EFD1A6D48916D52E0F3590716C6057B3BE9E7D08F2CE6E9838A7357B7C60220BE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635921688, "uuid": "f3a1001a-252f-408c-8141-546f46957499", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635921688, "uuid": "64a50140-001d-45b7-a14b-d0b5b2999673", "value": "12288:6x4+vErnm/TljkrvUzAIjH7aCm2dvCqzaylCUXuu:6OC9TBkr+Hbm2dvwICouu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635921688, "uuid": "dbe19ff6-18b6-4f6e-82e0-d1e8a9d4455c", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635921688, "uuid": "a99933cd-2b86-49f5-a1de-9844c078f759", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635921688, "uuid": "d5bd8882-6e00-4379-bc45-d17d63d8bd7e", "value": "SIGNCONTRACT,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a7cf19e-3ca1-11ec-843c-42010a9c0014", "comment": "Malware payload (Kimsuky)", "timestamp": 1635942290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942290, "uuid": "f548c8fa-604a-417e-bc7a-91fb068a93e7", "comment": "Malware payload (Kimsuky)", "value": "267135bdf42742a6982d68648d461eea", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942290, "uuid": "27af9a3d-9b3e-4ec5-a622-3456a97ed48f", "comment": "Malware payload (Kimsuky)", "value": "0d867cac8d7ab33d4a3bbc69a713dc50bcb6e830cfb0e6cae99eaef56d7d5562", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942290, "uuid": "71427501-8cd2-4283-a6f0-64fc5f2dc8a2", "comment": "Malware payload (Kimsuky)", "value": "4c119e4503ea4c0f57f516dd519f81a5e7c191b4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942290, "uuid": "2de36e63-a534-45bd-a6bf-d4048329df30", "comment": "Malware payload (Kimsuky)", "value": "6b43e898d5d22665e1646388c8e1fff9314e5117f7553a88b239124592f8f51a2fbf5377ed47400f8ed6220fcec48405", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942290, "uuid": "e60c1700-cacb-4461-9bd2-3b9126d7ce8c", "value": "T1FAB35C4071D08075E4EE2E3D0534CA725B7EBA31DF68AE5B238842698EB43D15F39E76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942290, "uuid": "be667463-0c3e-4ade-939f-7f027f2765e9", "value": "234dfac8916f947b79e658c20b0320ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942290, "uuid": "b707fabd-2063-4edd-99c5-fdafefb8bfd8", "value": "1536:E7D4EZAOSIcIiJ0lQkjU9BsbIWwm3Qyh9XA2Cr4sW85cd7ixwyQjbr:EVSkiJ05+BEIWw+h9Xwjo7ixwyQjb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635942290, "uuid": "3b276321-35d3-4a40-84fb-3e8952f15d69", "value": 112128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635942290, "uuid": "612655c2-0b28-4fe3-b1e6-fba596c806d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942290, "uuid": "d406f98e-b145-4217-a7be-4ebe8ab0296c", "value": "0d867cac8d7ab33d4a3bbc69a713dc50bcb6e830cfb0e6cae99eaef56d7d5562", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49722892-3c88-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635931658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635931658, "uuid": "e069fce3-d0da-41c5-b39b-d4745cb23d7a", "comment": "Malware payload (AgentTesla)", "value": "f6f4871edf5b9444f60d3754a4075f76", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635931658, "uuid": "7e1cf2c1-0fa4-4615-94c0-48bb21497876", "comment": "Malware payload (AgentTesla)", "value": "0ed2558e7875dfa24b4a975b32bf8a08efa5ac363185eab5335c4ead1dee8c32", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635931658, "uuid": "e5170d43-4a84-4f75-8cb6-56f8d3289c8e", "comment": "Malware payload (AgentTesla)", "value": "5c3fd04b61dadb7c79234f88a12128f10c8a6532", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635931658, "uuid": "e85d9438-afb9-40ed-b69c-aa4ce6806727", "comment": "Malware payload (AgentTesla)", "value": "2290360239fb5b6d0d48863faf5038d5a3e919f36c9e90a0acd645eb945dec35264490de281c3602423c08c9e9d12c9f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635931658, "uuid": "d650b5c8-9181-4033-bdef-185c61150f13", "value": "T1A3D42380646230B0737DEE88E603F5444D9EE8187A1176DC20DBA751E985E3EAFFC9D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635931658, "uuid": "e76d97a9-a9ed-4096-9673-8bf7e4f1fde4", "value": "12288:+Rj+8+obLO8pst0Rq9yZI098FiTAC7AxXU8r0DGFo:+Gmd6j9yZ998FjM8wGa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635931658, "uuid": "ba158bfd-45ba-430a-95e1-ac5e122acbbb", "value": 604275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635931658, "uuid": "0fd49067-1c54-45a9-ba13-b78d82fb223c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635931658, "uuid": "5936b412-321e-4ae1-8678-c8ba0923bbbe", "value": "QUOTATION.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1235c394-3cc7-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635958624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635958624, "uuid": "3dddc5db-b7f1-4815-b09a-31792eced572", "comment": "Malware payload (AgentTesla)", "value": "3c3e5e77eb4b5c0341baf5a71819ef09", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635958624, "uuid": "fa8cfe5f-7a38-4046-b158-1460bf148407", "comment": "Malware payload (AgentTesla)", "value": "0f1682c3771d3642666d9e9e3435b0d3e649af33a1a2e244da398392951e1aaf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635958624, "uuid": "48eda7c6-d790-4094-aad9-1df7e12f84f1", "comment": "Malware payload (AgentTesla)", "value": "ed6aa391a34c0e56300d7845b12dc72151883097", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635958624, "uuid": "9053edf4-ac2e-4f50-972b-7eb8e5e100a9", "comment": "Malware payload (AgentTesla)", "value": "854e3997aeb9128f53e54a5b25a0a2bb56e96afd37ee3deeecc85e79c82bae86699c2efa02bf1547f7f13dc47b651998", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635958624, "uuid": "e9426908-5298-4578-9479-8ad9281b99a4", "value": "T1CD62CF5AE8E627C6506F25F0FA10AF19602F985F8B62799B6320BED2059ECD40D7930D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635958624, "uuid": "5b558e6d-dd57-4e9a-af34-fab6bc5ccc47", "value": "384:+hotN9v89ixqmc/K2DMjM5yISnI2HgNMlrhg:ImdqN4w55+Q41g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635958624, "uuid": "f181d9ce-94e8-4e49-b558-9da583e6cfc6", "value": 14816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635958624, "uuid": "05a32f82-88e7-4d7b-99b5-8a94cf0d4739", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635958624, "uuid": "1afb0f30-a123-49c3-82a4-63d174edc7e1", "value": "Quotation#2390.pdf..zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f418ce8e-3c88-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635931945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635931945, "uuid": "c12bc3f5-6cc7-4716-b04e-4035e0f7b36b", "comment": "Malware payload (AgentTesla)", "value": "8f74fa28e03f2adfd34572a1742d2717", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635931945, "uuid": "738f6201-e1a6-4605-b1f7-e39895c7a8d3", "comment": "Malware payload (AgentTesla)", "value": "0fbc75ed04a8dce53a7ae5e27b87eade7ff2b0832f1b447fa6b935720379e3ed", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635931945, "uuid": "586b9801-8533-4497-951d-ad80fc8b3925", "comment": "Malware payload (AgentTesla)", "value": "4c89bb6bcbdd2331274c8b059d5124d7165fc058", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635931945, "uuid": "57100d03-a794-4eda-af8d-0651f05195ec", "comment": "Malware payload (AgentTesla)", "value": "e0669153c6f5e70bca73f3175af80091e7c432cdb9d463cf796e95e4678112a5ba2240f24e0409837274f00baa9d7025", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635931945, "uuid": "32d64efe-d873-4be2-8960-e916fee9bfe5", "value": "T15D64238A84D8092F241BA502F153C2D27F2D701B1FA386DCD1927793BEB4E15667EDA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635931945, "uuid": "38ba1c3c-8e57-483d-84c0-8b5713434985", "value": "6144:b/FOAR9HQpD0Tj3PW4ZJd+kFqjbVH3R/MHTuvPZIVBMdZcHJ3VejY4urNMm45ebA:bZRxQpoX3PW4ZeccVHBEK+2Ip3cjTurg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635931945, "uuid": "06d4d984-5844-4417-a996-29a89ba68ef0", "value": 329790, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635931945, "uuid": "45a50646-8cb7-4e1a-80e0-2d4bcb23c3f3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635931945, "uuid": "c5d36f68-0c87-4dd2-ae7f-a63f7f49e62e", "value": "Documents Invoice No XP2102000250.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40b45435-3c9e-11ec-843c-42010a9c0014", "comment": "Malware payload (Kimsuky)", "timestamp": 1635941092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941092, "uuid": "359e5ece-9a04-48ad-a423-3160bf8a814d", "comment": "Malware payload (Kimsuky)", "value": "70b4cb8e39fc80c6a6460fedaaaa89fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941092, "uuid": "c182f27b-b677-47ee-8673-292d4f79ec1a", "comment": "Malware payload (Kimsuky)", "value": "0fd125e9441872142c17928ec6070a9d48de9f51c127f9b5be6dfb5b94fcbc97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941092, "uuid": "cd92f67d-385b-427b-82e9-25aaeefab380", "comment": "Malware payload (Kimsuky)", "value": "a6d6fc43a7933cc5a4414ea076e1469074554de8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941092, "uuid": "c3400dba-d932-4332-a7a7-cb4f09d59a3f", "comment": "Malware payload (Kimsuky)", "value": "f9ec80456f882dfc606eb6ad8b052ccfa7f273c04d43797f663b4c1e165e2bff577750a8ea16bdbc57abe1e46e8daa00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941092, "uuid": "b989430c-4c4c-4bad-93bd-f0dc6680b622", "value": "T1AFE56C56A7A801A9D8FBC27CC5574607D7B2B81693709BDF06A14A790F73BD22B3E700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941092, "uuid": "cb1137a6-9c0d-464e-88d1-62cf2bc35824", "value": "ca15bd62f0fd772b1ecf064f3a587596", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941092, "uuid": "550bd167-78f7-478d-b4b1-b4c2ebede75e", "value": "49152:+G4loKSwlq64qVzwg5JAh7N3DcOh5PGwuS0dGITZAezw8lPnwB:Akcs3fKGITSZ81wB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635941092, "uuid": "f652176a-6826-4abe-9366-35385068f44e", "value": 3310080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635941092, "uuid": "99d72033-8e93-4416-9ef4-5a944dc7144f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941092, "uuid": "7ef5d802-e046-4273-9190-0cd30ce077e8", "value": "0fd125e9441872142c17928ec6070a9d48de9f51c127f9b5be6dfb5b94fcbc97", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fca86761-3cc5-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1635958158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635958158, "uuid": "d5aeaf45-7836-4e22-9a93-f21157b5701d", "comment": "Malware payload (ArkeiStealer)", "value": "2ca8a40f921d842ab59fc524bc90fc75", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635958158, "uuid": "b51838f6-66ab-488e-b43e-a4f2ad82ee5a", "comment": "Malware payload (ArkeiStealer)", "value": "0feb1172a1e0f5c6e152b794c4a2921dd7fd5090118d119c21254250f0c755a0", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635958158, "uuid": "66b62612-aa06-4dc4-af8e-f69e6049a45d", "comment": "Malware payload (ArkeiStealer)", "value": "3c79b2bb717a0259757656a7bbb9056c551037e2", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635958158, "uuid": "a50ca554-c043-40df-afa8-0530d9da2b4b", "comment": "Malware payload (ArkeiStealer)", "value": "3fe278cfcb1521cd9a1978b6752f38b6c222e893a0f24da025b3add73aee730352ae3c151b3a943b62db6670622a5f84", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635958158, "uuid": "c5ade631-673c-4ab1-9039-083c51e5580c", "value": "T1B475C032F2C1C437C7772A385E166658EC297E116E68A84A2FE50E6C0F397717B2D193", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635958158, "uuid": "40008fe9-55bf-4e38-b472-53a3d7ca7526", "value": "b85fbd69f590e538d65c2f55613c4277", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635958158, "uuid": "5850855e-47fd-4750-b9ba-df8618c5c61d", "value": "24576:NYOWCiW8yssj9Ij2aREpmOpLF06E+b1VZo1SjVFsKICyWXqVWgH0Wy9bvFGNY83w:Nipoy+bPBFSVWyoDV83HgZV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635958158, "uuid": "021beb06-0e58-4f62-9593-2dd87b777003", "value": 1659904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635958158, "uuid": "546b874c-ee28-4a87-9c91-6a6c07629150", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635958158, "uuid": "552dad5e-f6c2-4299-9ee5-3c21c7d45c24", "value": "2ca8a40f921d842ab59fc524bc90fc75.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff94c335-3c4b-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635905764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905764, "uuid": "89afc1e8-dc2d-4df6-9556-923985e32620", "comment": "Malware payload (Loki)", "value": "29c86f38db2a3ed8804d754eb820f639", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905764, "uuid": "72e0c27b-eeff-4956-b028-5abbc98ba8c9", "comment": "Malware payload (Loki)", "value": "114eebc3dd4c4918b28ea9e02c9e29035588434551b95a25a675b42fee53c769", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905764, "uuid": "f836a3ec-6dfa-496a-9b7c-bd63cb11798c", "comment": "Malware payload (Loki)", "value": "d6b3d8d126764517d2af83cf1163e3b9bc551122", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905764, "uuid": "5b7722c7-4353-44c2-9a16-84dbe43b9e46", "comment": "Malware payload (Loki)", "value": "f222fb53c18f87e42551ec249668a6514b97d8b77c9f37252381c802fdb2fde0b26fa6ac1db589771be738592b53cbf1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905764, "uuid": "666e9419-d5d0-40a7-9672-00a77eb30cff", "value": "T13694D0D2A6E09902D57D0F31A0313C205273BEAE7D09F28A6D9D78AB76777C64160B93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905764, "uuid": "797f5b00-fc5c-4045-8d3e-c6f13e740770", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905764, "uuid": "b75fe06a-60c9-4ff2-90bb-23fde154a488", "value": "12288:63klLV6diTl0iY9O6OzdmIZZrdDv1LSlG:53ZTgfb0dhLS8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635905764, "uuid": "df0aaba7-41f0-4f85-ba6b-acdf46a15bbc", "value": 422912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635905764, "uuid": "b5f97b21-a94a-469c-8335-105a2f1be3f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905764, "uuid": "8717e065-8cf5-4fa7-b409-062426adfc04", "value": "2691221211004171515866.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba0e5fc1-3cdb-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635967495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967495, "uuid": "b6dc6dee-bb2d-4afd-b1cc-4ac3391f3c85", "comment": "Malware payload (Formbook)", "value": "de8e61b685a34ebc90995c66b83c0f3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967495, "uuid": "870b4922-3cfc-4d62-b3f0-18b8c0d6ffb8", "comment": "Malware payload (Formbook)", "value": "115a084d9aa48d9bb0f37d760c8997e3ec905a5b4adad3eeba9c8b18e44e9408", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967495, "uuid": "20079962-6438-44f0-88b1-c00b69b234cc", "comment": "Malware payload (Formbook)", "value": "f34d2b14e5135c335fee089f9a756ad6a64ac983", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967495, "uuid": "20389ed4-9e00-485a-8f7e-d6ce5f5a2a9d", "comment": "Malware payload (Formbook)", "value": "5f38431c4702e8d8f08a58262565e58ed21d12e0a8ca58c51ba5bdb76baaeefd7906d8e820290155212e5e28a1aa23a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967495, "uuid": "3ef1c0c2-23f5-4ea9-9461-506265f8ef41", "value": "T18654121873D040FBD48B2B707A718737EA63685421508A4EEF348FFAAC36792DB45A57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967495, "uuid": "e5747ee2-c673-450b-b2a6-2ff64b016156", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967495, "uuid": "c46c58d8-4945-4c30-a400-fc3f7ec5152f", "value": "6144:wBlL/cAWnHeRvkKco51lEEG8F/K4Wn8wEH6LbS3otQi6u4tVv:CerGvk0li8F/KlnbO4tB6uGV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635967495, "uuid": "335bd080-14cf-41ce-9498-0a84ef3f17c2", "value": 294178, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635967495, "uuid": "a3c422c6-9f0c-4e97-b3a1-801b11264266", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967495, "uuid": "6fef0b5e-e386-4663-b84a-b6bcc12ad731", "value": "de8e61b685a34ebc90995c66b83c0f3a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7015d9f3-3c4a-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635905094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905094, "uuid": "7b34beef-f88f-4ed7-ac54-cfa37f865016", "comment": "Malware payload (Formbook)", "value": "27bcbe24630badc56282ba082f523089", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905094, "uuid": "fe512c43-e114-4b42-b919-9fbb70592c65", "comment": "Malware payload (Formbook)", "value": "115b0f130d659263693b82d6c90448632788a6319c55bced3618d55496aa44ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905094, "uuid": "5e8da6aa-61a2-4742-9a10-ee8ae7f7b13d", "comment": "Malware payload (Formbook)", "value": "1f233f7109ee57b11330e7158dc6dab51a2c341f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905094, "uuid": "b164790f-4ef4-49ab-aa0a-522ce81f3857", "comment": "Malware payload (Formbook)", "value": "d5c119d87ce25f4b4bdd78dd8acff08432149843e6424c2e6ad67be60ab741bde357e4d208c55aa1d5a03c2ea88262f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905094, "uuid": "47753b36-79d3-43ba-80f9-ffd3889eec08", "value": "T18EA4D0C262E44725D5AD5FB050712D3453B37E9E3858F29CAD98B8E73A73BC24121BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905094, "uuid": "1dd504a5-12f4-4e2f-af7a-6343682411af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905094, "uuid": "df375eb1-9558-4b27-a4d6-7fbead05cb22", "value": "12288:SeTlMQm6aUqNJdy8+BiU3Y4T9pCiR4AelS:rTqECNzytsQ9pCiRreI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635905094, "uuid": "672ac337-eb12-46fc-852b-2b576e63a9a1", "value": 454144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635905094, "uuid": "70efdd41-fbe0-48e6-a367-c92767574aa4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905094, "uuid": "3dc56ee1-7352-4fb2-8235-df2d290550ee", "value": "PI & Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "595b2392-3c72-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635922236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635922236, "uuid": "fda5ffe3-dc91-4fe4-a540-697a5b410d1f", "comment": "Malware payload (AgentTesla)", "value": "c589ae997d2d7986dbe81501351026e1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635922236, "uuid": "388c8abc-5f8f-4085-9204-1d95f7580543", "comment": "Malware payload (AgentTesla)", "value": "11d4f1eeedde80a918617093d017fe4b7257327295c3516e5e9668b4ab747cb7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635922236, "uuid": "96253859-29ae-42b9-a1fc-efb694bef146", "comment": "Malware payload (AgentTesla)", "value": "9bf1b4cae1e65b8c7766507e935ddf1ee2de6694", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635922236, "uuid": "ed27d1a6-8447-4b8e-b07f-b3f5f7f31ac5", "comment": "Malware payload (AgentTesla)", "value": "1ff368e91fd80bd7b8d2e7ae19932ea820e5146efc6e449abdf95c7f8339f0bcb7853ded5c1ac0b57135a9abf1320321", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635922236, "uuid": "31db0737-60f9-4351-9bd2-8a2f097dc398", "value": "T145C423F1395501E9E83410A4216DE67B517FF355C5ADA4722FB8A7FABB8B0006363C26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635922236, "uuid": "0aaba0aa-e7f0-4494-b956-d6eeedac3d78", "value": "12288:QJsBibW7g5G5K8SMvFyRyuYo5eGVBTgDUcZmsA99xyBYh0nJDVj:Q9MKG84kAuY2eGVJrcZmsqotnJDVj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635922236, "uuid": "040d0dfd-8655-4d69-bc09-54d7aad6c0c0", "value": 548479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635922236, "uuid": "d508497d-8212-4c23-9696-3a0fd87bc97a", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635922236, "uuid": "6709b56d-d733-425c-93ab-3cda5c953b71", "value": "statement of account.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b48f268-3cd8-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635966021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966021, "uuid": "d15007fa-c24b-4ca7-a777-054af1074f27", "comment": "Malware payload", "value": "e53c1ba8c92ff5a38b709ff9251d8f1c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966021, "uuid": "2dbeb4f4-4af0-469b-af9c-5828cebe18f8", "comment": "Malware payload", "value": "12025996d0d88dc6a062909ff36aebc667780ddb955d5a4bafc99e74283361bd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966021, "uuid": "f077e4be-c01f-4abd-8c97-dc207af399a2", "comment": "Malware payload", "value": "b26df13fb1a398ed2715b5d8d0fda1883cff704f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966021, "uuid": "30df6493-a00c-46ce-ad4d-a8abac051998", "comment": "Malware payload", "value": "71f0fcea9d7488bbf08d8cc89a8de2841c93fee8031299e993a4b8580c3fa50eca22e04e3b319dcbf6f4cc396f1b334b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966021, "uuid": "a2f93379-fee6-4c18-a394-c226725d8f20", "value": "T19163D8B7016581A6C5882334F8711F0B7ABCC6351980B698F04FB6EAEC1D65D9EF83B4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966021, "uuid": "7416768f-612f-466e-9341-ef623cb90c41", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966021, "uuid": "3a0e63fd-af3e-4841-a3d6-4ab4a1a0b58c", "value": "1536:YmpgxkyA8En+q/NMUfaamOW4dAviBBvbERREa:Ympg886/CordAuBvbELEa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635966021, "uuid": "df585865-8730-4b5a-915f-bda4ed7191b0", "value": 71680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635966021, "uuid": "9ef14b99-6bbf-4458-ba96-5c0fabbf305a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966021, "uuid": "2de9e921-6435-4fc0-9d1e-e69dfa14b1ba", "value": "e53c1ba8c92ff5a38b709ff9251d8f1c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50525b6d-3ca0-11ec-843c-42010a9c0014", "comment": "Malware payload (Kimsuky)", "timestamp": 1635941978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941978, "uuid": "183ff669-6ec5-47ae-9d78-09c1452d5149", "comment": "Malware payload (Kimsuky)", "value": "7f4624a8eb740653e2242993ee9e0997", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941978, "uuid": "2f0907be-5143-48fc-9b98-579f4985940d", "comment": "Malware payload (Kimsuky)", "value": "12c9f6699f64c757aebf5d9120d95a612826bee0ffe7676812b28bd31e86c9c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941978, "uuid": "b311e8f3-b100-426a-a504-531179eaaafd", "comment": "Malware payload (Kimsuky)", "value": "0aa04d97417a72ac3f5949c496244170495d495e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941978, "uuid": "9553ee87-732a-4e0d-9faa-07be1554a010", "comment": "Malware payload (Kimsuky)", "value": "e9c8c47ee658e4291bf7d19717b3fe4cdef0ebf2f31bf15088da15e93fa8ba301d62b63e3742bcd8129fdd7c05fdf006", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941978, "uuid": "dc94ee81-b030-43cf-8e40-daf195fafb8e", "value": "T19F648C19B2A504B9E477813CC9539A06E7F278190771D7EF13A0466A3F237E09A3FB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941978, "uuid": "efc1b170-88bc-484d-a426-7e1878c343df", "value": "77b34438da1c6957e5e5dcccce760d8c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941978, "uuid": "29d4e442-fc18-494b-b19e-fb94945633f7", "value": "6144:/1uXz0EJwstQBMWUFg994XB52h6YXdEwohB:9uXNJwRMWUGI2hkwo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635941978, "uuid": "0bb89451-3a7c-4256-886c-baa4e1084ce5", "value": 313856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635941978, "uuid": "5c909108-6813-41bc-b32e-b5e30ae40668", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941978, "uuid": "da517978-35ff-466c-b757-291242445ebc", "value": "12c9f6699f64c757aebf5d9120d95a612826bee0ffe7676812b28bd31e86c9c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9f48559-3cd6-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635965321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635965321, "uuid": "7a687a92-e072-4d79-84b4-d34e8efabed1", "comment": "Malware payload (AgentTesla)", "value": "8707bc4949fa7827b46aae0d99e409fb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635965321, "uuid": "f72e7e99-2206-4e4b-8344-fd5eec1bd3dd", "comment": "Malware payload (AgentTesla)", "value": "12ea05795a7eded6787cdfe01e9d99c9160d542cf995015f5b28a148be862b13", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635965321, "uuid": "b252fa89-fa51-492c-b7f9-d455bab0015f", "comment": "Malware payload (AgentTesla)", "value": "58dec47ad046d15da107ae318871ed79776ba3cd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635965321, "uuid": "632a7188-ab94-462d-8dee-5be3be9341d3", "comment": "Malware payload (AgentTesla)", "value": "23bea28a1a2bfc680143f0fba45842a26ed427b18c4905e46dfead8095e919e2e273151c7cf63e652e003673034a91b5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635965321, "uuid": "d97c0dbf-e42e-4fd3-9f3b-57ecf842d1d0", "value": "T1D494125057E92B13C9BD6BF9A9A0121017F0A6572503E3EC3DCE79FF976AB404690AC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635965321, "uuid": "ff637b7f-f80b-4c78-83d5-5c0227e3f9d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635965321, "uuid": "f5a9dce1-4b39-4795-891b-7ce9e7472707", "value": "12288:UTiv89OFBsSXJECXhDNu+E7LikLcpj1u:UTB8FWIJp1MR7Y1u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635965321, "uuid": "e9c700d9-f6da-4e40-9644-f2d5de1603de", "value": 420352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635965321, "uuid": "6c29e15b-d93e-4ca5-b316-aa3afd065a00", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635965321, "uuid": "b5621c12-2d03-4291-b230-0ffeebd831da", "value": "urgent order 1065.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3aeb4826-3ca0-11ec-843c-42010a9c0014", "comment": "Malware payload (Kimsuky)", "timestamp": 1635941942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941942, "uuid": "e93c504c-80bc-4b1e-8be8-d99e677e0ef8", "comment": "Malware payload (Kimsuky)", "value": "0cc0aa5877cec9109b7a5a0e3a250c72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941942, "uuid": "86961b50-e5ed-407d-92f7-75e3c24b4dc1", "comment": "Malware payload (Kimsuky)", "value": "1324acd1f720055e7941b39949116dfe72ce2e7792e70128f69e228eb48b0821", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941942, "uuid": "f4340d11-ac2b-4aae-9b95-fdb4aa26b7e5", "comment": "Malware payload (Kimsuky)", "value": "1d49d462a11a00d8ac9608e49f055961bf79980d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941942, "uuid": "9224e98f-86dc-4655-b3fc-e594744a3634", "comment": "Malware payload (Kimsuky)", "value": "e2babcedd12c4b7c0c619ce3e3c5e895ef2fef7ac9043e66c587de33cf491d408882be0995f4fc17b236017a85ead42f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941942, "uuid": "844c133c-6242-4b67-9a56-fc09860b0e4a", "value": "T188B4F121B4D2C87AE07319355CF88BB55EBDBE300B2A59EF7394137A5E201D0173AA67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941942, "uuid": "ed21968b-aa01-40bc-b870-7b8f2eca9e96", "value": "1c23f058b5f8b7c505f6977680f9e0db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941942, "uuid": "d6ea3adb-e556-44af-8bbb-307ce41e31e0", "value": "12288:B/P+NYgHizBSWMJ/17sM57k0+iQkB86PGjg:BO6gH8UJ/mMWkBCg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635941942, "uuid": "5fafceec-8ce1-4d54-9a1a-d90694a48fcf", "value": 525824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635941942, "uuid": "635a6fa4-370c-4536-a7c0-db4d955e4400", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941942, "uuid": "4f1e2a95-8e3b-4c0d-aefd-52789d032f5b", "value": "1324acd1f720055e7941b39949116dfe72ce2e7792e70128f69e228eb48b0821", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aded86cf-3cda-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1635967046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967046, "uuid": "d64174fb-63b1-4a63-9be6-562099202363", "comment": "Malware payload (AsyncRAT)", "value": "df14f9dd74daa4fb3d16912ab50a5998", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967046, "uuid": "03c9444a-139d-4db2-b809-fb5ebadb1439", "comment": "Malware payload (AsyncRAT)", "value": "13d9fb222ce260be6b6bb8c960f8371b4f75ea39609eb31581943cda37e8d6a9", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967046, "uuid": "a2fed009-e080-4e6a-93ae-271bbd953851", "comment": "Malware payload (AsyncRAT)", "value": "11df3f25e52ab751fe7c1ef301743aae1814b893", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967046, "uuid": "c6de4432-fcbe-4d15-9607-d7534d70c162", "comment": "Malware payload (AsyncRAT)", "value": "bf645249dba758e2c5947ecc41d697f9c5f3d77fc315d0eafaa944851d867152068e7abc58d2188214fa6b50384da629", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967046, "uuid": "f5323cb1-cf04-4103-afa3-c960d46499cb", "value": "T187232B003BD8822BF2BE5F7898F26205457AF2676603D64E2CC451DB5713FC69A426FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967046, "uuid": "1fe95c9f-6837-42ee-865f-53d8dcaaf255", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967046, "uuid": "4f3a2d64-7c46-4076-9fe4-5ec1bdb91f2e", "value": "768:/u6cdTAYhbJWUh8Nzmo2qLzKjGKG6PIyzjbFgX3iu6/GI1+aGd3a0FolBDZix:/u6cdTAu42eKYDy3bCXSu6OhVFordix", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635967046, "uuid": "6ccac2da-8939-4164-9888-38ab706f2220", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635967046, "uuid": "4771768f-044d-49e7-931d-6362b5bfde42", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967046, "uuid": "8a7e134f-1641-4489-b608-68a58f567fa7", "value": "Xr47SGSv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9fc46c8-3ca0-11ec-843c-42010a9c0014", "comment": "Malware payload (Kimsuky)", "timestamp": 1635942128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942128, "uuid": "4154074f-9000-48df-9728-3215a3236ab5", "comment": "Malware payload (Kimsuky)", "value": "750655cb2b62e5455c862ea32c8480d9", "object_relation": "md5", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942128, "uuid": "fcf54943-50f8-4767-9e61-2e85a0c96aef", "comment": "Malware payload (Kimsuky)", "value": "13ff844942209edc3b2fee0475d94887a6ca5f1176c01088d6901630f73137ba", "object_relation": "sha256", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942128, "uuid": "d17e5fc0-7221-47d3-b6ee-57886cdddf9f", "comment": "Malware payload (Kimsuky)", "value": "358a41b6a5c8ec12f301b829fff39c3db27d21c4", "object_relation": "sha1", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942128, "uuid": "38a1bf8b-3c93-4f17-9435-a11cd7ce8be2", "comment": "Malware payload (Kimsuky)", "value": "84abb9483f44ee353adeebbf82e9cf0deb039619178ab8fe0f1206aafc2d292571779ca52d7c56b2e585e4ae0011a82b", "object_relation": "sha3-384", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942128, "uuid": "90656544-6cd7-48dd-94fe-f6a130a2c0ad", "value": "T175F31257F5A84A745730CF75CA68E844AB9849FF01AD83B80F25299E3638FC4247AF53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942128, "uuid": "b04b04d7-9312-4104-bbe6-d3da286e5411", "value": "3072:6VKbdmiPfS/uYGaJNsU4kE5hggXbDdng0rVV9NlAUxVRbl0Gl:6VKpJYfvHEAgXrVxxV1Nl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635942128, "uuid": "dd24f811-3654-49d6-ae84-5e9b8fd8938d", "value": 169628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635942128, "uuid": "38fe98d0-7b49-4bdd-88db-6945d59082ca", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942128, "uuid": "fcad382e-1291-4d39-aaa2-049ee28622dc", "value": "13ff844942209edc3b2fee0475d94887a6ca5f1176c01088d6901630f73137ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a4af9bf-3cd5-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1635964704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635964704, "uuid": "0bb944a2-502d-4f28-bad0-e2fdff7e4735", "comment": "Malware payload (Dridex)", "value": "5e9e14c4e562f758edcc9a8c588c524b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635964704, "uuid": "b70e37a9-1af8-4330-a6ee-7d80fd3606f3", "comment": "Malware payload (Dridex)", "value": "1459c4695a196f00720b468ef9dc625da0e4a144e3b2bcd859da2e6805360d10", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635964704, "uuid": "a9881521-b023-4a5c-b9f2-30960587f4ad", "comment": "Malware payload (Dridex)", "value": "cbbcf3202f570bc34a3e256cf2e8c1e1987b21b7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635964704, "uuid": "79d6282e-39f3-447a-bf40-9d02ac6765d5", "comment": "Malware payload (Dridex)", "value": "597650c257ca554543fa656d5130a1377a984d0860398a41a63271658645cf61de56665774902c83ed58cad20ba5a235", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635964704, "uuid": "a20069d9-d35f-4442-a6ef-d95243097d24", "value": "T1F293021FF21A3CECC03B7B7D8446E2AB252962234C63EB95315BA05854DE3E63B5B115", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635964704, "uuid": "952005a6-ecbc-4b5f-9b32-97ce27a41cf5", "value": "1536:8CWDP2CET+S+agP7nA9u9DE2ehOPq8Khwa3R1wLF41BwOPd3jBmJF:83sT1k7TABUXKhwa3R1wi1vDmJF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635964704, "uuid": "2bdff9da-7d4b-4e27-a5f4-fe407cbfe6ff", "value": 95237, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635964704, "uuid": "8f840d5b-241b-4cac-ae38-6a1c37d17dcc", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635964704, "uuid": "259d3d4f-13c2-4ea6-a396-5ca20f4b5110", "value": "inv.0298.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc5abffb-3cc8-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1635959446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635959446, "uuid": "777632e2-9f5d-4386-8b7f-6ab26d5ac26c", "comment": "Malware payload (Dridex)", "value": "652f27e9ed61e47beb4199d5586c2c0c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635959446, "uuid": "39b3ef12-edfb-4ff3-b316-5829814521ef", "comment": "Malware payload (Dridex)", "value": "14aad95322971b398e3eebf4f6a12591acc2899d95480aea7266584d79980eb8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635959446, "uuid": "2f32568b-1100-4a27-ad22-15b7f0c7251a", "comment": "Malware payload (Dridex)", "value": "b14c7b6c0cf8eb79db8d149964e00a9185ad59c7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635959446, "uuid": "2991ffc1-f8e6-489f-ab8c-4738100d48a5", "comment": "Malware payload (Dridex)", "value": "d2530f85e2142f2933efe25c2f1f83f0f6e3e6348e84f39b123a26edc816643d7bb655b90b59b160936180f098baef51", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635959446, "uuid": "29bfb74b-e279-43ed-940a-404a298d9408", "value": "T14EA4BF04C1EA0676D52B62FE75FF0CCA47104DF9B506AC84D3435A6A5B32FEC3A7A849", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635959446, "uuid": "e043f717-5cf6-4301-92bd-80372cf9647b", "value": "ccdf79216449388cf5a36d38a385d866", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635959446, "uuid": "db4408aa-4c4a-4c9a-90df-ecc5b6d32be3", "value": "12288:gZKEZNxJPdthZz/MqmOce24Wqa+cKdDSFczjJgiUCeoCqoE:gZKEr/1jhz17Px", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635959446, "uuid": "023a3c43-8101-4687-8a63-8be606c514ac", "value": 471040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635959446, "uuid": "20280a82-2020-413c-9f22-892c6d46b855", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635959446, "uuid": "bffbbc27-f223-434b-921f-68ceda323abd", "value": "652f27e9ed61e47beb4199d5586c2c0c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17665be0-3cb8-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635952190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635952190, "uuid": "2f5cf661-3eea-4649-b242-d9d1da7f72ea", "comment": "Malware payload (Formbook)", "value": "07d1dc744dc86ab0a64e50bebadade2b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635952190, "uuid": "c19dab22-d76b-49d3-913f-b638d4ac2151", "comment": "Malware payload (Formbook)", "value": "15489574c78c8f668f691c8ba3afdca8b2f642b6be15a60011ddcc1f2857375f", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635952190, "uuid": "917e0f63-86b1-4ef9-b429-64737e63173c", "comment": "Malware payload (Formbook)", "value": "e2b5b850c58d5f79c36c82fad71673c03d299199", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635952190, "uuid": "bcd8e758-20c2-42da-932b-c418b8603399", "comment": "Malware payload (Formbook)", "value": "17c870b7399da2180396a368c486cfa28869df1194748548758698231c3bfd2eae4ecca486dc032d205e42da29b49e0c", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635952190, "uuid": "a2e08ceb-d4b7-432b-8e4c-66f91273d0b4", "value": "T171B43398953BEE362C91540EBB95CA3F4F55E4B838B0D2325BB1E246CA3E5CF06394C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635952190, "uuid": "477e49dd-f90e-4348-94db-e9796fa5735f", "value": "12288:sQs9Tga3ihrZBWqblUzhIFbws3oiIh8JSuF7Ez+Zfec:sgakrXWDFIFbwMn4QSuNHZP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635952190, "uuid": "6b851766-83e1-4e73-a4d1-aa4f97d1b8b0", "value": 504230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635952190, "uuid": "2825cbe3-ce3d-4ed9-a11a-29bd6109107b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635952190, "uuid": "3c424908-3201-4926-b4c3-335679ce85c6", "value": "SURRENDED BL Draft-Sea-Waybill-FLXT-1304583.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9216460f-3c9e-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635941229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941229, "uuid": "e958dcfd-2e8b-42e6-a75b-070471ec67f0", "comment": "Malware payload (AgentTesla)", "value": "781947017145971edc27036c9e845ebe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941229, "uuid": "1f45db60-48b5-49cb-a2a6-a809dfb725ff", "comment": "Malware payload (AgentTesla)", "value": "15dfbd9aa253295d39cc50d6630e70dd1fb3f099fa42bb22c7a449b9b964568b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941229, "uuid": "b164931a-9242-43ee-96f4-7900f97161b1", "comment": "Malware payload (AgentTesla)", "value": "bcad7976e2520303510ff5453ce2248a84f75dd0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941229, "uuid": "91dfd925-5c4e-485d-9918-adc24d235a96", "comment": "Malware payload (AgentTesla)", "value": "a5a88fcc7a0d8727c53e3b5dab966d987d659d7f7442c78002fbff4f14b2c84b456ce39596739b8059d3de5fca790340", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941229, "uuid": "61fcfe99-777f-485a-9066-0125853e8589", "value": "T1E1055920B75D89C8CAFD3734CF25D1B117616C6E2A10CA1924F43DFBBABC61356316AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941229, "uuid": "011462f2-76c3-427d-adf5-8788bb95eb9b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941229, "uuid": "de54cb1b-6165-411b-9fa8-3fe12fbc2d70", "value": "12288:qdZc7SZvb2vM5wCat5bXNVbU4nMBAUgW1jyuF7EzqZkJtLTex0:W5ivrt5b9BdnMBAUf1jyuNNZkHSx0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635941229, "uuid": "9a001f47-18e5-40f6-a908-33c6d6a6ebad", "value": 840192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635941229, "uuid": "0639f3af-cdff-4c8a-a559-400fa8e84d44", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941229, "uuid": "3db7f248-1ac5-420d-8e63-b847296f9704", "value": "WaybillDoc_INV_1736442024_1132021_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93a43d8e-3ca0-11ec-843c-42010a9c0014", "comment": "Malware payload (Kimsuky)", "timestamp": 1635942091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942091, "uuid": "af0a8d82-3385-4f82-813b-722b61a7ac36", "comment": "Malware payload (Kimsuky)", "value": "ff0dddc847825f13001b08661b2c7d0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942091, "uuid": "52ff5fb9-f808-4376-b4d4-3205a69be286", "comment": "Malware payload (Kimsuky)", "value": "16c621580603afa3e1286642ea2df01814e692fe52b357aef96899f1cbfe6b33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942091, "uuid": "51b9d42f-f861-4578-bb0a-41ec2250039a", "comment": "Malware payload (Kimsuky)", "value": "b6844d85ef467d3baaee03f71af6e6972cf89c01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942091, "uuid": "e3444e40-da22-4c46-8e51-503a0b9cfd1c", "comment": "Malware payload (Kimsuky)", "value": "2b95d97374b63dedca3be26d5b9e2390784afdce0e5b74cb46640d0d8fdbdf0490809dc541159d6f0ffe6446aee7b93a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942091, "uuid": "66b08128-3594-4dfd-bae6-68d3caf6b491", "value": "T180247B09769440B4D897C1788A934A83E2B278850B79EBEF5360837E5F3BBD17E39351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942091, "uuid": "157e2744-b057-4933-b06f-5fe0c68a85bf", "value": "11636d1d15351b6330a67156608b68d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942091, "uuid": "dc695697-a90e-437f-8f6e-b25ff55295b5", "value": "3072:O6XJK0ETjuNzZOsrVENHO08jV/e1AlTu/RIrLn0+tzMWp62WIPv3TqkPUeCjN:O6XM6zVRE4XplT+RqgoMCik8eiN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635942091, "uuid": "997a974e-ab1e-4004-bb34-038590fb8975", "value": 224256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635942091, "uuid": "a57875de-4948-424b-bcbf-86428983e3f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942091, "uuid": "8ae6ff72-19cf-4eee-b6c7-66a2bd1e6f6d", "value": "16c621580603afa3e1286642ea2df01814e692fe52b357aef96899f1cbfe6b33", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a44ea34-3cec-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635974529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635974529, "uuid": "78256b53-9d7b-4642-bf6d-35b76b069e01", "comment": "Malware payload (AgentTesla)", "value": "70a12982269de14c6118be719891cccf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635974529, "uuid": "ef0d4d14-f134-4201-af7a-3bf264a14cab", "comment": "Malware payload (AgentTesla)", "value": "16e7ef4030a0bff04da63bf8d9ca084bbe6c28d680778918402a2cda85685132", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635974529, "uuid": "1c9a3077-f357-4366-a12b-b40a7379274f", "comment": "Malware payload (AgentTesla)", "value": "051cdea5f26e310bba88dabc29d2d4c8c7d58b57", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635974529, "uuid": "15379c15-ee80-449f-8ad5-86c2341cbc34", "comment": "Malware payload (AgentTesla)", "value": "85ec3785f56f64823db770def2238cbb08103865b5856c26f72c9f4e42bc74dff68f1c1d75bfb9706813bf3c1f172bdb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635974529, "uuid": "1cd2d303-b6f5-40d8-9e21-94576294d1e0", "value": "T1CA9412A027FCF3A3CA7E27F92535191087F590521067F36C7DC63ADA1A26F025681AE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635974529, "uuid": "0579b0f2-db44-42b4-9298-6479e23d2554", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635974529, "uuid": "79ad1900-0ae7-434e-8048-4fbc8902088b", "value": "6144:r8/RhRzul0uzrgN8MbeAkr4yFdRLM39e0AGcPJwgHPFgrtf/r/TMqj7LflThzFtr:r0A0uzrgNBbVpIfYliPA/rL/rf1tf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635974529, "uuid": "63d9d7ab-a767-4540-a96a-aca2a1f3d5d7", "value": 420352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635974529, "uuid": "96c8d377-1445-4d96-bd0e-902d1088ddc7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635974529, "uuid": "bf2468ad-7545-4b63-9249-490655cb0a36", "value": "Shipment Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2ea76cf-3c70-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1635921635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635921635, "uuid": "78ab3ad1-f1b4-4b51-b356-9732650ec283", "comment": "Malware payload (Dridex)", "value": "8d45e3d446cbf965e849f66b264e73d7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635921635, "uuid": "5ec04948-e25f-433b-8dd3-b891b988b353", "comment": "Malware payload (Dridex)", "value": "16ffd70da4cf1d46f085a3202e0f0b4a2bacaca0f72e338eec003d93a3e6364a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635921635, "uuid": "b5d5aabf-4fc3-450b-8a42-2ec92246899a", "comment": "Malware payload (Dridex)", "value": "8c660d62b1dbb0e2a4379b284c10ff77306cd55b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635921635, "uuid": "d2f241d4-ba98-47b7-9a36-3dd7a5f8f1bc", "comment": "Malware payload (Dridex)", "value": "ccff56a9914bdbbec1498b9faba301e8ac4b771f4b9ae9cba37dc36fe301ceeed065f40ba5a0ad1375edfa39c8f216d1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635921635, "uuid": "c5b1d2f8-a627-41e1-9a55-e16178050ec1", "value": "T10B8302ADE1A46C58C16DEFFCB8166FD1AC1D21412490835F3C5DAE08A3A531F6F1F26A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635921635, "uuid": "dd343ff0-f3d8-425f-9e79-8be6fac8a601", "value": "1536:8CW9PFwJpvc1e+BwT8YIbDMz+1d6xo9PaiTWLxU0bQJ2y9MD4UsbgvYm:83yMrbDu+1d6x8Pa2Ck0sMl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635921635, "uuid": "786e8f27-03d0-426b-9ce6-f20399fe10c7", "value": 86787, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635921635, "uuid": "0d7e4d86-207c-4a6c-895b-ebd17272ba10", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635921635, "uuid": "b2744c87-e5da-46ae-84e5-60a01a67e0ce", "value": "inv.1123.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8762fe21-3cc6-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635958391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635958391, "uuid": "c49b59ab-312c-4824-b4b1-2a36046ee2f6", "comment": "Malware payload", "value": "fffd2903ec20ac275330f9d1d36f991d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635958391, "uuid": "23d2f492-38f4-4482-869a-0baa8427386e", "comment": "Malware payload", "value": "17296ef169776f90a8b6984a2e929fe661bb0083e281956b313726c2af102b8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635958391, "uuid": "da0824d9-561c-4a5f-aade-855431a79f80", "comment": "Malware payload", "value": "0cfbfbe366191bc201830f7fb7fc6bffa9dea279", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635958391, "uuid": "9989ad15-ff52-4f2b-a68a-da07d5010539", "comment": "Malware payload", "value": "2f376024b3ebb76f726e5e73bc24d42fba23834e9231a0111116b84442c50db90893dd59edb632983e8a02ed505beb6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635958391, "uuid": "ca686aea-ccf1-4296-b3cb-e86fb0e739fc", "value": "T1A9744ACC761071DFC817C8F289A86C78AA646877570F4213A4671AEEAE1D98BDF150F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635958391, "uuid": "3edb59f5-7e3b-4b53-8d85-41c2cae2e26a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635958391, "uuid": "6bbd43c5-f218-4059-b36b-d18f59cde2a9", "value": "6144:I3BSFdS3gTU6kdwWJz+RLW+onAJQxYhLUiXAwPhQF7+MrH/RbKXIsI4oF6cuz:IQfkL4SnaQx3iXAwPhQF7+MrH/RbKvy6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635958391, "uuid": "890b5990-15a2-4493-965a-d14ceacf853f", "value": 367104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635958391, "uuid": "2113eb37-adda-4609-8e26-c400089fe8ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635958391, "uuid": "320232dd-22f0-4add-95de-c229f4912b9d", "value": "fffd2903ec20ac275330f9d1d36f991d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1c25256-3c60-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635914734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635914734, "uuid": "31c06604-e350-4c2d-a425-23768c6eb60b", "comment": "Malware payload (Formbook)", "value": "1d8bee6c3d7b6c225566bc1e029fdeab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635914734, "uuid": "58a7772c-8b39-41f1-88fa-ce2f54d60178", "comment": "Malware payload (Formbook)", "value": "177d82d6a53494bf58a577731d6a5c65118677114dedd45176b5d34a559cceb6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635914734, "uuid": "8a728db8-16ed-4bd7-88e0-28ae926dd1ba", "comment": "Malware payload (Formbook)", "value": "e9e8987fcf2abe3f22df4d60874c833a2c1710af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635914734, "uuid": "1cf6ae26-898c-4e8d-99f3-85ed6f088065", "comment": "Malware payload (Formbook)", "value": "2c5ebc55ea13785149b65d3dfc11f0985b1b973f4baeba980ab1407274ad4bb8b48189f374f6d9b19f0a6d33fe13c153", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635914734, "uuid": "d74624aa-8b88-4cf7-8ef2-6a846e0aaa32", "value": "T194055820F35D48C9C6FD3734CF25D1B017616C6A2A10CA2924F43DFBBABD61766316AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635914734, "uuid": "ed6cf396-ba70-4b7e-abf7-e63c83d3fd42", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635914734, "uuid": "5eac785a-f2b7-4039-b846-d96e11c6e64b", "value": "12288:0Lq+y6WoDyvl706xxxFiaW0lT7XY10yuF7EzqZkJtLTPx0:wqT6Wo80ExFBHXI10yuNNZkHbx0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635914734, "uuid": "6cef43ae-910d-4019-a772-81364abe7099", "value": 829440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635914734, "uuid": "e4a01f89-5bfb-4544-8d83-504f371795a2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635914734, "uuid": "1a38449f-3376-44be-99c6-2126bcc7b225", "value": "Purchase order #110321.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4d90111-3cd4-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635964507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635964507, "uuid": "f3de5d8e-6c1b-4e34-a132-23fe468a84ca", "comment": "Malware payload", "value": "ff1a958a59a14af230ea15e62c472cd9", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635964507, "uuid": "61df3c83-5eeb-4aee-b04f-1798f757805e", "comment": "Malware payload", "value": "17c5c2c8d429dcea665e3d283b874228e01139453709e47e2c283a77fc49d537", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635964507, "uuid": "065d2373-6d3d-4104-943d-53cbae1caac6", "comment": "Malware payload", "value": "ffd3513447cd33af6df142bbc249bc2b2be2b38a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635964507, "uuid": "6144d4e8-d2a1-4ef2-a92a-b17d047ab470", "comment": "Malware payload", "value": "0127304276ceb9fb3f01f3cca2fbeb2f3bfbd4a380e571e582da1abd310ab572673680bab5f36b9464a16c93d59e0c12", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635964507, "uuid": "6978fdde-e519-4136-accf-3ed01bc94bf4", "value": "T16AC40103F9959F57E51BC3B87E628C696B6DED494B08B7CB10307F0EA7B43609C4264A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635964507, "uuid": "91916440-d571-41ea-9d5c-d0c98cac4721", "value": "12288:MV9iQsDr8Nu0tEILt/5J0RiCFNpQU0cz8:MVXkr8NvnLl08CDkco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635964507, "uuid": "fef13176-858d-420e-936f-6d8857cf7c0a", "value": 589824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635964507, "uuid": "97e3f481-fc23-4eeb-a153-32d30b0b9453", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635964507, "uuid": "23cb0596-c486-4499-b3c2-760ab1f996b8", "value": "ff1a958a59a14af230ea15e62c472cd9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d12d53a-3cb8-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635952200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635952200, "uuid": "743c3cbc-36c0-4fb1-a802-b13e2ed8de48", "comment": "Malware payload (Formbook)", "value": "48324a02d63111164454123e5ce7150e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635952200, "uuid": "d43636a4-9b52-4e88-a50a-029f3e44b625", "comment": "Malware payload (Formbook)", "value": "17f039fb473c199f9f2b66c7671f6c2d0ea0a8b29cff152bdeb70772855394a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635952200, "uuid": "3709f673-6edf-4815-8f7d-fb5e430e927e", "comment": "Malware payload (Formbook)", "value": "0841efa86b8c5cf6736928bfe2e3c3797915d1a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635952200, "uuid": "bf1603e0-9052-40db-a564-e50590e5eb31", "comment": "Malware payload (Formbook)", "value": "32c6c30cb8a7e6505de408f9e1bb630e9eb0766da8ca93372a480824cc693956978795a4dbe31ea3958313ee923ef782", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635952200, "uuid": "fba436bf-c203-4b5b-9ea2-5e0f44ed197d", "value": "T152055920B35E49C9CAFC3734CF25D1B107A16C6E2A10CA5924F43DFBBABD61356316A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635952200, "uuid": "68d65940-4f4d-4024-86d7-4478f8d8f482", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635952200, "uuid": "43ae50cb-9c5f-4af3-9cb7-e3634e7f4ed2", "value": "24576:Y2+oMZXujZIBLwCb6Apx1myuNNZEnSR0:Y2+X8IBLIKpsNZEnSR0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635952200, "uuid": "c0d37ad1-edad-45c5-8686-d4fd65267fad", "value": 835072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635952200, "uuid": "672dcf23-e233-4d2a-8c87-86f4a44cf40d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635952200, "uuid": "6abe39e8-496d-4b7d-9f82-d6b7cd917fea", "value": "SURRENDED BL Draft-Sea-Waybill-FLXT-1304583.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03d430b0-3cda-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635966760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966760, "uuid": "ebdbc492-a736-4ba4-84e0-deeee752a058", "comment": "Malware payload (Loki)", "value": "8d4ed0595a44320c2610e03f8151b41d", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966760, "uuid": "caa998c5-c105-4ea4-889e-e8f8ae3a3b09", "comment": "Malware payload (Loki)", "value": "18d052c060dcef2983353daadd8d020d042bce53cfaa759e84bfe8b4d95a7d4a", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966760, "uuid": "396bcc10-629f-4442-8f96-53457ce65852", "comment": "Malware payload (Loki)", "value": "5b016360b4de4751a9d2d1f60a99a0d8f8306262", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966760, "uuid": "0cda49d7-166b-42a5-8bb9-c1197474dc09", "comment": "Malware payload (Loki)", "value": "6be4daed9d942928b66331df7d89993209583c4a882cfbfa60d9cdd738a30d79703685b33ba77786cedb278c454650a4", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966760, "uuid": "6d5fe4b9-12f0-4490-a6e9-1972ef799569", "value": "T16114027F77309A6FF436AA39F9107215552DDF924ACFD4322404371B9B70EAA2403E12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966760, "uuid": "36fb2b16-b4aa-4340-8df6-28dcb87930fe", "value": "3072:xiwRmQKHX9Hz0QrR5Y7q1xNTqlFua7gx15U6b3zjxES9ybMBHxhJ5adXD83z3w:QJQKHNz0Qr0aTqr7JwDcM5GRD8zw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635966760, "uuid": "b46dd56f-a0a7-44a3-a3b4-40895a56a23e", "value": 206792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635966760, "uuid": "af5283d3-dcb0-44eb-afe0-abe5bc6210e1", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966760, "uuid": "7fc738f4-eb73-4498-8481-5d11132d2588", "value": "Payment Advice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad6c76d7-3cdb-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635967474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967474, "uuid": "bc333d16-5401-4eb2-8c12-b53a7f42e8be", "comment": "Malware payload (Formbook)", "value": "0a9c33568666c88e722c9b0366b93afe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967474, "uuid": "e3435ba5-b621-4ede-9c8b-73972999d590", "comment": "Malware payload (Formbook)", "value": "1aeb38db4aa9f7758a8e63680f8c71f4f61df56c2045a8f029009a6c15f06722", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967474, "uuid": "9a8b3c76-bb62-43c2-99a5-1308aa2f2ee6", "comment": "Malware payload (Formbook)", "value": "e6a5c7723cb9675257d95d36ecb0c72892c9ed4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967474, "uuid": "f0e2ba1c-2243-4dc2-97b2-dab74f3d4685", "comment": "Malware payload (Formbook)", "value": "65de9cbc1e952df52beb7311dbf2bc0226aa20e20cb5c4c726a77ddd903964ccc73687fdf03790549c06cc1775cc3f8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967474, "uuid": "bf400f05-891f-41f1-a585-d446cc6c97ca", "value": "T1EA054820F35D49C9CAFC3734CF25D1B017A16C6E29108A5924F43DFBBABC6536631AA9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967474, "uuid": "abc1ffb3-fa9c-4142-a8d8-0acd5016b062", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967474, "uuid": "6d707d1a-dafc-47fb-9f1b-d4b28d0034e0", "value": "12288:44z3XimqFHpHaQjtvNOrVzxRXndWwYsEXHa1ByuF7EzqZEJNLTPR0:vznimc6yvkrqw0XHa1ByuNNZEnbR0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635967474, "uuid": "fb1ee362-0738-4739-8378-5ac339906ddd", "value": 821248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635967474, "uuid": "549700eb-decd-4007-9730-d6ca928ed55e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967474, "uuid": "ac4acdbc-7ddb-44c5-8e0b-cc31e3738b1b", "value": "0a9c33568666c88e722c9b0366b93afe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d26c9d26-3cb0-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635949068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635949068, "uuid": "4b515681-dc94-4177-824c-2eb6a8695473", "comment": "Malware payload (AgentTesla)", "value": "0c9063911d4b8fae4a524df57b0430df", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635949068, "uuid": "c2f528b2-7d59-4577-9dc2-63d6d661c280", "comment": "Malware payload (AgentTesla)", "value": "1b3e26e2381fa2c3d128325f4a71d42aabafe4fbd2b1091fad90afad26487f3d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635949068, "uuid": "bf34e49a-8e18-4174-a602-7bb5ac9d5f60", "comment": "Malware payload (AgentTesla)", "value": "8cc46d1afe5eb8e409de5e4953c2a98859170e2f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635949068, "uuid": "903f01eb-3e60-4d49-9212-3a5cf0374202", "comment": "Malware payload (AgentTesla)", "value": "0fa76f59b26294b76f8190de3c2a18a99aac47adbdd7c990f74cd04f6b27e96bb2209df49c532566278020b3cc8b871e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635949068, "uuid": "7c320de1-e306-4e97-8d1a-b172cd77202b", "value": "T154B4F052362C8B50C3AD77F5649A8394BBB93D3A1412EA4D2DCA31CE19B73818F74D87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635949068, "uuid": "a5828b6b-b84f-4536-9551-a0062a77b0fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635949068, "uuid": "39d7904c-a909-4547-a87b-39bc66c019a6", "value": "12288:nOxIbw8eG9auF8t2AjDdruinQtoY4IFkPDLmMeguJNLQ1:Oabw8eG9fF8tdruSrKgiO1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635949068, "uuid": "73b66714-3621-413c-abd7-10368d3a5eb5", "value": 504320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635949068, "uuid": "ae62727f-9e60-4f06-be20-bfd79e1d2498", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635949068, "uuid": "8f26936a-a672-4c5f-9c85-ce682ad18864", "value": "NaR4FPLB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d46efede-3ca0-11ec-843c-42010a9c0014", "comment": "Malware payload (Kimsuky)", "timestamp": 1635942199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942199, "uuid": "c4b2cb0e-9156-4f38-a5c3-faae06e12e7d", "comment": "Malware payload (Kimsuky)", "value": "80f51861e9cd12fd9fe50650569d1fa2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942199, "uuid": "09c018f1-bfd4-4a8f-81a1-8549a2a56acc", "comment": "Malware payload (Kimsuky)", "value": "1b4366fa0474dc0ad6b7be2b17aa251ad2c706d829e1c8d2d036b42376e8927a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942199, "uuid": "fffd342b-e715-4d9d-acc8-7f1d176cc9bc", "comment": "Malware payload (Kimsuky)", "value": "d14cb2c07c83b0170a3c1a4300020d52e7144e73", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942199, "uuid": "446bf7c3-13bd-4231-9073-690439fa40df", "comment": "Malware payload (Kimsuky)", "value": "76dcea331c92afe3136d2a132e620eac1debf134cab14701b4c78531187aa6229f52d62ad1ca32179c2c2649f5b7743f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942199, "uuid": "3d827fb2-9a24-4f6b-a97b-fa5a16917586", "value": "T13DB36C007180C075C4EE2E3C45709A625B7EBF71DE386E9753A842799EB42C19F36E7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942199, "uuid": "7d7272f0-766e-49b4-b36f-ddfa18cb50e5", "value": "712fdd0a975324eb988d3fe2289f686b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942199, "uuid": "ff2f1831-df2e-42fe-ab9a-a73cc0397d1a", "value": "1536:k/0V6LXKjkTVpX4axAhXOk18bQJkVJk5BavCPto4VNNA2MJsWwjcdWXUT85t:cKA5pX4lXOkCbwkVJk5H1TNSrWXUT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635942199, "uuid": "4282f530-833c-4190-86f1-a25865487358", "value": 117248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635942199, "uuid": "450f32c4-9303-49f7-9574-519db421cc12", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942199, "uuid": "1593b54d-f448-4259-81c1-3cdb80cf3029", "value": "1b4366fa0474dc0ad6b7be2b17aa251ad2c706d829e1c8d2d036b42376e8927a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0398e0a-3cdb-11ec-843c-42010a9c0014", "comment": "Malware payload (Neshta)", "timestamp": 1635967452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967452, "uuid": "322fc739-9450-42b1-8697-1e20ad9b588f", "comment": "Malware payload (Neshta)", "value": "b4c024b530685b4d6624a05969d9997b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967452, "uuid": "ef60b402-c99e-4452-9018-f708097d91fe", "comment": "Malware payload (Neshta)", "value": "1b6ff162d06ef0d1df78ada89bc99374b76362c5693b625ef9d46c9ee50e5309", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967452, "uuid": "b03e13e6-067d-4028-afcb-f7cb0116e264", "comment": "Malware payload (Neshta)", "value": "a584891d70ea5cc84d7d2934f3ea70af83b83980", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967452, "uuid": "dd4ba9e4-574b-417f-80a3-90e3a3009c48", "comment": "Malware payload (Neshta)", "value": "f1814af702d64b5c5f07c5874d69ecf97bf5d96cf7d3ecaf883bbda98517be548868914b142624af6f890c289c203f29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967452, "uuid": "a59c28a3-d345-47f6-9834-e90b68fc4312", "value": "T13A641214B2F0C4B7C0151FB8DD29C7B6D5737D2279204A8BBB745EAEEC397C29A08646", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967452, "uuid": "03a2dc6f-952e-4c23-8475-31f7b22b2c72", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967452, "uuid": "aa8b636e-a8c4-479f-abd2-d5ef7a18c4f6", "value": "6144:k9aWnHeRvkKco51lEEG8F/K4Wn8wEH6LbS3otQi6u4tV6BlL/co:QGvk0li8F/KlnbO4tB6uG6eo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635967452, "uuid": "f14634d9-4013-4501-b0bb-8e546afedc6a", "value": 335650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635967452, "uuid": "e1acfeac-70f9-45fc-a9c2-add8a798eebf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967452, "uuid": "b3f23525-1417-49c7-88d6-93f665911400", "value": "b4c024b530685b4d6624a05969d9997b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffaf8121-3c7a-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635925951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635925951, "uuid": "ac0233ab-08bf-4db8-b54d-4e7aace66906", "comment": "Malware payload", "value": "96cd390969d53ebc4b2900875e0beeae", "object_relation": "md5", "Tag": [ { "name": "FreeBSD", "colour": "#75A699", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635925951, "uuid": "9e7b9b92-9a8b-4f8b-9470-65efd9e2b289", "comment": "Malware payload", "value": "1b95acf7324157cbaf17cc0be9fa6a30e995a8ff1ed0fd8c6f4d5025d598e238", "object_relation": "sha256", "Tag": [ { "name": "FreeBSD", "colour": "#75A699", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635925951, "uuid": "6d5417c1-454c-42ff-badb-2fe437871a63", "comment": "Malware payload", "value": "21bc13a92f0295120d9e7d0a378400019e44354f", "object_relation": "sha1", "Tag": [ { "name": "FreeBSD", "colour": "#75A699", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635925951, "uuid": "8abbf9ab-2559-47c3-b462-d40eaf842008", "comment": "Malware payload", "value": "b187c767b46f19fce761dfab5f127674e45c389c125213017b512c549d8b4a3928ae386be0bec812385816df914f6675", "object_relation": "sha3-384", "Tag": [ { "name": "FreeBSD", "colour": "#75A699", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635925951, "uuid": "9d004df4-14f8-442b-9cbc-601f2dd3f6da", "value": "T1DDB54A62F89655E5C0FEE0304D465299BAB0B96903303BF71F8497690736BE4AF7E311", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635925951, "uuid": "47ffe3b1-d6b8-42c8-9e40-373c57e5fb11", "value": "49152:VBWlwme8nhvmR52bzPOA1nsRTuIQflLQn+MJ3m+02D1c:hmeQhvmS/R1nsFY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635925951, "uuid": "ba68c4de-473d-43f5-b371-f67742c87852", "value": 2494698, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635925951, "uuid": "eae76b9b-cf16-416b-bd66-8dbe04cc394c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635925951, "uuid": "791206d2-16cd-48b0-b9c2-0528d4436884", "value": "1b95acf7324157cbaf17cc0be9fa6a30e995a8ff1ed0fd8c6f4d5025d598e238", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a701c3f3-3c40-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635900891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635900891, "uuid": "f135330f-48e0-4e3c-b47d-c472c8b403bc", "comment": "Malware payload (AgentTesla)", "value": "c49009e63d04f3ec09d082cb3965bdf1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635900891, "uuid": "a45ffa88-e415-4ce1-97da-7d25908114c4", "comment": "Malware payload (AgentTesla)", "value": "1c4ca5b1cec71d282d5048c29b39dc3db8585da39ce71362d8d7c518dbfc27ba", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635900891, "uuid": "7e5912fa-fd21-4fae-bc22-1765cc170140", "comment": "Malware payload (AgentTesla)", "value": "e160e77bfdbc144a7b559b3592690ba3a2d54068", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635900891, "uuid": "ee29f46f-8532-44cd-871b-fd370fd3293d", "comment": "Malware payload (AgentTesla)", "value": "686094f600aa997809763552336b50d288d08f71d1f746b2f49b4e2ab5aa4637fc51db801d56c83d935ad840e3bcaa34", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635900891, "uuid": "2b8e8076-d849-4ca4-81b0-67153af3916e", "value": "T1F535F53174E9788CEDE9483046D969220DAAFD377CD9F25D94D2BC0881731836D6EE2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635900891, "uuid": "586e85b3-c9d6-479d-8e89-96b5c2a9655b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635900891, "uuid": "704d1096-bef9-413f-98b8-d1228bcc4a4b", "value": "24576:Sr4EWOhtDtoqM0Y38JLzYXFqxGO2VYJUEKlCW:kXpodJ3kYXFqGYJUEKlCW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635900891, "uuid": "b0c6e88a-a445-495a-9964-2e1371b5e1c0", "value": 1097216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635900891, "uuid": "9d1e5c3c-5f7b-400a-8d32-f2582e64cad4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635900891, "uuid": "3f08056e-8da8-472b-874a-ceb4f249084c", "value": "statement of account.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "203f8a00-3ce2-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1635970244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970244, "uuid": "bec0359d-e1bb-4904-bda5-4cec950a7f04", "comment": "Malware payload (Dridex)", "value": "210573e41374cd2d5cd26436cde6aac2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970244, "uuid": "62235160-cfb6-48aa-9e93-29ee33d62dd9", "comment": "Malware payload (Dridex)", "value": "1d700dece40d52ae1a1ced0e9d561b1ae5c641b9c17a1599cd554b408d385dac", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970244, "uuid": "db88d3e8-de98-4f62-b01c-75ac4346c2b8", "comment": "Malware payload (Dridex)", "value": "d9bc3ba76bb669dc90ac1c1b2d519a97d88d7f39", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970244, "uuid": "ae30b42c-f82a-4787-a602-02767da15820", "comment": "Malware payload (Dridex)", "value": "fbb6ffad97dd85fc43473319a1b7367705ef21e8257858244faedcfc75dbbebf5625eaa0565e946a4fd9e12ee88de598", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970244, "uuid": "afe387e0-ffcc-4035-9b6d-d5554ea7122a", "value": "T1B783028F9222FC60C83F2D7F400F85B53E0D82279DC3FA59285AA65C59DE1B35F9A844", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970244, "uuid": "53e5174e-22e6-4eb3-b027-f96a14390022", "value": "1536:8CWvP2CET+S+agP7nA9u9DE24suTlr1qeB7Oq34a1U1FFr:83QT1k7TAnRd7OqIaMn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635970244, "uuid": "54130c63-8c7e-47a2-ad49-ff02fb3b60da", "value": 82242, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635970244, "uuid": "e805b53f-f14c-42b0-8279-261ddfd7b8ce", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970244, "uuid": "cfe3071b-5e21-4548-bfa0-3a0592459b1e", "value": "Bill 881668.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2765654-3cb0-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635949095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635949095, "uuid": "255c4369-ed37-4bbb-b0ec-007dbc99821a", "comment": "Malware payload (Formbook)", "value": "8cb47329911b4d8fd206e7c448657412", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635949095, "uuid": "5330f66f-b22a-4036-a43e-20f633bfac56", "comment": "Malware payload (Formbook)", "value": "1da9324526f50ecf9bfb388913d055f7239db43623ce2fa5502e2eb5f52f8eea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635949095, "uuid": "c541897d-59e4-47c0-9163-797ef3b1d9d6", "comment": "Malware payload (Formbook)", "value": "ade773ec08a05186c1ea1610ce227615d6ce9ca0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635949095, "uuid": "15bf385a-39fb-4c5f-8b00-16ff5653f289", "comment": "Malware payload (Formbook)", "value": "f52ad4a1acf28264ace3238cb6b4ab74c6622184bc9cb00312776fe8bc537046755918567e58005d6274330bfd909eee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635949095, "uuid": "1f458e37-042a-4402-8ef6-53526331a43f", "value": "T164D44A1D5201C143E65839B0D4696FF003609EACF503EB6BAD557EA7FAF1FA908035BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635949095, "uuid": "c09765d1-94a5-4645-89b3-b1e6f0f3e9a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635949095, "uuid": "89e75468-e16a-4744-93b0-1d3144817220", "value": "12288:g953k5VDE06ATlHIPJD1/hrW/v6+Tq4A2HL3YgH+D3uOtGr:g9JklTdw3cfTq4xYKA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635949095, "uuid": "11c99d62-29e2-4eb4-9dee-7b022f62cc40", "value": 612864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635949095, "uuid": "a8641d7c-5c23-4ac9-b632-8b7ee01f5d8f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635949095, "uuid": "8f0070c6-9b1e-4932-a624-296f3997cff8", "value": "commercialJ-80-PM-MRQ-4025-6901.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9134626-3cc1-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1635956354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635956354, "uuid": "26f71b26-3e80-42f0-bb21-d7b22463efa6", "comment": "Malware payload (Dridex)", "value": "9d52e95d5da946e0e33630a61a97a48a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635956354, "uuid": "5c660e1d-bf99-462d-8f96-bf20f8b65437", "comment": "Malware payload (Dridex)", "value": "1dd687b54dc7ee7016191de79e5a9a3d72263bb7a038ffeb56c9cd83453b1a3a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635956354, "uuid": "e04d4a10-e53f-4907-9c29-94a9129f28b1", "comment": "Malware payload (Dridex)", "value": "ca8efb9450563b0ea7ca508bdea19ab4e4603165", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635956354, "uuid": "9e0d3acf-cbba-4955-be04-de46b39cf829", "comment": "Malware payload (Dridex)", "value": "c88cc7b0fed590346476354825bd19e3411061622cbb60aab1bdcc46120d34d2fb89c65391c657aec0bbaaddf192ecad", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635956354, "uuid": "a07d492a-09bb-46c6-b825-2548faf6425d", "value": "T140A3026DE8632849C0E914FE89491DF2A43902445042FF2B7DAEB1B90B752CF679F07C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635956354, "uuid": "a99a400e-6757-43b7-835a-4dba797ab877", "value": "3072:83HFzIsj8aipSW4vHREQ4iZKUbM6Zqe7/wkM:8SOipmvxpZ+5L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635956354, "uuid": "c2e6921b-e7f8-455d-ba8f-d42ecc6e7134", "value": 101583, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635956354, "uuid": "664ae710-b232-4e12-91fc-11d9d8cc0c24", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635956354, "uuid": "a69c9304-121b-48f9-af50-1ce71fe7f2fd", "value": "Bill_9001.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f376afb5-3c9c-11ec-843c-42010a9c0014", "comment": "Malware payload (LimeRAT)", "timestamp": 1635940533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635940533, "uuid": "7d27e76a-8dc1-4561-8dc0-27fb0dce8fcf", "comment": "Malware payload (LimeRAT)", "value": "b289d2bbca051d3af53a94f4cc7989e7", "object_relation": "md5", "Tag": [ { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635940533, "uuid": "253d061e-4140-48af-a113-ed690188345b", "comment": "Malware payload (LimeRAT)", "value": "1e023a2129c632ea14bf9ecaab2c98cab8a8d9c34382dc4def1e474973d6b100", "object_relation": "sha256", "Tag": [ { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635940533, "uuid": "23f97571-9d63-4326-9db1-920b3d0aa71f", "comment": "Malware payload (LimeRAT)", "value": "7e8b07fe8b221a1eb0f7209f4761924183385190", "object_relation": "sha1", "Tag": [ { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635940533, "uuid": "6768a20f-2c4f-41df-9d68-7fcebd77564a", "comment": "Malware payload (LimeRAT)", "value": "fa43b6919fd59b9e3bb8b206b4e09bc9e3fdddb4a29d0c979cbac3ec4f8f9e493c4eb6bb5f6576355c539a7119dc110e", "object_relation": "sha3-384", "Tag": [ { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635940533, "uuid": "f0f4937f-003c-4ccc-9057-e6c0ec4701b2", "value": "T1F351490255693A71DFF1660AE25BFFC1096C98256E0C80E3EE8B372765ED91B7C2C128", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635940533, "uuid": "1a0d9fda-156f-4465-821e-d23e4df6124d", "value": "48:eoeh1XGRctKuZGZRIPXGRctYZGZRZ6G5RtdHIDrF0RZt:HMURctjUZRhRctYUZRdbtd+UX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635940533, "uuid": "2d7572e5-1cf4-4769-a480-992f55e85d74", "value": 2571, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635940533, "uuid": "87ff16cc-373d-4834-8c5c-f49f788853af", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635940533, "uuid": "10f88b60-6916-45fa-95cb-6c7f70fb9334", "value": "Bypass.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4706cdba-3cd8-11ec-843c-42010a9c0014", "comment": "Malware payload (GCleaner)", "timestamp": 1635966014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966014, "uuid": "27e7dd9f-f210-447d-bbcb-92cfcc58f46a", "comment": "Malware payload (GCleaner)", "value": "d6fe99dda423f5d46e37e8b803c36394", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966014, "uuid": "217ea728-ab8f-41ba-9bce-1b0731d21097", "comment": "Malware payload (GCleaner)", "value": "1eb4d7e93b013213d4837ad64e801c030446764fe02877de8a49e93c83265f30", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966014, "uuid": "e246d0e3-945f-4ae3-aaeb-904a27555efc", "comment": "Malware payload (GCleaner)", "value": "68d6b9ce7bbb48dd5653db69dc5bdba02c8f890b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966014, "uuid": "211c3ef9-09b3-4e69-abac-c208a7054881", "comment": "Malware payload (GCleaner)", "value": "a4e1a4790b2738a0e89dfc3a0e1ce387fa4781191c27850a4c0d4e2b43bfb9e28df539267871e93d22664a759f4d5b76", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966014, "uuid": "fb12390a-0710-4152-bf80-a847fd0de6a2", "value": "T13C043A386391B436E4F70439A4ED97F094687A3067948CEBB7854F6E0B796C2D630B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966014, "uuid": "0a44b812-cba8-42ac-b2e3-450dbed12a10", "value": "2c02c1999142edb52caad79376c81ce6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966014, "uuid": "36c43411-a9ee-4dd7-8bc0-f38bbcb9dca0", "value": "3072:hYtTaZJ64KViz8WeFy0lmM+GbV3gWph+l5/yyvcOGkXthDBzBAXL+laxX1955Nh9:gaeaVUZlmCV3PgNyyvcOGkXTDBzySl6K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635966014, "uuid": "34859fd7-3261-4a42-898a-5399039a7dc2", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635966014, "uuid": "43e87520-ad8f-4b9a-977a-5fe5d5e42b6a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966014, "uuid": "54c8e25a-f264-4c8d-a0fd-66cf974555f4", "value": "d6fe99dda423f5d46e37e8b803c36394", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b2d94e7-3cc6-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635958397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635958397, "uuid": "bae262af-ddfb-40bd-8b6e-1ee9d5f247d8", "comment": "Malware payload", "value": "b5bd8dfef7366e06844f2b8595dd9910", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635958397, "uuid": "81e867f6-e51c-4cfc-b54c-49f116545e42", "comment": "Malware payload", "value": "1fd1e4dac636a9e9bf400b197dd19633797be8d3cbc9cffbf29ee38496def001", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635958397, "uuid": "ae2504ad-c023-4fd1-9ba5-d14202eed699", "comment": "Malware payload", "value": "4331ffdf420d9858435bfae964c7be792b50b47b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635958397, "uuid": "be36354a-e774-49da-bcf6-be5ee6668dea", "comment": "Malware payload", "value": "eccabca47b4a59c943e84edd0a2ba2c894463490691b837637ff59df7fc521bf5f07ae8ed5747c7239da3c6bd88005e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635958397, "uuid": "81762140-c05f-4fdc-bc71-6349cdce8a0f", "value": "T15C24F7987D14F6DEC95BC835C9585DF4AA602C7BC31B8603A0673DADB93E897CE041B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635958397, "uuid": "e473d436-f0be-48f0-9dc4-30b77ceca1bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635958397, "uuid": "cabad6fe-4284-4656-adb5-da674bf289f5", "value": "6144:3k0YQ9zUQcRbYqfGL0lwu3okf3iZY3PhHnD:3k0Z3cRbYqfGL0lwu3oC3im/hHD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635958397, "uuid": "96982d23-2907-4fc1-b2e4-f2970cb0b59a", "value": 226816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635958397, "uuid": "37da993f-b9bc-40d2-bb72-a5fe226a33e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635958397, "uuid": "86da0e0d-73e6-485e-a007-b5c1c55c9615", "value": "b5bd8dfef7366e06844f2b8595dd9910.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96d704e8-3ca0-11ec-843c-42010a9c0014", "comment": "Malware payload (Kimsuky)", "timestamp": 1635942096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942096, "uuid": "6cbdd475-4f7d-40dc-b0ab-7adb06cc70d3", "comment": "Malware payload (Kimsuky)", "value": "d7b2cf6c8597d12d30aca68b277912af", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942096, "uuid": "13f00f90-aec8-4315-ac72-af9d93f6050c", "comment": "Malware payload (Kimsuky)", "value": "2060d58311e927aec8f2e8803f5bf5f8072e0a8cf85adf0c1a667d9221a394d2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942096, "uuid": "d78e3f58-a334-42de-8329-6e973e26c67c", "comment": "Malware payload (Kimsuky)", "value": "70f49bb38578a30fafae5e92446f0eab98dd0d28", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942096, "uuid": "16db7825-ade2-40d9-b27e-3a5308633fae", "comment": "Malware payload (Kimsuky)", "value": "29bddb52246b62c533f9ad49c35224414dfbc41b3df6bbf3b9b97417dbebf3bff0fb461b6fc4d10cd193353500fa1f93", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942096, "uuid": "6e212151-03a8-4cb7-844d-3b170436c4f9", "value": "T1A7148C03B641C076D5EF02B1B569ABA2007CB67287BC9CE3F7D41E5E58722C2973664E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942096, "uuid": "78353aa2-5d95-4d28-b246-c63f680cc8d3", "value": "f02fe477652fa62196cb265b3b974aaf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942096, "uuid": "f69e3ca8-b9c3-4887-9eee-88e711daf0c4", "value": "3072:KC9PqSnlKfxsP6JIonoTKGKhZJJ57prx9M5Vpl1FR+ZOvfBxtC0aZRJZchj:V3oxsP6LqKJX7/9GVJRhjCTTHYj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635942096, "uuid": "2e44cd10-c6d6-4938-ae25-c767d8e7e6fe", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635942096, "uuid": "1938c61f-2c0f-4f6f-8a84-4445788892dd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942096, "uuid": "03c7ac1a-4a78-4b4a-a5a1-4387d6228b72", "value": "2060d58311e927aec8f2e8803f5bf5f8072e0a8cf85adf0c1a667d9221a394d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6ad1f81-3c85-11ec-843c-42010a9c0014", "comment": "Malware payload (AZORult)", "timestamp": 1635930660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635930660, "uuid": "9d52ddb9-d75c-4cb0-aac1-5396518190fb", "comment": "Malware payload (AZORult)", "value": "fe7ecf80eecb2c688df3956d7726b14c", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635930660, "uuid": "02aea9d9-7bbe-4d08-8a24-bb9fcde66a75", "comment": "Malware payload (AZORult)", "value": "206166a880793a61a27a6fbbbad1690e58578b2a89a49f3fd932de7feceec124", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635930660, "uuid": "016ac93b-701c-4f9a-8ab8-67e241591f8a", "comment": "Malware payload (AZORult)", "value": "c8df0ac4c53402f9a420f6248778ae431ca5af04", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635930660, "uuid": "a77911ed-1656-4fcf-b807-6fee48aa5bd3", "comment": "Malware payload (AZORult)", "value": "1dc32327e7bec982183b23bd7091f471514f13cf9507a0eeb87ddd141727e98e47e176c0b9ef87bf104c24be986ddf96", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635930660, "uuid": "cb258f43-0065-48ef-971b-e1c62f3b11e7", "value": "T1BC549E10A7A1C035F4B252F889B6A3A9B93F7AA16B3490CF13D516ED4774AE0EC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635930660, "uuid": "921c5fa5-edd0-4ffa-9002-c7f7bb82b8e2", "value": "e024db68009cf7f32dd817cae1867bf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635930660, "uuid": "1e62e19f-3abe-4718-be9d-08839bb6d38b", "value": "6144:7dklZKSU6LuxjHqOY8x+hYvBfCctVmSO1AT13:7i/TUcu7Y8x+hYZCctwSz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635930660, "uuid": "cb8245d9-f822-4ba2-a7bd-dc0162940833", "value": 299520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635930660, "uuid": "d485236d-54de-4272-9db6-cac7855f73ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635930660, "uuid": "cb66f06c-1bc7-452f-afab-5efc3f10e667", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99b4cfdb-3ce2-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635970448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970448, "uuid": "7245ab1f-5663-4977-9183-388c399c3b43", "comment": "Malware payload (Formbook)", "value": "51577ad5c1831e5c27c6574a1f064e88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970448, "uuid": "09065298-3163-4f85-97b9-bc43e99e180f", "comment": "Malware payload (Formbook)", "value": "221e9e3719749c7017ad2100a3d48e0ddb47824e02627fe859706fb591332849", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970448, "uuid": "61332779-42fe-438f-94c0-0dbb47ba9c15", "comment": "Malware payload (Formbook)", "value": "2edd85625f49abc18f0ba85b87e37fc2a2c16853", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970448, "uuid": "be4df4a4-82f7-40d5-b196-933037229630", "comment": "Malware payload (Formbook)", "value": "66b8224cafb8d8c982b5cf2d4b47e7afc5a4d161e0d740df86649a6fd19be91210cceb3c0ed6708ef2fb0991d5288f97", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970448, "uuid": "5bd773b8-8df0-4d57-86e4-122ef383ae87", "value": "T15BA4F049392C9B11C75CB7B564EA8380BBF47D3A5452EA4E1ECA70CE0A773418E70E97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970448, "uuid": "e511a408-278a-4994-9e11-31a4ff4acbc3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970448, "uuid": "4a8d65f4-5ee3-42dd-b3d4-af7f229a57e1", "value": "6144:RzWD7MbwN2s7GQ28uBQss3ifxVps+EQdZnHBOOCUPeDn2w9OZuW0cH9z6DlTD:RkIbw8eGz8yQHanp8QThhPIZ6x6D1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635970448, "uuid": "a46a1bd6-c917-4130-ae33-1d19d3b53bf9", "value": 477696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635970448, "uuid": "890f8808-13b7-4d3d-9654-5bd896349f85", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970448, "uuid": "563bead0-47f0-4156-b511-aeb88517054b", "value": "51577ad5c1831e5c27c6574a1f064e88.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "501d407e-3c70-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1635921361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635921361, "uuid": "1e505ee7-c857-49e5-a861-5039b6341642", "comment": "Malware payload (Dridex)", "value": "a7b8838cfdb9a143542d409d92a18015", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635921361, "uuid": "33efd557-e5f6-497e-ab17-5b207dc25ff2", "comment": "Malware payload (Dridex)", "value": "22768a52769efaa1e0779164dcc6d0b41bb74fa27b7e48db4d815b41d6b33df5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635921361, "uuid": "6119ceae-eb7e-4ee0-be4d-17815ce39d0c", "comment": "Malware payload (Dridex)", "value": "6291152fc4d58908fbe6b985a61fb2e57c76ac8e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635921361, "uuid": "7d65318d-5530-4f5a-9736-d646c12ba920", "comment": "Malware payload (Dridex)", "value": "a4984d8263390b5cf2fc0d45f4601df27a524b768d328edd90ea252d6a96868863295dc1ca2606d43c323e3246f03b7d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635921361, "uuid": "16e70139-1402-44ae-88ff-8f07b1ebc93b", "value": "T1B573E0DE9280F415C377CE7ECF269CE4A3070A176D19864B3899B70CAFFA2420FA6155", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635921361, "uuid": "b3088719-a065-43f2-9f4e-d4e7d3855b4e", "value": "1536:8CWqPuALLImemeKHqeK7YncGvfAcMETyTjB2S+OJ6FJ+:83B80XKUYycME+Tj81fFQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635921361, "uuid": "14567d1b-8ce9-44d8-9456-b5e35a3c426b", "value": 73963, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635921361, "uuid": "d69474f1-914c-44c7-b0fe-33d757766c78", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635921361, "uuid": "cb20ce27-0c76-4b5b-9695-1bbcf8f59835", "value": "inv_79317.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6491bea-3cda-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635967167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967167, "uuid": "e65d754e-9c89-425a-884f-524679f4a9a6", "comment": "Malware payload (Formbook)", "value": "c5cfef9b7b6b39513f276093d7ef2157", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967167, "uuid": "927551a4-361b-4878-b008-372a1f10ecff", "comment": "Malware payload (Formbook)", "value": "22a943a5c28c80163c59b4a42923050c5af77fe9cc919aee6d1aab569d684dc6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967167, "uuid": "b06a0d0a-f4af-4212-8a99-83b33ac1eb55", "comment": "Malware payload (Formbook)", "value": "9c2d4c4ac1017ac91a5bd956e6864cefcd0f2bec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967167, "uuid": "96c39ae3-33ee-4b9c-bb5c-319b2908b8c7", "comment": "Malware payload (Formbook)", "value": "4a3fde201239eca633a6dc35bf606318e2545f4706108c49ac660943f4ca13cb49793b94ca43f8371704bd475cea60b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967167, "uuid": "654bcaf3-6540-4937-9d76-17d89f1453dc", "value": "T11C156C65F1849632D41A3FF8CE879BFD14D5BF83692064166FA83F06CE35BA93426423", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967167, "uuid": "b6246bdf-ef1b-49dc-9f2f-6638587eb74b", "value": "3513b15d2020b37cf2b66a761c75ed57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967167, "uuid": "ddb37568-37cb-4b11-81c9-e63520043e03", "value": "12288:WxBZN9xp6/Yo9sSbJ+RLbKvOS9cr9BE6ZyxDcC6CoueU:WF/C/N+1KWS49xy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635967167, "uuid": "14988098-46c9-48ce-8ba0-683d78b15ad4", "value": 887296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635967167, "uuid": "1a4134c6-239e-4677-bd44-cd168f0ad1de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967167, "uuid": "21a5ec5e-e5ea-46c9-8741-93288c166f30", "value": "c5cfef9b7b6b39513f276093d7ef2157.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0e9fdcd-3ca0-11ec-843c-42010a9c0014", "comment": "Malware payload (Kimsuky)", "timestamp": 1635942193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942193, "uuid": "983e7f7c-3049-4d84-8658-a8bb09ada5f1", "comment": "Malware payload (Kimsuky)", "value": "61433868a92e5a31de2dd57c5f0b31ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942193, "uuid": "1bd460c1-b486-4139-948f-a5b53ea9ff33", "comment": "Malware payload (Kimsuky)", "value": "22c6a0be9068a4f35812c759158f96b5d30466add38e6bc5e088d345d80b0ce8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942193, "uuid": "82c39ef5-f48c-4f64-af84-ad30293a2084", "comment": "Malware payload (Kimsuky)", "value": "04d7b7d87db1575d4bfe68539bf0e13926651bb9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942193, "uuid": "3063a3da-21d7-492a-a390-bfda3b28cb5e", "comment": "Malware payload (Kimsuky)", "value": "0e2dd77515e6d4c75ad4a4e304596c2cb932c6c5393475c40a7bc40fbd5aa5b6f1b4db1b2cdf8c389565126368752a18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942193, "uuid": "9756ef74-0264-4edb-905f-d24b59e8d046", "value": "T120D36B1B73A410BBD1B6C639C8631616E37778260631DB6F07A4465A1F23391AE3EF72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942193, "uuid": "dfc7fa0b-52e2-4d32-be6a-bb82de57f03b", "value": "af37ec4244a04df6a22bde8343c56275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942193, "uuid": "f898eab7-2ad8-466a-a6e2-2be5570d0d42", "value": "3072:rxas3ZL/e+prQ2GT1/5lEsfIpumv1x2PG/:rcG/eI8xblvf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635942193, "uuid": "457ed733-932c-41e9-8c6d-67d1bdc1afa5", "value": 132096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635942193, "uuid": "7aaabc60-1481-4360-a50b-17519711c527", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942193, "uuid": "7d3047e7-df70-4f9d-87b3-0115bfa6e01d", "value": "22c6a0be9068a4f35812c759158f96b5d30466add38e6bc5e088d345d80b0ce8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d328961-3cad-11ec-843c-42010a9c0014", "comment": "Malware payload (Neshta)", "timestamp": 1635947502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635947502, "uuid": "7cecef2f-6227-4975-8695-fe3df3247259", "comment": "Malware payload (Neshta)", "value": "6f9a435a8d01482b3a8fbdcd361f277b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635947502, "uuid": "d23cd594-a4d9-40e8-a4d9-5b61080ed752", "comment": "Malware payload (Neshta)", "value": "234de00e0baf6411e8b774d7821ce00a06ae9d09599f4dbc32b1367493130707", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635947502, "uuid": "36e45956-89eb-4f08-b25b-a88e0e1e6a5e", "comment": "Malware payload (Neshta)", "value": "fa6abbaa9eab006f1d6b464a29c11ca88c35d8bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635947502, "uuid": "2c7ef417-6a28-4e9e-adff-7a7c59df7f19", "comment": "Malware payload (Neshta)", "value": "729a68a0ae0f0ac578a7ef815a905c9390120dd18ec7ddef3d9ec732b409ef9e32698b56e1647e3b89765fe24c0bffe7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635947502, "uuid": "1144b91e-d38d-46cc-b284-3da5483efea3", "value": "T18E54123532D199BFC05D17B167B28A64D27BE91C2236A4CB47580F7BB8533CA9E053C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635947502, "uuid": "afc152a0-f54c-4f75-963e-bc6c2e4a8369", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635947502, "uuid": "750474b5-ebfc-46b1-b790-26e3aade1f91", "value": "6144:QBlL/AzzbidkKfQ0I4udOInsZAYu7bxEKUtEg4lMIMGYB7zoPT0H:iWzzWdkKot4uwisZAYYbxEKUtEg4lEBV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635947502, "uuid": "afdae4a9-ca12-4768-9374-cd82b812760f", "value": 282119, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635947502, "uuid": "b364aaf9-d9cf-4ae5-9db5-cb3908d0a397", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635947502, "uuid": "3881e1aa-ad04-4a6e-896b-8d216b31bf68", "value": "62,500-payment............exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aba40081-3c48-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635904335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635904335, "uuid": "1213b22d-3af9-49df-b9cc-9528dacd740e", "comment": "Malware payload (Mirai)", "value": "dca9705c3a8560845e9e37d5ba21e5a3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635904335, "uuid": "5546f485-9aff-4f92-ae2d-539c46c36652", "comment": "Malware payload (Mirai)", "value": "243812aecb98fd61746eefdd01780946f98003ea0914c63417a5a442b3932c33", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635904335, "uuid": "64e5f31a-d534-43f5-9c4c-7df7f215e7fe", "comment": "Malware payload (Mirai)", "value": "eab719513cf4a2836b3bfa6f5fcda59614f3e320", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635904335, "uuid": "0a2d54e7-6693-484b-ac88-5781780dcc82", "comment": "Malware payload (Mirai)", "value": "7f41bd85e09e7e1ca633fe247062c2dae39b523bf17a9e8de8584a3f31283240bb02b43e1e9827d21d2d9e865f5d4b5d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635904335, "uuid": "05484df1-c73d-41b8-935f-6c2575734a7b", "value": "T148930785BCC19A12CAE8237AF56E01CE371563E8D2DE7217DD201F6437CA82F0D67A95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635904335, "uuid": "5fcfd9f4-8b74-4053-8f0b-9156e76d3823", "value": "1536:UWNtOzGhXfH75A6i/cQb4Uzy+SR6VSmR7a5XEUJAqrVD1pSFKt1ipQ9QWuQEH:UWazYXfHtAP/18UzGrRp/riC9Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635904335, "uuid": "5db94a77-b248-40a5-8e57-dfcef0979940", "value": 95228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635904335, "uuid": "b7f3fac5-315c-441e-88ed-e0bed12719db", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635904335, "uuid": "e497304f-18a4-48f9-a19a-7a390fc7b405", "value": "arm-20211103-0152", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edb3b731-3cdf-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1635969300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635969300, "uuid": "ad53726d-250d-4613-9068-3cd9347dae96", "comment": "Malware payload (Dridex)", "value": "e525ab78fdc841a840014bfffc6d285e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635969300, "uuid": "132e56dd-b456-4084-8491-f0b2196ac90b", "comment": "Malware payload (Dridex)", "value": "25528ab62b935d7b77a8b5b141620baa8891b1cc118da5d81dcdf9cecfe9bd42", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635969300, "uuid": "9c430fc0-47b9-4f8e-b2f0-f80de946fcbe", "comment": "Malware payload (Dridex)", "value": "871766186f3c4927507e4db400c4891305579f1a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635969300, "uuid": "fa2dbd7a-d7b3-4d9f-9125-7b129f7f0e73", "comment": "Malware payload (Dridex)", "value": "31fa6a2c649999347f62eda69e930cdd8455ae09b96c0c74ffcdc019967ab4fff4137f7ffae4266cc5678c3dca3cbfaa", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635969300, "uuid": "b809b6b3-19dd-48c0-8253-7a34b65f2156", "value": "T14873029DD0E96498C66D99FD716F1CF2E105D404A264C1AF3D6EAE087AA235B0F0F42D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635969300, "uuid": "d60cda38-35d8-4547-8a04-12dd4c470f3b", "value": "1536:8CWNePFwJpvc1e+BwT8YIbDMz+1d6xFzXEm/CpBsJKQTlDUpGtE/j01Y:83vMrbDu+1d6xd0m/CnKKQTlDUpGtb1Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635969300, "uuid": "272a8884-ca07-4f32-be60-4a48023fd5a6", "value": 75489, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635969300, "uuid": "61151adc-9ac8-45b1-be64-8d789da654b7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635969300, "uuid": "16d1f0a2-f175-42c6-bc60-2138331dca9a", "value": "Bill_630781.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31f8cfc4-3c82-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635929042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635929042, "uuid": "e2c28e5b-d6e9-4dc6-bce0-6c7a91bd0266", "comment": "Malware payload (Loki)", "value": "76810bdeda9d225d471db8bf46b4da8c", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635929042, "uuid": "c69e90c0-f89f-45ac-a03d-d7f9d8b85ea1", "comment": "Malware payload (Loki)", "value": "2574ac816c73da9f0a6830d9f9b8453b86bad0015973df0613edea485915caab", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635929042, "uuid": "1ccd7a88-9264-40a4-8dbb-22f4d29e689f", "comment": "Malware payload (Loki)", "value": "6409453a58210c11b5861641a812c0c40143248a", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635929042, "uuid": "de7f3567-567e-484e-a9cb-e2653c087c7e", "comment": "Malware payload (Loki)", "value": "c4851344536975c55580d0d8d401c5c93e7e53227c5d86ce934ce29590342ba7de1a1dfc1d34c975abaab4d458e0c8a8", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635929042, "uuid": "6cfb93bd-a0b8-4254-bc61-ceda0785c1c6", "value": "T12FC2437AF58B0E48DF579769060A7B69064DF11D73C840F23AB8DB38795D80B8723938", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635929042, "uuid": "24baf4d1-5b99-4101-a041-a8ec7595e9b8", "value": "768:SaXplaxmcR0FqsHsv3mcSvhj6FWAC+u7sR+:SxxNR0FqsHSNihj6FWAAAY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635929042, "uuid": "311f0c76-4a7c-4a4b-a982-7579c6e3e79b", "value": 26179, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635929042, "uuid": "ce2a343a-4cc2-4e80-8070-59f0e9ef1266", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635929042, "uuid": "bdb4020c-f4b9-418b-a78c-29be44e7641d", "value": "invc_00009499400049.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41428a8e-3c72-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635922196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635922196, "uuid": "d3c99627-7fac-42e8-9415-7894e052b3ef", "comment": "Malware payload (AgentTesla)", "value": "71793eb541fd25cca6ff817f420aa053", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635922196, "uuid": "f5f6ac2d-769c-413f-afe5-6780c130c62f", "comment": "Malware payload (AgentTesla)", "value": "265786959d8100084742220425f699fd12cfa55d3976cbfb7a1cbfbc7b002dd4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635922196, "uuid": "e3cb9924-8a3d-4b81-903f-092ae8ca897c", "comment": "Malware payload (AgentTesla)", "value": "46412c5c3363ff1d412623d3091d3a371016606e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635922196, "uuid": "ef64620c-fe25-435b-b3a4-66c039e783f9", "comment": "Malware payload (AgentTesla)", "value": "0422178537ab6f2278bfb4e6682b2bf569808c81a4640ed95ba3cb3bceffc174688f94fff257e2e3b374953f9c225327", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635922196, "uuid": "cf03b1f9-b05e-485f-92ab-001ebc5e1432", "value": "T1D9055930B75D8D89C6FC3634CF25D1B017A16C6E2A10CA1924F43DFBBABD61756306AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635922196, "uuid": "60ab89e3-b4a3-4251-8803-6f0b900fc3c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635922196, "uuid": "1c5cd3d0-7114-42f5-ab8f-abd487da7b9a", "value": "12288:ny3+UocV9aZRd/MHYlk2QmXtbgYmj1byuF7EzqZEJNLTeR0:njcV9uRuHYG2xXtbFmj1byuNNZEnSR0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635922196, "uuid": "8d26cf9c-cfbc-4edc-ae20-e53241a175b7", "value": 846848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635922196, "uuid": "967cba33-d73f-4d94-8e9b-70f837a2c95a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635922196, "uuid": "fd551fa3-866f-446b-a3d7-62b678c6831f", "value": "TRANSFER SLIP (2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e89e80d6-3ca0-11ec-843c-42010a9c0014", "comment": "Malware payload (Kimsuky)", "timestamp": 1635942233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942233, "uuid": "d251e06f-254a-413c-97e3-c2979e25254a", "comment": "Malware payload (Kimsuky)", "value": "b124c9c155c113f8b0434b589c07c9db", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942233, "uuid": "856d7016-c343-463d-80d2-4cd38fd932d0", "comment": "Malware payload (Kimsuky)", "value": "2683f21bf33acd5a6d7d5806ce69f408816d05ef0a981d0849079572830b93a5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942233, "uuid": "9221d4ef-2700-4f61-866a-b665f611fdae", "comment": "Malware payload (Kimsuky)", "value": "6a0eeb5508644618087a587eb45cc9ca2240e656", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942233, "uuid": "5e9d82ac-1f9d-4dda-91a4-4f0ae1f60610", "comment": "Malware payload (Kimsuky)", "value": "0a7bb9a2fc704d444b806760d52204e421a04fd3a45f9fb1b19597d156a5f08d5c842ad2cc6b6b129460439fdec0bfaa", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942233, "uuid": "7aecc673-d08d-4b62-8003-8dc76f1339fd", "value": "T126B35C11B1C0C031C0AE6E3D4530E6A29B2DBD61DE69AE5B1359413D5EB02D1AF35EBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942233, "uuid": "5e5d30b3-8f96-44aa-8835-0b79fa829d4e", "value": "8308fd527beec1685acea37090f5c599", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942233, "uuid": "32614167-04d1-4480-8e32-f55a239af448", "value": "3072:FNPXTs10Kkow9dhRjIhnGW0HHxgUB4Iu:FNPXTC72rhBIgLz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635942233, "uuid": "10620344-b90c-4550-b365-e26c178f53af", "value": 115712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635942233, "uuid": "39c6e7d7-1d80-42db-830a-477bcdc469bf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942233, "uuid": "31aa0221-7b95-483a-a049-c047ebac6a50", "value": "2683f21bf33acd5a6d7d5806ce69f408816d05ef0a981d0849079572830b93a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3e9e898-3ce0-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1635969686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635969686, "uuid": "b359bc62-04cc-42bb-b051-52985b3e70cd", "comment": "Malware payload (Dridex)", "value": "8b131127e123059501c8a2b97f83dcf0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635969686, "uuid": "52d07126-a81e-4116-afb0-4d63f991063c", "comment": "Malware payload (Dridex)", "value": "2775b71e3fbe5eb7c6edea36fc86496b5c41da6c6ed3442777e7438ba181a25b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635969686, "uuid": "95e7b8f2-862b-4d3f-af8e-a2320deaca21", "comment": "Malware payload (Dridex)", "value": "f4347e353cf7a153dcc4c17ce71365b1174dedad", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635969686, "uuid": "b402e494-fc7e-4daa-9f10-98d12a1d065c", "comment": "Malware payload (Dridex)", "value": "b485a00e66e79dc3cd7adf9fe54150b8554a4bad485eea2a7177f26e557ef8197bdef1df0b6f79f8b40cc0205a7be7fe", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635969686, "uuid": "ddfcfe32-ade9-45a8-89c9-fa8a02b34038", "value": "T16973029CD2E2A484C1ECA87E749B1EB2BC576001A482D26F2C6DAF4C495329FCF5F135", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635969686, "uuid": "e9e22409-c89c-41dc-ac0e-3829d10d26f7", "value": "1536:8CWvPFwJpvc1e+BwT8YIbDMz+1d6x72J5ZShPOzWUFTMes2U/E/LPE:83IMrbDu+1d6x6J5lzWUFSF/EDPE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635969686, "uuid": "f1906348-d241-4526-a90c-224bae5e5c6e", "value": 73469, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635969686, "uuid": "a67c6c48-b798-41f2-b905-e5e4c6a85c81", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635969686, "uuid": "7b0e1a42-d03f-49da-b807-0de75d58871d", "value": "INV-51869.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81694ca0-3c4c-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635905982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905982, "uuid": "effb7dd0-bb6c-4992-b6fa-6b9e49f76057", "comment": "Malware payload (Mirai)", "value": "ae0883710ff72e5d8b44c998f11611f7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905982, "uuid": "b70c636c-3341-4cb0-9cce-ddccc02a93fe", "comment": "Malware payload (Mirai)", "value": "2784c2a29401a1fe95bacb007f08f62064f1923d2f601df357b28a086528efd3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905982, "uuid": "97409964-0952-41e8-8a89-58f2c5407180", "comment": "Malware payload (Mirai)", "value": "69d8a86cefabae08e7208e0552b5ef37bcb597c0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905982, "uuid": "e41f391a-7474-4c7e-beda-30b98cba132a", "comment": "Malware payload (Mirai)", "value": "aefc54ecbec50e37cb3ef0014839761207efa18a83866c42b9ce6e3a963eb8134cec114f71a83d4cd11901777dac7349", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905982, "uuid": "e4671628-d777-48a3-a367-4d02867c7619", "value": "T169332ADAB902AD7CF98BEABE80160E0AB23123541053073777EBFDD37E321549956E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905982, "uuid": "614cb3cc-145c-4c0b-8b8e-7a3f04266e27", "value": "768:mLGOe2kf9e9X9nbermI7vc59QPQs5gFHviPuzWeHXpi2UJTpDnH638gC:mL/4f8F1ef0YgFvimzpZi2UJJnHY8b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635905982, "uuid": "d2a07caf-608a-4482-b213-d542417e660f", "value": 53056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635905982, "uuid": "bd55d1c0-00c8-46a2-ad6a-28667cf87bdd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905982, "uuid": "96e38179-68dd-4ee6-a347-c067fce5cac8", "value": "ae0883710ff72e5d8b44c998f11611f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2cfe374-3cc8-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635959430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635959430, "uuid": "21bc8739-f4ea-4f12-aaab-4c2acd9bee92", "comment": "Malware payload", "value": "9aa6aa141a72e6bdf7c94c6d9ec6393a", "object_relation": "md5", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635959430, "uuid": "3f489213-0e9f-42cb-954a-5f2bb0b47c8b", "comment": "Malware payload", "value": "27da163fc18aecdaa7d4f5148d373b2b24e8524933aaf9b168a33c060e12ca93", "object_relation": "sha256", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635959430, "uuid": "3d528297-2f3e-44be-996b-3654cbd9c2a3", "comment": "Malware payload", "value": "3d4e2eb631050d86366bf6470159802e8f5b071d", "object_relation": "sha1", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635959430, "uuid": "3daf8703-dfd4-47c3-b668-6369a832694b", "comment": "Malware payload", "value": "7c33be134952b7b8827e010b570a1d6e23915cf07dbcbd98a1096439c609362d4229afa4330b480c14e5020091bdac4c", "object_relation": "sha3-384", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635959430, "uuid": "b8438268-125b-45f1-bc05-a7a2776d3f44", "value": "T1F892157EF58B0E489E96D668160A7BA6064DF12D73C440E137BCDB387A5D8178B22D3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635959430, "uuid": "d4a9d6a9-1f1c-4b41-b772-7a58ef2aa8a1", "value": "384:4cmhJoJBoXpZF/D1o9acynv4F0gtWUWFdlN/KX6GQvrj+gWTn:+goXt/Dvnv4FzWLziX6GQ2gWTn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635959430, "uuid": "2e7e8b04-45aa-4a29-8cf2-516fd132dc35", "value": 21028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635959430, "uuid": "ee1f9801-212a-4b46-a66b-15a4fca6b30f", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635959430, "uuid": "4bea3584-2a3a-4dc7-b0d1-01e6a9381d61", "value": "9aa6aa141a72e6bdf7c94c6d9ec6393a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d95506c4-3c72-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635922451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635922451, "uuid": "16ffd0a7-23ae-4852-a05e-5c523d6403a9", "comment": "Malware payload (AgentTesla)", "value": "b1532eb19cf22b524eac674c86b50d05", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635922451, "uuid": "137336df-666f-4b1e-bb74-cd81efaa8fda", "comment": "Malware payload (AgentTesla)", "value": "2809dade1e315babc80d180fd6cce88d4e179c70f76828e064bbc7f0f636e881", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635922451, "uuid": "09b9795d-4ed9-4e64-9867-89d550de658a", "comment": "Malware payload (AgentTesla)", "value": "9a638b0bc9d8efd20485bce4c68f44d205c0bf49", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635922451, "uuid": "185f9e51-ce8b-41ff-9777-9a74c645e290", "comment": "Malware payload (AgentTesla)", "value": "fc33298acdfe3404dd8b79ed216733c61a15433afd3287b659d3a29e8900c72920e7dd5eba1023a18abf0863ab266913", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635922451, "uuid": "865857ce-6c3d-467e-bd61-510887be0679", "value": "T140B423E5478E46AFC981959F5851BB458337A66EF1E3FB360300A81CB838CE9BE55C70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635922451, "uuid": "9fb8cf6d-a099-4356-a893-4c154c19da83", "value": "12288:DG/fgCSsJ0hHYwlSIzJpGA5HhMa458+o9/A:whJ0ZYxIFp7BMVo9I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635922451, "uuid": "8cb8b921-fbe5-4d39-81d3-9aadc6ba3aef", "value": 523557, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635922451, "uuid": "27069639-11ff-430b-a366-187b4ee21b4b", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635922451, "uuid": "72d8115b-6362-429c-aa34-8827c8880d8c", "value": "siwfft copy.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5aa34ea-3ca5-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635944322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635944322, "uuid": "be187605-d9f5-465c-9580-4e27e7389022", "comment": "Malware payload", "value": "41911bc2ace1b103171a0e04d47f8cd5", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635944322, "uuid": "8fc60044-d6e4-49f4-92d1-beaa1e3b38ff", "comment": "Malware payload", "value": "286b7813276bd817ae15dcad1b458de4670d814deff3ad1d4e465c35c77707ec", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635944322, "uuid": "2189b641-650b-4f24-b406-ae93296bbaa9", "comment": "Malware payload", "value": "0c01cdcb40fb0ddf79a5fae64be294f9bb233cf5", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635944322, "uuid": "be15f051-a8e2-4421-83c0-7eae881f26d2", "comment": "Malware payload", "value": "dfb61c68b79774182083a6f4a25d3efd5634dfd285e5f5403bbc5b0edea1eeb13d3827958a9c5800e67b13af3af56b84", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635944322, "uuid": "503b38cb-b5be-493a-940d-d3c0db1c6831", "value": "T1F1773381FB64A92ECC7780324D7A2639615A4DD28E82D757B828734C2CB79E05F49FDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635944322, "uuid": "b55de797-a292-4019-a381-e1757fbbf002", "value": "786432:QUra52wQ9ymqqAQW30Xz1Jk6OGjVt8UfQ2PG+H:Q05b9ymLAQW3wzbltpG+H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635944322, "uuid": "eec2698e-2d8d-4fc5-9f4c-8fb1ea243f90", "value": 34572861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635944322, "uuid": "df70ed7d-548d-4219-918a-c08d8ed80f97", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635944322, "uuid": "01bf471d-29f9-4cd8-919f-40d7dc1a48e8", "value": "applinked.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd168ab6-3caa-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1635946509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635946509, "uuid": "e78a6e2c-639d-42a4-bdca-6391619a28c9", "comment": "Malware payload (ArkeiStealer)", "value": "120082a3c92cfa03b2f4fd78a189087e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635946509, "uuid": "ca476513-7779-4fc8-905f-477100abbc5c", "comment": "Malware payload (ArkeiStealer)", "value": "28a3dc5780a2b75be107c64d08f4458fe6ca3e130c391e7c40c631a35a992eda", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635946509, "uuid": "429c7d8d-b3e0-4448-88a8-f176f4ed0677", "comment": "Malware payload (ArkeiStealer)", "value": "42c3888a726cdee9cda333723075ecb647a9034f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635946509, "uuid": "8d462c4b-06d8-4e0a-baf8-cdfc51e29a51", "comment": "Malware payload (ArkeiStealer)", "value": "862b81fd82751b141b181f1dfd2bbc20d17e2c34dcce99f28b73797db4c508d770eb0eaf609c8a2e6ab106795083d007", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635946509, "uuid": "ad9a29e6-fca9-44fa-b7f3-e3ee59889bb5", "value": "T17A75C032F2C1C437C7772A385E166658EC2A7E015E68A84A2FE50E6C4F397717B2D193", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635946509, "uuid": "61f615f5-5769-42f2-b1ed-176aa6c9550b", "value": "b85fbd69f590e538d65c2f55613c4277", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635946509, "uuid": "ce503240-c801-489a-a7e5-bc02fab1e6a4", "value": "24576:NYOWCiW8yssj9Ij2aREpmOpLF06E+b1VZw1SjVFsKICyWXqVWgH0Wy9bvFGNY83w:Nipoy+bPpFSVWyoDV83HgZV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635946509, "uuid": "41eb8516-56f4-4e7e-a95a-02dcc731efd0", "value": 1659904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635946509, "uuid": "9a3141a0-1e00-41d3-adb6-5df71957a78f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635946509, "uuid": "81ff2833-7119-438c-87fa-981545c80872", "value": "120082a3c92cfa03b2f4fd78a189087e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8515eb61-3cb3-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635950227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635950227, "uuid": "8a36c0e2-cbf7-4462-8912-44ddfca926d1", "comment": "Malware payload", "value": "b77ee5f2f3da5857394d2dd92a4fd9d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635950227, "uuid": "a18397bc-62a4-4fb3-a1fc-54cf2bb22366", "comment": "Malware payload", "value": "28cb9fac47c13c10dfc0d3e3a36c5b473e1ff36b0d8d7638b06c84f6b157e90d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635950227, "uuid": "3be4bf1c-3a75-470b-b97e-6811023a6452", "comment": "Malware payload", "value": "30cf49d28bed6c963156e4bd4aef12b604fe0c26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635950227, "uuid": "1bff6156-7a76-4649-ba90-d19b6ed4cabd", "comment": "Malware payload", "value": "978e5cf55d8790b0d3ebbc76c473da9cbf1e8857dd1e3793a77d01c0973ad8ab6775ef1fb6c6ff7587effdb66387b1fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635950227, "uuid": "65faf5ca-ea76-4e40-9b0a-ab56ee1a687d", "value": "T16594DF5136AD8A10C36DBF7220A69301BBB0AD652D42D64F2ECE358904BF7464E35F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635950227, "uuid": "2d48179c-d22f-4f40-bcdf-65888f79c570", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635950227, "uuid": "72e8348f-5b07-4bb8-9f85-89a24f8e9562", "value": "12288:P9wIbw8eGDvx85tJejjhXP6H8VUe321j0:1zbw8eGC5XexdVUF1Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635950227, "uuid": "cfcdc136-fb1a-4bf4-a86a-994d0caa77df", "value": 433664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635950227, "uuid": "6ed4123e-f48b-41ac-8d4a-23edd5813039", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635950227, "uuid": "28514bc6-8a08-4482-b6f7-0dc1b1f4dc4d", "value": "ziraat bankasi swift mesajii.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d082c404-3cae-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635948206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635948206, "uuid": "324dc23d-37e1-46b9-a2a1-59f28f0532f5", "comment": "Malware payload (Loki)", "value": "2b0218f59308f890c8f1fc6a113e439e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635948206, "uuid": "be4430a7-a1e5-4241-9ceb-700430ca8deb", "comment": "Malware payload (Loki)", "value": "29ccfd244ce86d83bc3c39b3b2de1484e284ece26df89f7e18492d642b7ae6e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635948206, "uuid": "1f39d888-bdd8-4490-a27e-0e65b26c104c", "comment": "Malware payload (Loki)", "value": "ca9ba4a3aa18511e95d150a688a2bc79eaf30d02", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635948206, "uuid": "7d01a511-40bf-4fd2-8bfb-c17725f4ec39", "comment": "Malware payload (Loki)", "value": "22ff254021d2294345a2f82d160dd27a8ef116aac45e6628fa23d6848a496cf8d5995b88f82e2c1db964c95700f74999", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635948206, "uuid": "dbd26887-6ad2-4894-bc8d-179de53c4d12", "value": "T13B746D06B3038B4AE81877B5EEB77B101760BFA599B1571BD2D4B82E103F39A3990747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635948206, "uuid": "952601f4-0220-419e-8ad2-8d3e21489cd8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635948206, "uuid": "393a97d6-2b26-4114-8f0b-4d928fd54c5d", "value": "6144:nbMQ4/g8RNVZ73mIhH2Bh4uKFigNf/Qff1AVP6xQQP8o1xL:yVZ7zt2Bh4us3/81APXo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635948206, "uuid": "86ab941c-d488-4bfc-8418-5446660c6f99", "value": 365568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635948206, "uuid": "bad8b991-e367-48fc-b84d-59d844f9edfd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635948206, "uuid": "cde52e32-f42a-4d2a-8c05-c0b2eca0f42a", "value": "Original Shipping Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78831a2f-3ce0-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1635969533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635969533, "uuid": "44c7eed3-dffc-402a-8ab0-026602547626", "comment": "Malware payload (Dridex)", "value": "1ee57c2eb43f834998b83f28329712f5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635969533, "uuid": "d0f54c30-4ebe-4664-8a76-ffa8701eed9b", "comment": "Malware payload (Dridex)", "value": "2a5e126d19a9ec44c7436e648c7e2c2eecaa9006768ef994cce127ed86858cb1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635969533, "uuid": "14aba5da-c7e1-4d95-b6b4-17d688c30fe2", "comment": "Malware payload (Dridex)", "value": "81e1a629a259a827536cb59972e10b6972971d1d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635969533, "uuid": "5fd46f3d-9ee3-408c-a4ed-026c6525a1fc", "comment": "Malware payload (Dridex)", "value": "7bb9e0c0a565c414ce22d2d0fe4e883c161053b4163c82dd5d47697510666c53e5159ccc89f6c34e1cb7736f15665649", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635969533, "uuid": "14962370-0f1f-451e-bea8-0c1aecb87c98", "value": "T1797302498B55B4C0C5EAC47C8069EEE0F907232C6982D31F34F97F14AAF92D79B9A315", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635969533, "uuid": "7c0099bf-3509-4359-b1ea-079ff93d60ea", "value": "1536:8CWaPqrE3gpMokPF58Ik4kosQFVvSuMaQAbLMv/A+VJHZSiCy8sjYoHb6N:83vEwFkd58IXkOFVvMn66/9VJ4y8sjzm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635969533, "uuid": "fd09df9c-31c5-4597-acf6-c0f87b39ebc3", "value": 75588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635969533, "uuid": "ba4e58bd-ceb8-4fd5-9557-e6567010c0d1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635969533, "uuid": "1063c533-7f07-42af-bdd4-4ac91ccad2b0", "value": "Bill 4894.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e747c886-3c4b-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635905724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905724, "uuid": "119f0bc6-1486-4c01-9920-900cc73daa60", "comment": "Malware payload (RedLineStealer)", "value": "a1ae61f9b4b0964c5752db5bd784715a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905724, "uuid": "84f04d5d-6472-4b34-9e62-fd2271bb81f7", "comment": "Malware payload (RedLineStealer)", "value": "2aa3aec1e0030a3c15a2b44b4b58842e9e5e9d707849250ecd5dfa3d67300126", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905724, "uuid": "bdc174e4-ea0d-4b30-8a71-27dec71cf421", "comment": "Malware payload (RedLineStealer)", "value": "7108a0e327580eb16d62e066363f45da0898aa83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905724, "uuid": "81413c31-72b0-40ce-a513-c9a110ff1639", "comment": "Malware payload (RedLineStealer)", "value": "2a16afab6dfc18cc910a481299dd6214dacdd5fa85aeede657814041bf66e254676aa2c6bef0691ebf764a84b25178a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905724, "uuid": "1102024b-db5f-4c57-b113-6a891b0f7b08", "value": "T1B42623B3A3B100E2E4E18C354537FEE536F666694F419CFA5AC56AC32D214E1E223E53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905724, "uuid": "406d4612-9a34-47ce-b58d-db1715e19522", "value": "908bea7ee71339f1c35ba419da3ba679", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905724, "uuid": "480aae3a-eebd-46e7-b32b-e0fc8be9ea8c", "value": "98304:L7/lLCy1BTU4dCUEgfw9fbMkiIsco7d0z5tG46yuBzx18pfX5y:Nf1BddyfDscCuNtG47wz8P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635905724, "uuid": "87ff4bfb-a5a7-4890-af93-cd56070d3bac", "value": 4605440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635905724, "uuid": "7d9aa2bb-c09a-47b0-88f4-57b67b4e4b36", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905724, "uuid": "9fc46fff-db3e-48e2-ae0f-2a0c7b1be08a", "value": "a1ae61f9b4b0964c5752db5bd784715a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e8300fa-3ce4-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635971180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635971180, "uuid": "5adf6821-b173-4eeb-b727-7eea2892f05e", "comment": "Malware payload", "value": "4c33f093ffad0989cfa4d675920b5b42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635971180, "uuid": "ba0762fd-9485-470b-acc2-3e3287fde709", "comment": "Malware payload", "value": "2aa7af9fb2fa3cf27a54a08d6fa87b1d15e6cc6565d5afe37502b2a729928ce9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635971180, "uuid": "3e46e8ff-7493-4df0-9778-49f74a384518", "comment": "Malware payload", "value": "db4f7fcb3e0275a56675b6ccad1c4c37cc05aaf4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635971180, "uuid": "c70f2987-014b-40be-99d9-5fd2d169dd91", "comment": "Malware payload", "value": "036c18063d189e03444c2195672a92ee1dc2b3f8bf5547f7bbde33beff40fba673e823d6f58fa8898a841b2fbc9e6720", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635971180, "uuid": "481931c3-b1eb-41d9-95a6-55f4b7a21761", "value": "T172947C46B7A44CB5D872913989639E4AF7B1BC214B70D3CB42A0576F5F337E0A93A312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635971180, "uuid": "65489233-5263-45ce-95b5-8369ca0872b6", "value": "13cb415849addf3233fb3f4a6faa9d5d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635971180, "uuid": "dbae9c6a-262f-4588-b8d8-73727872c691", "value": "6144:vd5DexH2V9BKCiNncPaFQXRhZACg3fEVwIfOcVSkPfgaJ91R/yQpE2tU3EfVC9qM:v3DexHseNnWaFAZaOO6PI+p3O2tUU9FM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635971180, "uuid": "db5514c7-c0dc-4361-930f-c1985cd9b252", "value": 442495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635971180, "uuid": "2392c5a6-52ca-4be5-b4bc-6de3d253906f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635971180, "uuid": "f85c7c5b-f7ca-4ee1-90f4-cdc7c1149e6b", "value": "SecuriteInfo.com.W64.Bzrloader.IEldorado.25041.31025", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db13d291-3cae-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635948223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635948223, "uuid": "565a9a39-331c-4127-9835-5691f813991a", "comment": "Malware payload (AgentTesla)", "value": "46621bbce10796a9dddb012379138feb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635948223, "uuid": "9ca777e0-a2cc-4c22-9f1a-548f27c2343b", "comment": "Malware payload (AgentTesla)", "value": "2adb56e5a9f57e11ebacc5ed268aef80edd8db6de54ea81710f17834bcc8eb9b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635948223, "uuid": "c6c93c93-8e9c-4850-8cd4-df751b79cf1b", "comment": "Malware payload (AgentTesla)", "value": "f5a238e0d4b8214ccf49e28611b88ca534003e5b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635948223, "uuid": "8d501824-397e-4e50-b7bf-5ab7e27ab2f9", "comment": "Malware payload (AgentTesla)", "value": "40615df736ce9d3722bb3d483e2bce92fae6120feb8ade90b2a9218119f9edb0fe08464a3df37f8619f7244c49a75d06", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635948223, "uuid": "b1b4600e-d25c-46c7-9ae8-de4af5a4c97b", "value": "T122255D3178E8788CE9D5483044DD69621D9EF9733D9AF15A94E2AC0CD0731836DBEE2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635948223, "uuid": "af797fbf-4d2c-4464-8ca2-99aa14fb358d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635948223, "uuid": "c75e3431-216b-4c94-baf4-2fc8ee6190b8", "value": "12288:xFGKZCc1q6U9bRZ9bRoqJFTP4OPfYZsLZ3EP1W0IWRj3/T06h2:xQKEcqtDtoqsyge3EPc7W9vpA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635948223, "uuid": "026b8223-be64-4a87-9d5e-a5e339d9d5b0", "value": 1042944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635948223, "uuid": "0b1a61c0-5afd-44ca-b066-07c0407b0058", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635948223, "uuid": "b1836572-524b-4ac3-8793-2a49b8b7cf69", "value": "TT SWIFT COPY (6).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9bd5f2f-3c95-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635937403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635937403, "uuid": "4061c8c5-b27a-4a96-b62f-bb01c5bd912d", "comment": "Malware payload (AgentTesla)", "value": "fb3daba7d4fd31d891eba66b129e6ead", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635937403, "uuid": "640d441f-30d0-448f-b57f-7d652133433d", "comment": "Malware payload (AgentTesla)", "value": "2b1e81c6997ac9d8f79565636ae66b7cee7ff1969dbd533041b2da1128cef220", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635937403, "uuid": "f2d59843-1fc0-4b5a-b897-07225fc4742e", "comment": "Malware payload (AgentTesla)", "value": "c258ebd9fada289b542bef13a4b22a0986fc5680", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635937403, "uuid": "9d509c02-5f11-4232-a5cb-28464261a5d7", "comment": "Malware payload (AgentTesla)", "value": "1becbf21ebfac7420609706040a66bb53cf031055fba7d0ddeda4b6fe246045c222ddbac88a4d5e20df40db7363647a8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635937403, "uuid": "d5b329e5-f515-4d0a-aa25-e665bef81dea", "value": "T167D4CE91E2C84AD0D62A63F15CB3B71027AABD3D5432DD2D2D9FB1964A333524A36D0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635937403, "uuid": "af4b09e2-123c-434a-aabf-511202e10905", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635937403, "uuid": "aaa53a0c-bae3-4a6b-8fb0-1bac28f42e93", "value": "12288:SfIbw8eGn9mprJiKax0QDdC8QyElZ8zBrS8l+q/q1M:SAbw8eGnkcRDdVQyElyzFS8wq/q1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635937403, "uuid": "9c47f8f5-bb74-4bdb-8a0f-809355be8099", "value": 644608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635937403, "uuid": "225cf23a-9fa1-4d69-a60b-b70623a27bbc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635937403, "uuid": "084b42a8-4c22-4f51-a192-bb19b1191536", "value": "Purchase_Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8178b4b7-3c73-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635922733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635922733, "uuid": "0ee7784f-d273-4a49-8c04-28239425fc6d", "comment": "Malware payload (RedLineStealer)", "value": "4fb120e5975e3a7b4c59a1cf7b8ebc75", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635922733, "uuid": "0459d5f7-60c2-4ecd-89b2-571b05e7b256", "comment": "Malware payload (RedLineStealer)", "value": "2d1fb307892909f07593797b2fdf7474ece2ca8d27fb5b54dfb4439c880e8143", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635922733, "uuid": "b9603876-324f-4b49-8078-0a0801cbe74f", "comment": "Malware payload (RedLineStealer)", "value": "067688550fbdef9cbc67baab32531a248515329c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635922733, "uuid": "47cb711c-9f92-470d-a215-b0ea2d10630b", "comment": "Malware payload (RedLineStealer)", "value": "90fab2ee264ea9edc17d95cad6eac69f611cba5bfd8b24c78d57bbe557ccc9db1a565cac5eea71670e11a3fdd292fe65", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635922733, "uuid": "98f83481-2b17-4c0d-a29f-12352f4d8c0d", "value": "T19D74F16176A2C471D4E3153044F0BBB49BBFB8721474655B2FA4563E2FB02D08A3EB5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635922733, "uuid": "1c7233ee-921d-43b0-8183-ffd6b450247e", "value": "2d072324798956717a479868e71b5c9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635922733, "uuid": "3a436e0e-0a1d-4b62-b123-3e8fc005a786", "value": "6144:yMYlQUYFPySR/4bHfg9FDsiP4nld5ncKq7su/kRWBw+Tpi3OV37hGPVpD6q9Eua:MuUIBYYHDs5ld5crYewgrhGPVpD6q9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635922733, "uuid": "be8d9f5c-9425-4085-a67f-3692cc1ea6fd", "value": 339456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635922733, "uuid": "e4b82f56-b41c-4f11-88d4-3155f41d9268", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635922733, "uuid": "da621ffe-305f-423e-bc98-7b7b72e3eeb7", "value": "4fb120e5975e3a7b4c59a1cf7b8ebc75", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f619a81-3ce3-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1635970645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970645, "uuid": "0e0abd07-6592-442f-909a-3a9f81ce7ac0", "comment": "Malware payload (TrickBot)", "value": "00af0f44a7eeaf8cec9d8ae9a5902ade", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970645, "uuid": "3abeeddc-0830-4888-990f-16c8d75c75f8", "comment": "Malware payload (TrickBot)", "value": "2d3d2b64b59c287008adb36eeec22c5876df3b6a48ca6d1ee1e3bb7a305cf70a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970645, "uuid": "4079a364-b6b1-4dea-8fc7-d4aa131d5555", "comment": "Malware payload (TrickBot)", "value": "68ea1ea5e7534ad7e3abb68447c26c47eb265367", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970645, "uuid": "57398a3f-7266-4870-80b9-d4fbd5f5b609", "comment": "Malware payload (TrickBot)", "value": "af6a184950904923f545b70d9bbd00cb8d085d1307547990c9f8ab28562c811f2925bf78afd7a7a65c0893a7bfb71902", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970645, "uuid": "47229f47-e224-400b-9362-846ee0cda77d", "value": "T19215CE567DF0C07BD2A691710EF4BB7A62F999205B274ECB27908B1D3E31CC0563627A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970645, "uuid": "593db8e9-e48f-4621-83ef-094ffec0c7a0", "value": "5c272247eecddf77307138917800d024", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970645, "uuid": "fe91ee0f-f7d1-4004-822b-155070375f26", "value": "12288:y0qKG+wPRvCKXb4+aliMESpaPyyzY+NSbILBzLqkRYKpD4rSs1l:4P5Xb4+wiMES/XstzLWu4rSs1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635970645, "uuid": "c624b658-af4e-42d8-8cfd-63bd7c502fd8", "value": 880640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635970645, "uuid": "c4d9e3cf-6bd2-4c42-86dc-45ff677f02d1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970645, "uuid": "d2134bee-73d9-4913-a892-215f3d9e1cae", "value": "00af0f44a7eeaf8cec9d8ae9a5902ade.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66e336e4-3ca2-11ec-843c-42010a9c0014", "comment": "Malware payload (SilentBuilder)", "timestamp": 1635942875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942875, "uuid": "ff549c00-2f9c-43b9-9c97-339c2deed30c", "comment": "Malware payload (SilentBuilder)", "value": "b2af619fdc37ffdf6732eca16575c77e", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942875, "uuid": "d980314f-0b14-4c0f-8276-4253411ae224", "comment": "Malware payload (SilentBuilder)", "value": "2d6f67a5b1096faf9a4a1e59f88c4ea58bc96dabdbe497488ce498e3f3216737", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942875, "uuid": "29989802-55ed-4537-ba7c-48e914e7e0b3", "comment": "Malware payload (SilentBuilder)", "value": "2c0005e5613ed1398231a5d641244e86b6359d5c", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942875, "uuid": "1ed2ecbf-dbb5-495c-b891-951c63bf1e50", "comment": "Malware payload (SilentBuilder)", "value": "1c77a5fc24cfd29251f7dd3bbc7eb06f3bd1b6572587a3215d055062bf3b32858b8d2420d2aa0412743dd7590cdbf41c", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942875, "uuid": "edff9bbc-09d7-4c9e-838b-18175be1bc54", "value": "T135935A42BA58D86EF525C77148EB53A5B322EC305F6B0B872665B3203FF99E06E03547", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942875, "uuid": "5a6bf834-785b-4d4c-8750-a6d7c0804c92", "value": "1536:i5Kpb8rGYrMPe3q7Q0XV5xtezEsi8/dgw91vrVmxJiME2GhdD52lZPFu1AOgS+li:0Kpb8rGYrMPe3q7Q0XV5xtezEsi8/dgu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635942875, "uuid": "83a8a865-52ab-41c1-9d97-e8ef464579aa", "value": 90112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635942875, "uuid": "5c96824d-794b-4c03-9373-653f51e73f65", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942875, "uuid": "6aa9b0bb-3d5b-4eff-8108-62f6d68c7715", "value": "SecuriteInfo.com.Exploit.Siggen3.21609.18897.16379", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f1354b5-3c52-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635908609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635908609, "uuid": "f7d8f8ae-bc35-41a5-bed5-d781838b0301", "comment": "Malware payload (AgentTesla)", "value": "202171ec83375d0c3f46b097070fd96f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635908609, "uuid": "21399a47-fe2b-4dab-9d6b-5b1204ed8d4e", "comment": "Malware payload (AgentTesla)", "value": "2dd733b3f00d671be39cec6e8bd06234763eb8198e527663654df0f75265b9d3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635908609, "uuid": "1c02de8e-6b9e-4c79-9213-00744379e9e5", "comment": "Malware payload (AgentTesla)", "value": "b17793ac828dd390523f123b9bbd593cdb9d22e5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635908609, "uuid": "1a28e323-198b-4d76-8a4f-ac473b67e2c7", "comment": "Malware payload (AgentTesla)", "value": "8dde9af3ccc014e8516de73032a7be776dede104d2ddc4941f7ddb9cd5a7a8515358f28c23c4b4f2fe994ae02e5c8790", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635908609, "uuid": "74577b53-ffcf-4326-b966-6861b9d2a47d", "value": "T12F52E911D36CC37DCA9B0BB9602246910A3BA3457171CAEA8F7CA51D3F27B5E45227B4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635908609, "uuid": "dbcc119e-8779-4000-9e20-8ba06efdf7aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635908609, "uuid": "6c14f0b4-ed80-410f-899d-7fcb500f8725", "value": "384:H5yazKRUSGyMQUfuVhq8PHQnb8MLVbVJu0Q:HgahSczfyRPHQb8ObXc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635908609, "uuid": "1704bf24-2b5c-42d9-91d5-9bccd18c0a5a", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635908609, "uuid": "43ae9d18-04b4-4333-81f1-78733b57515b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635908609, "uuid": "c88c44a6-cb57-4e9a-8616-179ede62bdc0", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cb464db-3c79-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635925302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635925302, "uuid": "12a74ecf-b542-4596-a5be-a9a796e11f36", "comment": "Malware payload (AgentTesla)", "value": "b3a30c4b134e19ebd67bd673d3c5fd6a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635925302, "uuid": "2721799a-7771-45ae-9d83-50ef475a3446", "comment": "Malware payload (AgentTesla)", "value": "2e0a3f71d1f8691a777a6a9b21b40a9ef4558d20d6d53f66653b3bc49b63ac06", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635925302, "uuid": "4b5273a5-357f-403a-970b-644b55803ad7", "comment": "Malware payload (AgentTesla)", "value": "cbf629061d534f401490f6d150c1c2c4e5d6e67a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635925302, "uuid": "34a50b94-288f-4a1e-a4c0-9b13bcd08f97", "comment": "Malware payload (AgentTesla)", "value": "5e217cd0d8b85405b835e01b1a42c15669d97d467d62f29379d6e0e3610b04ac06084ed6ebaa77469520de27e2a441cb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635925302, "uuid": "f5e50d67-16c8-454d-91c8-3653d236d2e5", "value": "T1F1055920B75D8989C6FD3734CF25D1B017A16C6E2A10CA1924F43DFFBABC61366316A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635925302, "uuid": "7ee587c4-f5ae-42e6-ad4f-daaf4d8e0d10", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635925302, "uuid": "81626e8f-f477-45ba-962e-34e48e5f44f1", "value": "12288:SP3KCJwsqSF7Fcv3dDR2+Va8M7kaB1AAJ11kyuF7EzqZEJNLTeR0:IusHFpcvNDM+Va2aD11kyuNNZEnSR0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635925302, "uuid": "8270f21f-0f4a-4db8-ba8a-410c83b281b7", "value": 847872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635925302, "uuid": "d585bfd5-daed-404b-9115-56e98864c9fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635925302, "uuid": "55ad14de-d8fb-40f5-995a-275b0ab6862d", "value": "Specifications.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c9ef8c2-3ce3-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635970882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970882, "uuid": "238baa15-78d1-4b4f-a88e-cefd9793862e", "comment": "Malware payload (RedLineStealer)", "value": "e172ba4157323a85e397e762eb370bce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970882, "uuid": "17adc8b0-0f38-45cd-8989-e3301fc4089a", "comment": "Malware payload (RedLineStealer)", "value": "2e0abf93a5b5e789f549c22f12f3c8442fc08aa63d7e1a70978e0f42f563418d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970882, "uuid": "e4d13e46-d08e-4789-b667-8771ca79bd3c", "comment": "Malware payload (RedLineStealer)", "value": "b50a68c7f999e9f0c5de7df7b73a0cb2da2ce970", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970882, "uuid": "74df2939-0297-4b5b-8998-8545db511c31", "comment": "Malware payload (RedLineStealer)", "value": "19e872fdd58990aa5124e3edd1b54d49cdfa0bb43791098916e0b4fb5087782c798a06831460101ee584b591692db5f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970882, "uuid": "465e27b4-3308-4ad4-a6d4-594c019ebd07", "value": "T11084BF00E7A1C034F1B212F84A769269B53F7EA1AB3980CF12D516EE5B789E1EC71357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970882, "uuid": "aaa93f47-250c-4bb7-8385-a4b96e46bd59", "value": "e024db68009cf7f32dd817cae1867bf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970882, "uuid": "967c0c84-1946-405e-a0f3-1ec8f65511de", "value": "6144:GgkXZ4Uk5oZo9kVc9PFrZO52jBaFgE/9xmt8+0sprDZ:GXGUkN9dO4jBaFgEbmt8dsB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635970882, "uuid": "b3ee4ee6-e6ae-4022-b562-a2dbebcf77eb", "value": 407040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635970882, "uuid": "4daf2c0e-e192-4a05-8e97-13ecc06d8c87", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970882, "uuid": "65865df7-8531-4e04-aa97-d4545676ef7b", "value": "e172ba4157323a85e397e762eb370bce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97ae0ae4-3ce2-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635970444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970444, "uuid": "a1e14dc3-2be2-47aa-a912-a358ea922704", "comment": "Malware payload (Formbook)", "value": "fe106b61ef944f0109bf0b220a2f8325", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970444, "uuid": "1070630f-19b7-4b1e-9b66-b8b7550531a9", "comment": "Malware payload (Formbook)", "value": "2e1dd4b7b29ab0e8fd9b9b7236dc1d9620639e44a1c14a0853ce1d25dc1d6967", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970444, "uuid": "eb75ecc1-86d0-4167-b645-f0489dfdc5ad", "comment": "Malware payload (Formbook)", "value": "626ca889135b8c91dd82c8598dfbd97fb1ad123d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970444, "uuid": "493bd085-2b77-4552-85bc-710a2fd44ef2", "comment": "Malware payload (Formbook)", "value": "3c0acbaa0cde6f9152cba74773a880c19aa6e4d0b72e0ce47e31e2d13f3cf9acdacf288724aac48d7397db0129301f80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970444, "uuid": "e70ee422-2d58-4f66-8dc0-fefe856c7788", "value": "T117A4F152315D8B11C3ADB7F124AA9390BBB57D3E2442E64E2ECA72CA19773418FB1D13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970444, "uuid": "457682d8-fa89-4e09-a6a3-dda9af633777", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970444, "uuid": "9af7cee0-d62e-47a3-852b-9f47b1e51646", "value": "12288:mAIbw8eGf4VfZ8E+OjhtLlnQ4ZJJSwpAqefZ71:mjbw8eGf4VfZ8GPlnQEAqefZ71", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635970444, "uuid": "05b6f1a6-0d5f-48ba-86b2-a95c341855c5", "value": 471040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635970444, "uuid": "bc86703b-890f-459c-8470-7edaf48334ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970444, "uuid": "8284637d-d003-4f5a-9f18-2e7586f820de", "value": "fe106b61ef944f0109bf0b220a2f8325.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0408ab4f-3c49-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635904483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635904483, "uuid": "2643fb3d-59c8-428b-abde-6a64866765f9", "comment": "Malware payload (Formbook)", "value": "b398e58da3602e2abb9ebef7b9a9f459", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635904483, "uuid": "eedd1bfc-f57c-4555-8f5e-a7b11054cdfd", "comment": "Malware payload (Formbook)", "value": "2ee3982770f09899c595a7f26fd3b9c50ac0501014debcb85574faaefe4e1a15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635904483, "uuid": "e443ffda-fdd5-4f48-af76-eb60713f745a", "comment": "Malware payload (Formbook)", "value": "180558b950c87a5c852e51a816d8ca090762f20c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635904483, "uuid": "2edcb1a6-3f05-4aa0-82c0-779ee55f60e2", "comment": "Malware payload (Formbook)", "value": "45cd815f59ccdf585f2b16c14cdf71f8c5d329dca7a7c54348bee10f3d3e99fed740a9a483c0456b996a79b604776e64", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635904483, "uuid": "a9be6dc3-3a2f-4061-a8e6-138514511e15", "value": "T193458F7178A8788CE9E5483040992D620D9EFD777CD9F19A94D2AC48D0731836DAFE3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635904483, "uuid": "ff330d63-a37a-4e62-ac25-28a5f42f3919", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635904483, "uuid": "4fea2f0f-802e-4643-a9a6-e49eddeacb63", "value": "12288:B+c4tOWOp509bRZ9bRoqJFTPSdZRGoFLZYKqq0WL4MXjd1An/gPawNmlhebR:Br4EWOQtDtoqudDGQeVWLLw/gPai4gt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635904483, "uuid": "95468dc4-0a18-4524-b06c-89ee22430c1c", "value": 1198080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635904483, "uuid": "d26aeac4-543c-4a31-aaec-343d85efb8a2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635904483, "uuid": "ce731d61-0748-4ae6-8265-c6d80d050522", "value": "PO_208045621.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1f75d35-3cb1-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1635949497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635949497, "uuid": "70bd5f4a-4d73-479d-b093-895380868758", "comment": "Malware payload (Dridex)", "value": "569dd0b1ac6f13f30b45607323691fb7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635949497, "uuid": "e4b8d1be-72ec-4807-9054-55c418386fcd", "comment": "Malware payload (Dridex)", "value": "2ee523a8460bbf4ff52f41a6a4136ae43ea3ed8ee9fdfce3b525c156b0463212", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635949497, "uuid": "58bc5a2c-d872-4b57-8b89-4bc7b2db0969", "comment": "Malware payload (Dridex)", "value": "1cd5125bb6fe5e632763a870ccccd2ceaf2b672e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635949497, "uuid": "a12fd8c2-baa0-4932-900d-5a2cf6cc84c5", "comment": "Malware payload (Dridex)", "value": "016c1b5b9583b2d6f49c802b3fb0a0864e64e61831050d59eddd770b8cb0e6543b313a0ed83178413aa3d1e0d425bb8b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635949497, "uuid": "d76faaa6-9953-4942-9000-55cf0bc6f303", "value": "T15553E15F9719285BCA1D6E3F8B0C9CF66C1E70F9CC85D94D14106B0502EE1C7EAEA127", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635949497, "uuid": "a9ad9e69-17e6-4b40-a860-fbd113ca923c", "value": "1536:8CW+PIbZ853SAJbp2SnmJLSSZyOk3fMrW:83/bC92VJLSSZWfMrW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635949497, "uuid": "7bcdc8cb-89bc-4061-863f-7f7a8cb124f8", "value": 60719, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635949497, "uuid": "324fe069-c58b-4c10-96f6-f2d5b9e4c2c2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635949497, "uuid": "2aed8c55-810a-4f32-ae00-9ddd9d73b2b1", "value": "INV.2688.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14ebb910-3ce2-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635970225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970225, "uuid": "d14d2873-6f46-4af0-8c17-61bff6f0aa48", "comment": "Malware payload", "value": "cb68333c4366b7c53be4525f2387c736", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970225, "uuid": "2390781b-43d6-4ecc-86c3-66a8bde5be2b", "comment": "Malware payload", "value": "2f500db4f4263c9f7a131d5795e32d7400f8bba38fd2c84b070c0bc721c3cde2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970225, "uuid": "78699faa-2c24-4fba-97f3-59631541936c", "comment": "Malware payload", "value": "ae41f73f44fff07e098f98de1922a7bf50b9cd75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970225, "uuid": "0fe55b20-9ff3-4aef-baf5-58a58d5e76fa", "comment": "Malware payload", "value": "772e33170c85fd34edcbf212c55c21ef9274a80bab50979835fc4857dca2d289c68c71d1b28fa9eeea97e4562459fa38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970225, "uuid": "a26c4019-914a-4e77-bff7-e8331c4a46cf", "value": "T190A4D020BBA1C036E5F212F84976A269B93F79A16B7850CF63D41AED1B746D0EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970225, "uuid": "f8c488a3-4690-4818-a0ee-39e79f401e20", "value": "c672e75b8a5cc514b6d1aaa38159c5a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970225, "uuid": "c5ebb6b7-8a0f-4d84-8476-3f2de32ea6fb", "value": "12288:tKk28GAPp6PHHo4Ct6CD5dINBPr+F9CkmoB9:4H+PpuHzK6ClmHeb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635970225, "uuid": "358e458e-eb6e-4cd8-b7f9-ce7c3520735d", "value": 482304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635970225, "uuid": "6fbb8fae-7d5f-431c-aa11-13c9801e2ae0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970225, "uuid": "91001c2d-c2eb-4dce-a763-4d75e884b2e3", "value": "cb68333c4366b7c53be4525f2387c736.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbacb119-3c66-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635917247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635917247, "uuid": "6c5c5965-7622-49f6-a504-182b977d928c", "comment": "Malware payload", "value": "0aa961f14379c06a752c4a96bd114a19", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635917247, "uuid": "e0d4fd98-9215-4576-a27a-e915701a0f28", "comment": "Malware payload", "value": "2f6fee6e86eb56008a9ecf9831bc917956a354c68e9c7571b506a1e6bf88e22a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635917247, "uuid": "da42d7ce-7430-4a6b-bad7-026c62d9ca62", "comment": "Malware payload", "value": "66521c0a9a354c0abf3e04ad3ac72d01075c52fa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635917247, "uuid": "6815118b-634c-44d0-bbab-d94d3b48c97d", "comment": "Malware payload", "value": "60aaf09108a95af2c4d18d6ae6b280e79318c32b35e1baf0ea2ca37f7e9943d42c9c18304b2318f4c18e0d12dc75541c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635917247, "uuid": "26733466-af61-48a2-8885-a52f0e0c8fb0", "value": "T10BD6338AEE9DD9F5FC7504730A5B86FC04E31EE54DB0E44A4781F6E6B43A86F0226934", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635917247, "uuid": "90bba57e-0585-484c-b4de-f369b35e0d3a", "value": "ffe3cc63e5a1efb4d2f4cc004c584646", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635917247, "uuid": "2e221e69-36a9-492c-a3cd-08da5644e8b5", "value": "393216:dLOQ+wQ9Ed9cM6wVSUeZKy1FXJsVxBLz5:dKQ25M1EEaF6LN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635917247, "uuid": "d561b51e-95df-4ed3-b6db-aa8f7b482e3e", "value": 13096137, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635917247, "uuid": "9074a60d-2061-47d9-bd76-4fc9d77427b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635917247, "uuid": "d0fd00df-f54e-411c-b449-a2bb2e41d2de", "value": "0aa961f14379c06a752c4a96bd114a19", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97c6fad8-3ce3-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635970874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970874, "uuid": "23de6ffc-1cb3-4431-8c24-fc4809cfc5cd", "comment": "Malware payload (Formbook)", "value": "981dde46fb27b7e5173e8ddd1c1ad514", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970874, "uuid": "4cabf3a6-7259-4a60-a622-4c85e93af473", "comment": "Malware payload (Formbook)", "value": "30191d460ae42d2ed454fc5b005f01b28de09448fa4169521e2540356d49d9f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970874, "uuid": "412d8c65-c8b5-4a32-9983-26f4bc1d92bb", "comment": "Malware payload (Formbook)", "value": "d1dbebe5c98efe20a880ed0c8ca71e989af0c7cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970874, "uuid": "6bab62bc-697a-4326-b4ac-ea3dc2b28262", "comment": "Malware payload (Formbook)", "value": "09c7d117051ec994d0ed1da604404d3210c5049b1a944d9fa0f735ea9287a8e37a8ff70933121641997fde072f4066b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970874, "uuid": "dc8d462c-f8b1-4760-b00c-a49505baef6e", "value": "T1AC054930B75D49C9CAFC3734CF25D1B017A16C6A2910CA2924F43DFBBABC61766316A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970874, "uuid": "a1549091-fd9d-4c30-b267-56402d24f3d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970874, "uuid": "f2be3c65-15e1-4268-b542-5c855ba40580", "value": "12288:qsFtVq72pTb69MXsGI8Ux/oHmZh1YyuF7EzqZkJtLTPx0:PF3A2p69MXsGI5loo1YyuNNZkHbx0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635970874, "uuid": "75b0bc39-4d2b-443e-9308-eb1991837057", "value": 829440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635970874, "uuid": "cf2a03d9-1705-45c2-a419-099afa03939a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970874, "uuid": "73069848-fdf3-4a0b-bb7f-9f0f51e3b73c", "value": "981dde46fb27b7e5173e8ddd1c1ad514.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5813e02f-3c95-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635937266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635937266, "uuid": "7267cd09-30ba-4ce9-bcfa-6092ec227991", "comment": "Malware payload", "value": "26381599c30de28fb05bbf19cc89d8c3", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635937266, "uuid": "751a3aa7-1df2-4dbc-a383-44634d84ec34", "comment": "Malware payload", "value": "30b68f5c6c7edb5457e686090ed74d7cc9b19270767396676fb11145d6c3b145", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635937266, "uuid": "6f02830f-4df1-4dbb-bbb1-6bf590115650", "comment": "Malware payload", "value": "f6601a95aa3b458e5c82c3cd700a7eef6e76cd96", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635937266, "uuid": "c27bb701-444c-4fb1-8abc-ad85985a7498", "comment": "Malware payload", "value": "ae6cbace7e3e57102406fec23309be3618dc81dc5debfb89863a41ae1b8648176f402cef5cc20aefaf35ab22ccd96828", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635937266, "uuid": "7e3f267b-320a-4a59-a2ed-6f4a8b7f3f51", "value": "T16C33F2DB6B19ECDBBDBD8B691DA5B281C6E3D37A7A4CD8427816DD073C50B440837A20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635937266, "uuid": "2db9e530-619e-4145-a2e6-4d0d8af632f9", "value": "1536:5/rkTuU8Hl3T5f9QbLpK9tXKR+hNfixu+BLs:h68R5Fy0nZ+ds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635937266, "uuid": "45ab939d-78b9-4ab2-bda5-89937f343807", "value": 50241, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635937266, "uuid": "d2042a1f-2efb-4289-b9da-81975d8a1614", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635937266, "uuid": "ca2e8d5e-a6b2-42f2-890e-64813a859377", "value": "minusquod-2865222.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8e09356-3c86-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635931094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635931094, "uuid": "f71ad2b7-4eeb-4106-a167-f7ca11070788", "comment": "Malware payload (AgentTesla)", "value": "6fc334ae1660e18bcbaa20842697e41a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635931094, "uuid": "c5c24db0-7a41-4f5d-ae8d-4f67d60681da", "comment": "Malware payload (AgentTesla)", "value": "312178668cd1a82d426eda21e66204dea3543efae0d15ed0d6bf374db6b17d25", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635931094, "uuid": "5220742a-9c5e-4d8a-ba4d-f30cfdbbb45b", "comment": "Malware payload (AgentTesla)", "value": "2e5e5484cac10c5ee8b115e40e3d212c20b198d6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635931094, "uuid": "43177a3a-1d13-4bf8-8130-c66cb14f1f0c", "comment": "Malware payload (AgentTesla)", "value": "09e00777b0d62c67e73555dc36decc70a02b1af32649ef248bf5b8ababa25174a38c7288c35b00a12ef7c4a773483c87", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635931094, "uuid": "2a1e3ad9-14d7-440c-8d51-d97683d4849b", "value": "T18FA4F046322C9B25C75CB7F660AA9310BBB47D3A1453EA4E2DCA31CE09773429E75E43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635931094, "uuid": "d41ba8e7-0a0f-4ad9-a2df-f83434510092", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635931094, "uuid": "6653f31a-0226-469e-a220-98f6eb383530", "value": "12288:bTIbw8eGsllDojA8gGSS02CcY1RKcVB5y+p58ynhU1:bkbw8eGiDoj3gf2CcWKu35p59m1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635931094, "uuid": "433b1d35-a6f5-4e2f-abe4-0075f860a54f", "value": 479744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635931094, "uuid": "84958307-2fa0-4116-a1e0-69c5b10e9836", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635931094, "uuid": "6c467a9e-7712-458a-9c02-e9aabf7b7c4b", "value": "bank details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fcc6bc6-3ca0-11ec-843c-42010a9c0014", "comment": "Malware payload (Kimsuky)", "timestamp": 1635941896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941896, "uuid": "1aa955f7-bdf4-46a3-8b1a-359ff6694adf", "comment": "Malware payload (Kimsuky)", "value": "c40afa6d15db9bf2ea5b1a4fa447093a", "object_relation": "md5", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941896, "uuid": "451c5d0b-21f6-4820-8198-fb75ec876e73", "comment": "Malware payload (Kimsuky)", "value": "3202018adc13fd9e0b2611984c46e70904fa880c76daeb3430e8432924434f4d", "object_relation": "sha256", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941896, "uuid": "1d05cb8a-58bd-4123-90d9-a843495e2852", "comment": "Malware payload (Kimsuky)", "value": "6d5820850fd54283e0cd2cf85e72ad39f581a8d4", "object_relation": "sha1", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941896, "uuid": "d7d6b651-9581-4093-b93a-6f3fa8fcb36a", "comment": "Malware payload (Kimsuky)", "value": "ad589d4aa9f605012d6cf72cc8653a6c4ca9f6204cff1d35257f53aeb21a5fc38b7f15378969c6842d4db9ee53d37a5e", "object_relation": "sha3-384", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941896, "uuid": "05576fe3-0772-494c-be01-518cb23d8524", "value": "T1F915237B13B941E8A30853F0D2D0A8C09F9463C7695657731ADCC6A03DA882F5B6BDBD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941896, "uuid": "e9ba22e1-7d52-4fc4-a802-99e731a60029", "value": "24576:HZgB4pQZN2w9E1yTDHkjYFGIoobsaw6Q4DyT:uTZEwT4czwa9K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635941896, "uuid": "6d31b88f-fd33-49d5-844f-8866967ca2ea", "value": 918665, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635941896, "uuid": "b35a53f1-1437-4f77-ae3e-02f1e70ba78c", "value": "message/rfc822", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941896, "uuid": "769a800c-bc1c-4bcf-9993-3ff359a9d69d", "value": "3202018adc13fd9e0b2611984c46e70904fa880c76daeb3430e8432924434f4d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "450d6e9e-3ca0-11ec-843c-42010a9c0014", "comment": "Malware payload (Kimsuky)", "timestamp": 1635941959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941959, "uuid": "62aaafcf-7c8f-454c-b8ce-2281ca841b2e", "comment": "Malware payload (Kimsuky)", "value": "caa1a847d0ae3f3d647474f5db9069bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941959, "uuid": "268f6868-16a7-4f4d-a5d7-66f8cbfbd6c7", "comment": "Malware payload (Kimsuky)", "value": "324b2e2c0471e49c7cc07725a7d748041479714d265ec6dbf386edd3f619f03c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941959, "uuid": "95e26fa5-fcbf-4808-961e-f0c9ee2e2a10", "comment": "Malware payload (Kimsuky)", "value": "2e9175a3c23582d4da1368c044ffe565d5edb0f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941959, "uuid": "c0979912-35c6-4143-85b9-d6dfb8de1da6", "comment": "Malware payload (Kimsuky)", "value": "834d8114a40a8a20ae264bcef8356719f6ca7b1a131b34699f0ef1b3a4d4f7cc000a3b3088fa680884ecf079503d482d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941959, "uuid": "10f4116a-2279-4a18-acdc-c6d6c63af79d", "value": "T123945C2DEAD501B9D0B7D134C8F34983FA713C0A27799DAF13C406661E63F92AE79618", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941959, "uuid": "b0cb3ec8-5b1a-43d8-8848-914abdcd5910", "value": "6b93e6ef151a06a5df1eed09ff6fdd16", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941959, "uuid": "0afbb891-0563-4533-a161-3350b3928706", "value": "6144:HKyiGktmGPpaJfQTISi2IVmImKUvsVM9dzohhlUps:/qDaJoTIBbVVOlzoM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635941959, "uuid": "9b9fde2c-91ce-473f-8ed8-2ba5e5ff4aa7", "value": 414208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635941959, "uuid": "bbf843e3-f805-40fc-9cde-c7b20dbaf9d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941959, "uuid": "73cb9154-839f-430c-90eb-0680e1193710", "value": "324b2e2c0471e49c7cc07725a7d748041479714d265ec6dbf386edd3f619f03c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e7eefba-3c78-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635924929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635924929, "uuid": "12879994-defe-4b97-8b24-6b27da9cc770", "comment": "Malware payload (AgentTesla)", "value": "8044fec1ffc438bfdce390575020f0b4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635924929, "uuid": "a5f6b778-f947-4a20-adf0-c101023975dd", "comment": "Malware payload (AgentTesla)", "value": "3322cc83392fe39d3d801795f74e6d12310e9ead0939fa1d28473c7d5b6c5eb1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635924929, "uuid": "6d3ff5ec-d4f2-4d28-a373-76e4152ace8a", "comment": "Malware payload (AgentTesla)", "value": "87cfd915653e8baca60dafc171be1b0576af5794", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635924929, "uuid": "363c7679-cce5-4295-bb4f-9c0a8d2d193e", "comment": "Malware payload (AgentTesla)", "value": "7677174b8533b9ca8ee7a5a4081de396ae2b0a3b049ea8526d8e0ab4bf628a97141eaf93638b45ac76e8387ae838078f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635924929, "uuid": "398a0e10-5141-4900-ba10-a33fb01f0a77", "value": "T149C1BF59F4886E8D17DE7C1C3B866498F826F0E17187EA7977B41B3438D218C6C83803", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635924929, "uuid": "02dd121d-6738-4216-831c-5678f32f696c", "value": "96:h7thmYrAN4AEYFMoxVAbvgfjgQluSzlNKaRkw++g8U5+khsjq3A89SQx3wdIa//O:h7/nrABE9ozmOjgQluSzTow28A3x1xAC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635924929, "uuid": "9c2cebe0-f23d-46b3-9bed-4d1d2d37ee4b", "value": 5965, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635924929, "uuid": "1fc293a0-81f6-4ba2-a947-4779c47a8f37", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635924929, "uuid": "e46ce784-9a78-461e-bbdc-a2c8fd5a268b", "value": "Purchase Order.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41cb10d1-3cdb-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635967294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967294, "uuid": "4abce5aa-2718-4af8-ba62-81d99bc5c532", "comment": "Malware payload", "value": "ffa9201f2af86734cdc70c17144c3588", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967294, "uuid": "4c1200e9-f652-4c27-8745-ddf9ea4de5f3", "comment": "Malware payload", "value": "335b432faec17d923088621b9ef931e5b2d05c44cbf75dc8fe2fd6db238b7eda", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967294, "uuid": "1cd6d952-9daa-4b24-9671-a0919ef39f2b", "comment": "Malware payload", "value": "22aa413a3b4472da22f576c03da8028793584010", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967294, "uuid": "2f7e16aa-3047-48d6-a069-c548e1e56a04", "comment": "Malware payload", "value": "88d25f49db915c32a1e9491c62588b749788788bac5ee74bca382c219e9980cc4e76ed85e5cda5ee41cf341b3fd49745", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967294, "uuid": "e7635eec-80b6-4627-8c72-0f64528112bb", "value": "T19A74F111B6D2C077E1E795308674D6300BBB7A31187D49AFE7A4367E0EB03B14A7AB16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967294, "uuid": "0c09bc47-d31d-41bf-934d-9e74dc75cec1", "value": "adc309f4258aa7e488ca350060834acf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967294, "uuid": "3ae93ea4-c2c0-4ea1-a060-1406d9593f52", "value": "6144:W0EcZ+N66eTrtDGPxeA2LEs6Jip5GqH9op6YJWZfYA8Ie7Hp:PvZ+PetO4EsvjH9opD2z8IC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635967294, "uuid": "9594592d-cc69-4f43-8b34-cb19fa6eebea", "value": 361472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635967294, "uuid": "a635ce26-a1a5-4a92-afbe-380e3bcdda6f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967294, "uuid": "71c723a8-222a-4e9d-a045-9322a9fef4a3", "value": "ffa9201f2af86734cdc70c17144c3588.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c7c7984-3caf-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635948333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635948333, "uuid": "dd50612a-5d1c-402d-84d9-4cb3b468ef79", "comment": "Malware payload (Formbook)", "value": "a2f208fe902bda1d7db8433e90277136", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635948333, "uuid": "7e3b01c6-4bdb-44bd-a663-1345f1d724c0", "comment": "Malware payload (Formbook)", "value": "3385d2ea5b6acf9926ae2f0df8179bc35a0ff85f552a79c85a7f11faebb91622", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635948333, "uuid": "ad690458-0408-4c4c-8ff4-fa07aa231846", "comment": "Malware payload (Formbook)", "value": "d8c386f37550d52ec05e070a34e8ea442caaed6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635948333, "uuid": "59b8b37b-b7bf-41b9-9722-5b4e015e2dd1", "comment": "Malware payload (Formbook)", "value": "ed127e54fd4343935004e638237b2b5637b23a4be8c0a05951bef8fd649bfea22d5a1a50d8173a73c6b7b39d5cf65e90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635948333, "uuid": "89a0d907-6f7a-4998-9f5b-fe55b91ea32e", "value": "T158541221F1E880FAD5DE4A3018776E79D33F8749B06464470778ED6A2E324D6D62BF82", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635948333, "uuid": "c5f0da0b-a57e-488a-8e9e-ae5afaeb8141", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635948333, "uuid": "7d1de702-73f2-45d8-83bf-26546032849b", "value": "6144:2BlL/2fVV60knc/YE/C9PH/84kEN5G8MptDRTD:U0G0knc/YEq0Rm5FMpHTD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635948333, "uuid": "4c146544-dd62-4bd6-809e-9072ed82c235", "value": 297945, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635948333, "uuid": "8ff762f0-9d33-4e7b-b7b8-35c89f880564", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635948333, "uuid": "0856eace-b4e8-49ba-b526-0524bd7e07f9", "value": "xkp0987654334567890.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa169199-3cd9-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635966610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966610, "uuid": "a7a68c13-1d37-477b-8a7e-f69905e21a83", "comment": "Malware payload", "value": "2f9561978ce3753fb6896a46b0260f6f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966610, "uuid": "5cd6e021-fd19-42eb-9509-2ad7bee4d885", "comment": "Malware payload", "value": "340e5a65a7a2cf967f34080f7710b84ac5c3eb5f7aee8122bc8f3d0e9f4577cc", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966610, "uuid": "e74fef9c-1485-4ef0-bfa8-43b84631cefa", "comment": "Malware payload", "value": "5b32c97c623034fe604654d3bd491a981c826cb7", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966610, "uuid": "3ea8f779-cf91-4c70-bc9b-be414cc92f57", "comment": "Malware payload", "value": "8ebdca42c9d51813f3edd9f1d017656abf7c908a9de3e2d2445b8b0c35b89a692e9ad9085510765f6e236e7329346560", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966610, "uuid": "08ec9df2-8f58-4006-8ca1-980a44a26de6", "value": "T13B737CE0274C48E2DB5A66B75228895812FE6377798604CC348EF6D53BBE34D8E1D8F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966610, "uuid": "f1e7ef89-d354-45ce-aff1-0c731c06d382", "value": "1536:Msd8JUU+hktGcRtMuuy3rP5B1DZ8J5PqWWCx4JpDXqvX0DCWa/U2Zjd:3SskwuRTlXy/Uud", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635966610, "uuid": "0792b82c-186f-40d2-ab2b-aa20c7d106e4", "value": 77595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635966610, "uuid": "8b839f91-0748-40c3-842c-46b35751182d", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966610, "uuid": "3b8f8fe8-42a0-49ec-96bc-bfb7e89a8e08", "value": "Purchase Order NO_0184930.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0342feb0-3caf-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1635948291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635948291, "uuid": "f3784ad2-02e1-4c90-a17f-96401c1958ed", "comment": "Malware payload (SnakeKeylogger)", "value": "683e0f231228421448fb86d15ce5c316", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635948291, "uuid": "33c238b2-ae99-4f9b-9cec-fd57a9e8763b", "comment": "Malware payload (SnakeKeylogger)", "value": "343e86d17b0ba5402f7f032acd81cff7161e2044a1f4cec5f3b71b9a62bc3ab5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635948291, "uuid": "42f2d9fc-8916-4121-97f3-b4560db6556e", "comment": "Malware payload (SnakeKeylogger)", "value": "ae5c9c048a81bf2415562d80b48528912b9ec4d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635948291, "uuid": "a1047551-4604-4e82-a371-1b6b7001e806", "comment": "Malware payload (SnakeKeylogger)", "value": "3dc20fce3d6cd90ba0edda7c805207de22dcaff82e01b3fa51596e399f63f557bb8d970398d8ad1771901e46e496fbd9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635948291, "uuid": "85cb4ca9-fde5-4628-91f3-c86025414b4b", "value": "T10315AEA077694445CEF877348F28D67017637D7D2A60C61E60F03CEBBAFE6470622A65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635948291, "uuid": "42d18536-14d9-4eb5-84e6-5fc0becd78d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635948291, "uuid": "0af9b8db-5728-404d-a3a4-b2ca5353b4d5", "value": "12288:QWbB9eLSdVb/8QAcIWFUxh0OGum/YnROBDgbu1pNmeeKPLTQV0:2LSI/RWFXObROBDF1CeeeUV0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635948291, "uuid": "d098d385-2c3d-4b3a-9390-02f11ab726c6", "value": 902144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635948291, "uuid": "bec12f59-c8aa-45c9-b246-9dee461956eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635948291, "uuid": "0363be22-3221-4408-85ff-b404da4591e8", "value": "Invoice copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f47b4a48-3cdb-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635967593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967593, "uuid": "c4407b74-c98a-4822-995a-14ee5b28ba0e", "comment": "Malware payload (Formbook)", "value": "2cdc3d96a11abe92e9869d888d6c1696", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967593, "uuid": "142a667e-41a3-419e-8664-2bba46273311", "comment": "Malware payload (Formbook)", "value": "34957e2abc46b8e90fa220eedbdaedd08b021f54bfbc1155069b1165858b67dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967593, "uuid": "f1eb4e9f-0b0d-4283-8586-b974e634ff82", "comment": "Malware payload (Formbook)", "value": "910cb0036b3e9a2834208a2361ca28912ade8f6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967593, "uuid": "8f5bc75e-64d0-4311-818f-e7ad25b294d1", "comment": "Malware payload (Formbook)", "value": "3f7ad597e255e8d730e5b00af965515f75db0ef5943b2016704b3bd21d2df5fb0551878f6d747eaa289f033f55044c87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967593, "uuid": "da010084-c746-42d4-a31b-60a4622a95a1", "value": "T14B54231143C1C6ABC06FA7B7987BBA24D3FDC5081872295733F02E782D56AE3A91705B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967593, "uuid": "c6fd4bf3-ebe4-4ef9-a555-c652e6084687", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967593, "uuid": "2f9a0817-f9bb-4dd4-b773-9b2a3b646b24", "value": "6144:wBlL/c0Rn1/VSGV0YGiZTkGpO1ttI0nv4DmW04tJgmYGGOqXh:Ce0NSLY9TkAGI0MqezYOqx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635967593, "uuid": "16f35016-b628-43b1-ae52-e171782e40de", "value": 290868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635967593, "uuid": "e44142ba-3367-4e9d-863f-a54991145be6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967593, "uuid": "9bb355cf-597f-4e0a-af3d-1fd7487ff70f", "value": "2cdc3d96a11abe92e9869d888d6c1696.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09c70085-3c4c-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635905782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905782, "uuid": "c88645e6-4398-45c4-ae0b-d56cc8539fe7", "comment": "Malware payload (RedLineStealer)", "value": "b0190a68b9de51c255e0afa1631bc3ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905782, "uuid": "82a64860-4d91-442c-90d0-ae572c2f063c", "comment": "Malware payload (RedLineStealer)", "value": "34b23796eb2b9628bd024d02fe5c5bf9853c16cc92bf4b5d26c86b15605b2f60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905782, "uuid": "9ad0ea70-7aa2-44f0-bce0-8606519a9b38", "comment": "Malware payload (RedLineStealer)", "value": "2a6d60b6cd6ea6e38d69b9c1b234766e2754e0ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905782, "uuid": "2bca1507-3172-4f91-ad41-f77fd9fc2f5e", "comment": "Malware payload (RedLineStealer)", "value": "79011078cdf9a5a5f65c1328cfd85bd08d8823ce7fda195a1d8944284333e838bb7b6dba95934ae2093f41d142771266", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905782, "uuid": "e5e0aade-d974-48b9-b591-d2fc18a4b49e", "value": "T1441633A5796027DBC6F0E5B1BC738921BB6E421A6AC7B2071F43FCE629960C1503DB47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905782, "uuid": "81a7e022-b6ee-4889-83ae-dbd798a63a4a", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905782, "uuid": "7419d693-10d5-4884-b926-15906582be40", "value": "98304:0aNDtQqLZ7HCQlouWtCGwi49tH4WXMesoHe:htQkZ+SWtVwiKd4W8eK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635905782, "uuid": "a8bb4b51-e93b-4f59-90f7-d2a10778e6d9", "value": 4060556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635905782, "uuid": "45306057-126f-4e88-b3dd-0e9eb5156bb1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905782, "uuid": "7330ba96-fe4a-487b-af40-d0ed36024481", "value": "34b23796eb2b9628bd024d02fe5c5bf9853c16cc92bf4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2270a114-3ce3-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1635970677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970677, "uuid": "07fd8dd2-6ff3-4fa5-886d-fe73cf50872b", "comment": "Malware payload (Quakbot)", "value": "f775cb3ce382473d29ef0c719b99cbe4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970677, "uuid": "e8f17211-6771-451d-8cdd-530d8bc76d5d", "comment": "Malware payload (Quakbot)", "value": "34cda9d276e820ec2299d523a148bdd21c9ece7ed2d7244326da75654388d909", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970677, "uuid": "915deb71-1b35-453b-b4f7-8df428562f8a", "comment": "Malware payload (Quakbot)", "value": "1946c6cc76c211b8b8062a0b39081a067972667a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970677, "uuid": "d1e5001d-74a2-40d7-9613-006a72e05560", "comment": "Malware payload (Quakbot)", "value": "335eb62b3dca231c412954ccc6946fe00b9d6cd0cf662bfa33fa5a68f5a532a51e1a7df2ab3a1fa6114497f494146e1d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970677, "uuid": "c6839572-681e-4567-adc6-5135e50e43e7", "value": "T14EF4BF2236F94431F173073840B251A05EDCB952A479DEDBA382313D4A6BAD2E67DB1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970677, "uuid": "392f0cb0-c2a5-49b2-8221-d49239c3d9b9", "value": "7ddabfb6ef16af3c3a117549a0542f6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970677, "uuid": "cb5d9c30-32f2-43e3-9fdc-b6d1e7bc909d", "value": "12288:tJCN99Nsafl2MQnNuwAwnDWmpQtBpafumdK9E4peho/7N1GJs+Dd1XiGZpdph+6u:+r96aYHCmpQIiHeG/7ks+Dd1dpk6lg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635970677, "uuid": "27851c63-f97d-40b4-9d21-09f4a6bb4576", "value": 787433, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635970677, "uuid": "e02104ff-b083-4bd7-8ca3-3c18ec6dcff6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970677, "uuid": "277cd7fd-f84b-48be-a7e7-a22474ffd4c7", "value": "f775cb3ce382473d29ef0c719b99cbe4.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93042c0b-3ce3-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635970866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970866, "uuid": "d0d021f6-5e5e-4ef0-9c6b-0d4a21b9d479", "comment": "Malware payload (Loki)", "value": "aa6c99e4f8345ea9ebf05d8384819faf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970866, "uuid": "1b28274d-4022-4022-9336-60b4a170e713", "comment": "Malware payload (Loki)", "value": "35a460be7b0641c4ed8a4fdadc3400e6aacec2671ad0e38f7f08e415eed7c007", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970866, "uuid": "03399b20-fee5-40e1-a440-dd5d88309289", "comment": "Malware payload (Loki)", "value": "a8d6fab08785067a6541cbe347b4d94f8c3104fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970866, "uuid": "98a2e56f-0e82-4b5f-b9fc-b00995f9159c", "comment": "Malware payload (Loki)", "value": "f24ebb498e1312ca27a3f6a38f1fbfbfdfa33121c7e12e89891184f52b23b11e398859597dae5f4dd37773bba8b2db39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970866, "uuid": "cdb7891d-5c0a-4b73-8ed8-c46b54cfcb4e", "value": "T120441222B3F194A3F0471B766E31E632D1F191292124458F83F47D3AA5253CB6A9B6E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970866, "uuid": "843c3be2-94c2-482b-85f1-2ae03661bc53", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970866, "uuid": "c2832fb6-661b-4a79-8795-edc0bab0de6d", "value": "6144:wBlL/c5E8ftHjnwSbTZDNFGivsxlHihdZoaujTYS:CeO81DDnZklHif+9/V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635970866, "uuid": "71416cce-106c-4424-82ac-bb6308e7fe01", "value": 270754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635970866, "uuid": "b8f7dcf5-aa6e-4e84-900d-56dd75e9498d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970866, "uuid": "d70ede8e-b4d9-45e6-a105-d55c7349a6b7", "value": "aa6c99e4f8345ea9ebf05d8384819faf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79023e60-3ca7-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635945052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635945052, "uuid": "dce209a2-cbf2-4266-a977-3c3fa24c2c3c", "comment": "Malware payload (AgentTesla)", "value": "bac4059584293802a240d9d7dd397d00", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635945052, "uuid": "485f67a6-0b0a-4334-a253-0be5f5ee2f71", "comment": "Malware payload (AgentTesla)", "value": "369f7d7fd2e92d167689667a7af9aa44ca11d1d96c1be1942276dabecf5a8f8e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635945052, "uuid": "0327d3bf-3b72-4add-b4c6-4cb9153e1eba", "comment": "Malware payload (AgentTesla)", "value": "5cbe6b730295348fadbe5274c02ce8c4637deaa3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635945052, "uuid": "e267aa97-7bf4-4839-a393-2ff8d8621a97", "comment": "Malware payload (AgentTesla)", "value": "56cfe3d6459de7249a4a7bfca45d838acd5ebb842ff44b5c89cbb43ee80a91605af49d3cd053d6247970c5d875e06d7c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635945052, "uuid": "023f91d4-30c6-4887-9ff7-526abccf08bb", "value": "T18245813538E8788CE9D6483044DC2C621D5AF9733D9AF15A90D36C4CD47A087AE6EE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635945052, "uuid": "b9c5cd14-0746-4cb1-876d-fa34e73d796a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635945052, "uuid": "ca3427ec-50f3-4803-81e2-241ce923e96e", "value": "24576:zduGlP9tDtoqqPWZ88KNS96+45SFk413T9t:zPpo4+515SamP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635945052, "uuid": "d8d27bed-8374-48bd-9878-9ed3fc3886ef", "value": 1203712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635945052, "uuid": "5ae5425f-ae5e-41ba-a583-d0aa12dcf8fd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635945052, "uuid": "a9d6d91b-6055-484b-913a-a365d74376b2", "value": "Quote_request.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8ddb08d-3c9f-11ec-843c-42010a9c0014", "comment": "Malware payload (Kimsuky)", "timestamp": 1635941804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941804, "uuid": "fa546446-7f64-4348-9bd5-77ed0bbb558c", "comment": "Malware payload (Kimsuky)", "value": "400f7d68e98ef1b49741bc1810eb34ce", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941804, "uuid": "459cd5eb-5977-4440-9a4a-e30f8913a2b9", "comment": "Malware payload (Kimsuky)", "value": "36ab582abc1705552faac5068ef38b55e883d0dd339f3bfdef4a4fdd56fbb50b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941804, "uuid": "ddd4b94f-80af-4b3c-a942-9914399d2bf7", "comment": "Malware payload (Kimsuky)", "value": "73556122dbdc20a448dd2af4289c0d2f0fb0e5f4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941804, "uuid": "df185277-831c-42c8-8562-a09d7bca7659", "comment": "Malware payload (Kimsuky)", "value": "38456ca37b21e2c1f6f2b0379d6895eab6dcc592d2b34fa7f8ddae399824027f6495154b8c53d8a08b73c3a35079c528", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941804, "uuid": "afed2d79-fadb-4529-bb40-65373e765ef3", "value": "T104C51891B94672CBE49F27F89467DE82793D07F847304863A86CB8BE7E73C811595C28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941804, "uuid": "6cfa9df6-bfbd-4be1-a88d-83d7f251d102", "value": "d948d579578c8a1ca1e4b1598080ca50", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941804, "uuid": "2f52b0b7-ba44-4656-8067-0ab663bd99b7", "value": "49152:Xkoso0JLjMHWJwyDr4Pw+HZ3LBBDZMyIc:IBoHWJw27+53LBBDZMy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635941804, "uuid": "9ce43dff-8b5e-451c-847b-2503885989fb", "value": 2550905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635941804, "uuid": "6af69e2a-a6ca-4b04-80cc-c4836f7e78eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941804, "uuid": "87b25427-ff4f-4361-af46-4838121127b0", "value": "36ab582abc1705552faac5068ef38b55e883d0dd339f3bfdef4a4fdd56fbb50b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "605f0c9b-3cda-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635966915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966915, "uuid": "1cadce3d-b0f1-4264-8467-a76b4af594c2", "comment": "Malware payload (Loki)", "value": "25abc0be9a1dde6981b92a5e04ba0028", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966915, "uuid": "92a54728-095f-42a1-abda-d1e804d16188", "comment": "Malware payload (Loki)", "value": "3799e0d260d16e8c182b3e96713cbe8c251f4c601a0970b932ff52463b00f411", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966915, "uuid": "2114e69a-e9db-4124-82ce-baadf1c44c0b", "comment": "Malware payload (Loki)", "value": "c79b5688095e2538a118bc1a6f299d4e8a31adea", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966915, "uuid": "54db33a1-ce66-495e-b68c-1720cc1a7ec8", "comment": "Malware payload (Loki)", "value": "cb8bedf4ef2617397f0b8ecec070f84daf16807cc71767336ecf0a5b5da41dce3b1c5f45d63d9778bf1e25b71e0eacd8", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966915, "uuid": "ffab2d23-39dd-481d-b0b5-5d3d79735d59", "value": "T1ED141230649C4990F4725B7D1D23E6488269EF3F6509DEE20053B34F8DBAD01AA73E3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966915, "uuid": "8ef9facf-1b1e-49b7-a5ce-833d16b20c53", "value": "3072:J9nMxL8yFyN+e0S+Uvvrs1iUeDBHFnBEVupMiNH6AAQC6rbNy9Lc6HU:jdyFiP0SZvrs1FeDBHNBEV+T6yrbNyRG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635966915, "uuid": "a36ae38a-6c3c-4159-8690-2be67c0f35eb", "value": 190840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635966915, "uuid": "60b3fc77-26b1-4f7b-8c2f-313c8b918bbb", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966915, "uuid": "d28e0345-c8a5-4bb2-b015-c79d68f49cb6", "value": "new order confirmation.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c52f482f-3ca0-11ec-843c-42010a9c0014", "comment": "Malware payload (Kimsuky)", "timestamp": 1635942174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942174, "uuid": "0f58af43-598b-423e-a916-197c01719615", "comment": "Malware payload (Kimsuky)", "value": "aac0ae6863881f36b2f78e153495cdea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942174, "uuid": "f4c818c1-b639-4c21-8415-b4af6b0ad790", "comment": "Malware payload (Kimsuky)", "value": "37d22cfbdeac4422e1dee7eac233125eccf4af9afd0b9697181e8e8c5555257d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942174, "uuid": "13ca2d72-85a4-4753-b30d-443ae67b498f", "comment": "Malware payload (Kimsuky)", "value": "25a6c23f56e06a5853b0da1a2614a79340f397e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942174, "uuid": "fec55d3b-e772-4484-b557-750689303c9a", "comment": "Malware payload (Kimsuky)", "value": "51b73b55aa19bbebc126efd75a23b7d2f2de7521eb7335f6ce545699cc343b0e67b09b76447faefbc8030d6d5c2a1785", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942174, "uuid": "66229f1f-dbf6-4f9f-b14e-4cfe35ca9578", "value": "T18BD36C57B2A400BBD5A6D739C4530A15E7B2BC170624EB5F03A8439A9F273919F3AF31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942174, "uuid": "c3daa846-fc2b-4da4-b5ed-dabbad1fe125", "value": "be1efd06f854d2932722ce21aa132801", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942174, "uuid": "29b42ed8-1605-45dc-a4fe-88e81b31c27c", "value": "3072:bMNCpiS+gyYD7Y66wj5QCkeT9XtM52yQ:sCpipg5fY6zOCS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635942174, "uuid": "f7048e8f-c2fe-435c-95c3-bf008095ca42", "value": 135680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635942174, "uuid": "d0175e8e-e29d-4d8f-8fe4-a64e05183ece", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942174, "uuid": "0ead99fc-80e1-49d4-9e1c-aa809d142b53", "value": "37d22cfbdeac4422e1dee7eac233125eccf4af9afd0b9697181e8e8c5555257d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a38078f5-3ca0-11ec-843c-42010a9c0014", "comment": "Malware payload (Kimsuky)", "timestamp": 1635942117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942117, "uuid": "96bd4585-e8f5-4984-92cb-a83a5978d0fc", "comment": "Malware payload (Kimsuky)", "value": "5eb09dd7aafdd5af5a8396497f99e0e7", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942117, "uuid": "dc529a5f-1c6d-46af-a850-33c79a1edda2", "comment": "Malware payload (Kimsuky)", "value": "37e0d8519389f35a04c667fa79ab170df86b887557fecfc81dde7ff0b77da729", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942117, "uuid": "0d9c1c2f-853e-4610-bce2-a81c7c31932f", "comment": "Malware payload (Kimsuky)", "value": "ea48d2e4fb846e50e7737b932c1c0c93c504b543", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942117, "uuid": "75406eb7-1aed-490c-b76b-01db782cf119", "comment": "Malware payload (Kimsuky)", "value": "8ecd2ff08bae2331e114d6b535227e54a6ae8fa4570ab75322b6cc5490ec8e3f880a21e744a8a0e2a60373e38a20deb3", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942117, "uuid": "30cce245-3655-4bd1-a308-89e2a6745cc8", "value": "T1F61412B1C3BB8126E1AC097C114421C8B51A668B5BDEE3CFE367E3F48B2484787D51E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942117, "uuid": "95ccc589-d02c-47a9-8020-6779cc9c0ada", "value": "3072:l9CBnJ9ORL2WbjTU4q8nyWNovc2jTu8psch28KsJQKz254ooBbVrTnK3t6da5:ixJ90rXT7ovc2Tu8pschisa4FJTK96k5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635942117, "uuid": "8564183e-521e-4fd3-8e60-fb71cf002733", "value": 196551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635942117, "uuid": "694696a2-08e8-4f1c-aad6-af963ad6d51c", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942117, "uuid": "1c3955db-f6b3-4a5a-9028-1a5dd243372f", "value": "37e0d8519389f35a04c667fa79ab170df86b887557fecfc81dde7ff0b77da729", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f69b9ea-3ca5-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635944177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635944177, "uuid": "fb343779-0d3e-4b1f-862b-c516170944dc", "comment": "Malware payload", "value": "b7ef0d6bf5570c242af207a30f355a08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635944177, "uuid": "0c0f9af4-6ba7-4d66-88a5-dd3ae3fc003b", "comment": "Malware payload", "value": "37fd995e570c65b21d0fa2efbc7fc228f25873d95b35988bb5732f8445d5c055", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635944177, "uuid": "79408311-a5ce-4da7-a3d4-0c43b2d9e3e4", "comment": "Malware payload", "value": "03a183166a50425e09e6b00ad792eef37cc8a23c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635944177, "uuid": "70c89c37-7c1c-45b4-8677-a3121b337058", "comment": "Malware payload", "value": "524ff56e4408097a62a00fea339dae117603c3cca5695fc5e92ef7d33d84e93f054b490dc00e14bb6ca761a0dc76a396", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635944177, "uuid": "bb8625ae-fbaf-4fb3-ab98-39c35b7d8136", "value": "T15E452B05CAA504E1CCB6B07584268633D661FCC6C76D56CB07D0BDEBFA336E1A937A12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635944177, "uuid": "11e7a340-06dc-4c5b-8643-a4b32c60fc24", "value": "11e6392cdc2b76c2ba6ff63f8490ae07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635944177, "uuid": "6cb3a355-69ea-47de-81b6-08c7edb67d96", "value": "24576:9AUmCXkIIbmvnGzAoviuh1ZzRuCFOoYRNrd2vlQd:9bmyRPyhQC8Rt2Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635944177, "uuid": "9bbe11ca-3cef-47cb-91d9-15e481f20312", "value": 1212416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635944177, "uuid": "468bc7a9-c02c-4801-9f5b-163ebaae681e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635944177, "uuid": "40cf5571-d862-434c-b6fd-31c830d81ac6", "value": "37fd995e570c65b21d0fa2efbc7fc228f25873d95b35988bb5732f8445d5c055", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f60daf33-3cd9-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635966737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966737, "uuid": "81265080-a771-466a-bea8-5209a33baee4", "comment": "Malware payload", "value": "64c4a6643e5383307057fcdd4d0ff922", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966737, "uuid": "d3029f4e-040d-40b9-b0e7-d4de7c733351", "comment": "Malware payload", "value": "38826ea82ba92af94db38c5638a2d5534c9fea60f0b8efc1980b811e428cfd4b", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966737, "uuid": "b641c69e-383f-4d32-b8e1-e0918d95a996", "comment": "Malware payload", "value": "263d10c4874c3a224bf7739d28f3eb3aac1a6bea", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966737, "uuid": "7df871f0-2ac2-48b1-9965-72f5fa56f8ed", "comment": "Malware payload", "value": "d29d4e7cb30ac02c6555cbfb9ebf9a68bac2e6191df12b3be91f3ac7f94f0e8a6f17e865f0f2ba8ee5edc6e01fa0deef", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966737, "uuid": "a79953ff-ae6d-45b0-bee3-67033571bc4b", "value": "T1E01412517798D2CAE6BBB9753A3A4E61B683EC0CCD712B3C3485B7225D754EF0480672", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966737, "uuid": "7d9f4e06-2af8-4a47-9a37-1e08cd215aeb", "value": "6144:1GRDAzcHdamusYoh6dLNlw4SrzECLqRKB8pY+CNTmdVA2t+:cRMzc9am1h2N6JzEWQKBZ+gr2Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635966737, "uuid": "361afc39-e77e-4d42-bb3b-3a5c5d860255", "value": 206632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635966737, "uuid": "3c39ccc4-d2d1-40ec-a73a-fedb2387ef6c", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966737, "uuid": "f286bb9e-51ad-4b2a-ad23-a8ba083b3cff", "value": "NEW ORDER 001 P011.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fffc7be4-3cb8-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1635952580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635952580, "uuid": "0a0cb082-a5b1-4eec-85f5-e0ca54420361", "comment": "Malware payload (ArkeiStealer)", "value": "15685a4b7c571f0151679a8d02b090c5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635952580, "uuid": "d35f3638-64ae-4e3f-b589-5afbf910287a", "comment": "Malware payload (ArkeiStealer)", "value": "388e833740f160ceb5946b7c5e89c5af08dde862a7dd38344149e72dea7ec00d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635952580, "uuid": "d49ee05a-ddfa-4ebe-a8b2-3f5c58c20c74", "comment": "Malware payload (ArkeiStealer)", "value": "d67cfae6e373901507d46fe479b937e6224afb31", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635952580, "uuid": "ba7ab535-ed58-41cb-9c1f-a1cdef48478a", "comment": "Malware payload (ArkeiStealer)", "value": "8c172778254b07a605a9baae82a02ccea19b135bbf80b6c83be539b6ad90b5ae2587f811830d7c2136336225c5a373f8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635952580, "uuid": "5dbf627d-1bef-4543-815a-fbd7273256e1", "value": "T10EC492DDCD00C102DBE33BF222AD5E41C726D6BC0D146872A5C86D5E54B26F87626BEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635952580, "uuid": "59a6954b-7d5d-4202-883e-ea8e91852b12", "value": "6da48c08bfb04326a5b3050895dcdfb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635952580, "uuid": "7ec74a74-4a39-4290-90de-0669b3020d05", "value": "12288:/dpq2sSE2B0OWtV0oTqCuI+Gd+ABigEcV4Dhk3X9beHv0qYtYsGMmicEY:V82sSE2B0OWtyoTqCuI+Gd+ABigEcV4l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635952580, "uuid": "8c7c2b2a-dd6c-46d8-a9db-ae57e95606cc", "value": 589824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635952580, "uuid": "c11bc012-25e9-4e34-b5a9-02d71141fdd7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635952580, "uuid": "2c498176-9f3f-4269-bcd7-90e5aeb02b5e", "value": "15685a4b7c571f0151679a8d02b090c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f558205c-3c73-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635922927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635922927, "uuid": "11e2ba58-af94-4b35-b036-90c1f8d3e077", "comment": "Malware payload (Formbook)", "value": "9e315c29eed4b047094cc1f10b720971", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635922927, "uuid": "3a9aa165-ad43-427d-9624-71c465e0b628", "comment": "Malware payload (Formbook)", "value": "38935c02661ece35d0287947cc94f02f5256389e1f47b43f701d01e67ef65d78", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635922927, "uuid": "2f8f3a94-a279-48c4-94bb-04e3eff595a1", "comment": "Malware payload (Formbook)", "value": "3e199a28a4370d920690b3eb032460950675eb51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635922927, "uuid": "a6adb703-2078-4e82-8acd-915040848acf", "comment": "Malware payload (Formbook)", "value": "0099521ed612677eee9702468eb801ece8e4b82c8bb8b250c1160bc289ad9204b7b866e3cc79a7acba58e33e6a93b5e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635922927, "uuid": "e226badd-f3f3-470c-901c-72560a5fcb18", "value": "T159C4CF41E358EEBEE1C210734994ED3158A0E5312F2F58A3EFC16F9ED6299C15A35B83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635922927, "uuid": "e1f42778-d96c-46be-b8ec-3ad0073fcbbe", "value": "263d4e9111f76a284d24a21190f4a6a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635922927, "uuid": "2343396e-1c06-42c9-99c6-950691b895e5", "value": "12288:0lc9Drw8FSZCWyr72w4n4e7PWP4m5Hqfc7:0Ct4ZjyP2w4n4am51", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635922927, "uuid": "3bf74ee8-5a8b-4ceb-8446-5175a82d63b9", "value": 544768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635922927, "uuid": "8c50474b-4203-41dc-980f-9c655d7d9df4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635922927, "uuid": "cf1af45f-4ed9-48f9-ab3a-55c8174e54e8", "value": "RFQ21116.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0737c132-3cdc-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635967625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967625, "uuid": "a3863160-8f7a-49f9-b70b-98df1f2fdd26", "comment": "Malware payload", "value": "2432bc9f187f3e6e5739d1341528f6e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967625, "uuid": "e6420f00-441b-4680-9800-1f0143379988", "comment": "Malware payload", "value": "38ca0e3d3af73d933e76222258e5d648d9db12bd4456993dc161f92db353e243", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967625, "uuid": "20f0f052-dfe7-49ec-a515-fa857e676071", "comment": "Malware payload", "value": "e95d2719e4ca5dd2d370139f66f993d81d48507f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967625, "uuid": "2a48c38f-f784-4220-9b40-0371c0aac077", "comment": "Malware payload", "value": "a7fe80a843c154b51b806edcaa56cf3c1b239f4a0b40ce9f9eee93aafee7e2c11a5d02419dcfddd886d701443a3070b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967625, "uuid": "671157be-b495-4bd4-8ea7-9a96a83bd69d", "value": "T12D74F111F793C032D0A3553C1970EA3D5BBB79A22531D09F67A82A6E1EF43C189BA317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967625, "uuid": "41cb12e5-1443-453a-ac78-3a6e382fdfe6", "value": "adc309f4258aa7e488ca350060834acf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967625, "uuid": "9b9fcca6-8644-48f8-9d56-85f2bd115c3c", "value": "6144:b0EcZrO+A+sASm6ToiMkaPhoc6EOQQSPivGF/rM9tb8x4JZ:YvZ3JB6ToiMRPMEdQSPiue9tAx4J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635967625, "uuid": "f2725a48-355c-4b87-8ec1-27f882a96d17", "value": 360960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635967625, "uuid": "233aa564-7062-4803-8b7b-1cc7f6c68bbf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967625, "uuid": "0bb994f1-7c3d-417f-a7e4-9a76992bd76f", "value": "2432bc9f187f3e6e5739d1341528f6e6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e940112-3ca0-11ec-843c-42010a9c0014", "comment": "Malware payload (Kimsuky)", "timestamp": 1635941948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941948, "uuid": "38acd267-578c-49e9-b6e8-fef2dd383fd9", "comment": "Malware payload (Kimsuky)", "value": "e647b3366dc836c1f63bdc5ba2aef3a9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941948, "uuid": "ead4b312-8836-4900-81e2-888cdfe2ce51", "comment": "Malware payload (Kimsuky)", "value": "3903958eb28632aa58e455eb87482d1ccef38a6fe43512baad30902e8bfdd6d5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941948, "uuid": "b4c8f525-b2bf-4d45-b878-eed0f9b99b3b", "comment": "Malware payload (Kimsuky)", "value": "a7b0711b45081768817e85d6fc76e23093093f87", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941948, "uuid": "4a036221-c97a-47a5-a7cc-bfa32a761065", "comment": "Malware payload (Kimsuky)", "value": "14a29d8130be7da64c4ed80486e834b57d7113ae9483853f2b7ec8753d335de31782d881d85f70c599b1945af5e6d823", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941948, "uuid": "f9586c68-71f4-433e-911c-9bb2a5f49735", "value": "T14EA4F1107581C0BAE17E09385CBAA7756A7CB8305F34DDDBA3D88E791E202C05776BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941948, "uuid": "569d388e-971b-4b7e-a84c-2514ab79f300", "value": "194f714c2987b8432496320ebae1cc55", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941948, "uuid": "ff0e9051-1ca6-45fb-a1b9-c58d8ea578f4", "value": "12288:L5VaR+IeIcFHazhjpniikvx4/qs6iDwEHtDWT:L5SjcFyhjp0x4/qs6VEt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635941948, "uuid": "4156e4be-2e5d-453a-b0bb-ce5bc3e8d373", "value": 493056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635941948, "uuid": "fca90ffc-0661-4180-9b7b-86c8a71a3e9a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941948, "uuid": "c4d1444c-27de-4887-8729-55f50b6b6be7", "value": "3903958eb28632aa58e455eb87482d1ccef38a6fe43512baad30902e8bfdd6d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c08b817-3cae-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635948064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635948064, "uuid": "ec89daa4-876c-426e-afc4-b3b35dbd0b19", "comment": "Malware payload (AgentTesla)", "value": "93c2da8747fdb7c51c489676560b5fd5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635948064, "uuid": "74f651b3-0307-43b3-8333-1e334f487436", "comment": "Malware payload (AgentTesla)", "value": "39bd07e713980928314f3cc9322c304606cffb21bfd3f8ed5b9634b29195e07f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635948064, "uuid": "730d8aaf-90d9-4229-b4bb-2231da3fc55e", "comment": "Malware payload (AgentTesla)", "value": "700b30b0a07b437dd6417c97fa093bf20b1a91c2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635948064, "uuid": "3eaba8a9-4a94-4218-9395-e82ea24e5e50", "comment": "Malware payload (AgentTesla)", "value": "aa949ee1a0e5cc16aed69a3117843f73eb25e28236383ad5e31b5b1e354271ae6e37a636d7cd1ec5ad05a83fad8d4600", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635948064, "uuid": "d57e5425-c7b6-4350-8518-dcc421d6d943", "value": "T1DCB4F002715D8B64CB6CB7F0309A9350B7B67E3A6412E21E2DCA72CE4A373118EB5D57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635948064, "uuid": "bcf45605-d960-430f-8228-94435030cbc3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635948064, "uuid": "6cfe5e55-8df7-4354-a40c-3a28c012c670", "value": "6144:q7jWD7MbwN2s7GQGvthou+u4Xq+WyqHAl+thJWOTkPWCJwGx8iiNi1WaCCwLlTj:q7UIbw8eGrv5+jqgothJWug6NpaCV1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635948064, "uuid": "d6196e3b-3261-40e4-bc91-ab7bef2d213c", "value": 498688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635948064, "uuid": "42a8ce4a-aeff-44ad-81a9-59bb38a4c0fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635948064, "uuid": "d02f2552-9048-4a5a-898a-71c917fd8058", "value": "SWIFT COPY FOR PAYMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a7a51f7-3c5a-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635911823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635911823, "uuid": "83382893-a9d0-4baa-b7cf-0d5c3a68f1a1", "comment": "Malware payload", "value": "bd4ef60928a0418f2f42958444a3ffc4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635911823, "uuid": "93a00f4e-e4cc-48b6-ba93-d2ae70d4e0c7", "comment": "Malware payload", "value": "39c56ea74a5eeb35efc0dd8b13b42e2d1ee2014a2bdb331d9e36b2da4d714de5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635911823, "uuid": "aff982e8-4201-4daf-a096-bae09a236f66", "comment": "Malware payload", "value": "1d283bd5686d6468b42b93241be4a9b871b419fc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635911823, "uuid": "3f54e3e3-2f29-4904-9b8b-dc286a55806d", "comment": "Malware payload", "value": "e6d74997a2d404160d83300407d1adb6a8167603f0d090042870e79095a9f3bc861df63e41d3970a2d35575308d24f96", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635911823, "uuid": "027cb97f-97aa-4208-850e-bf175624f56e", "value": "T1A6B4501CBB454A72EC4E8539981349147B231F375B5AEAC9138F3ECA87FB2D91C15C8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635911823, "uuid": "8c68afae-d94a-4dd3-80c8-7c00c91926be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635911823, "uuid": "0010e94e-be66-4eb6-9cc9-ee3368d50675", "value": "6144:iVkLufhPPMKQmkSsfFG81e4jgDcTA25n4rL19K3MDmFCJw:hyXMKQmqoX4U4TAWSwM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635911823, "uuid": "07d76378-321f-4d21-b12e-b48bafbfa851", "value": 505344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635911823, "uuid": "cd3eec86-3607-4acf-9114-a5cff3894996", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635911823, "uuid": "291c0ff9-0bcd-4481-9ecb-11e25df4bf78", "value": "bd4ef60928a0418f2f42958444a3ffc4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7831a0b4-3c77-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635924435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635924435, "uuid": "09fc91e0-ab52-446d-ab5c-0182e572091c", "comment": "Malware payload (RaccoonStealer)", "value": "c8629ae81e8f4d1a2b33667b82e707c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635924435, "uuid": "bd89e018-a0bc-49ba-905f-4013c8d426d7", "comment": "Malware payload (RaccoonStealer)", "value": "39eab0fe41e582741cfe50e4cf5163c345d4e48aa10b7e2a9bd53336bcfb6e03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635924435, "uuid": "024ef8ba-74a0-4195-9885-1d019a2a4ea0", "comment": "Malware payload (RaccoonStealer)", "value": "f0b93855cbfc8be20bec54ecdf1ba772088d668e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635924435, "uuid": "67b92d60-ec43-4563-bf7f-a9412a334c25", "comment": "Malware payload (RaccoonStealer)", "value": "8590aa746a1752925c3fddaeac2bfefa2aaeb75c2835fd639bbbcd4a704aaa675e04cd1c06329ac3a897ec9a7017ca67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635924435, "uuid": "ab4e0843-a79d-4fca-a4c2-346302826c8a", "value": "T1BB45AC20F35D8CC9CAFC77348F25D1B117616C6E2A108A5924F43DFBBABC61356316AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635924435, "uuid": "4d18bc62-1eb7-4208-a38b-b4e07f034b71", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635924435, "uuid": "374b330d-e9fc-4201-9f39-c23a72544947", "value": "24576:g7y10rLSWdcgw+opPmIB4zXJ5wWv9cXiyiY17yuNNZK9nP0:g4gLJdcwSmIB4wHlOsNZK9nP0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635924435, "uuid": "a0f03c4e-4b48-40a5-a3e7-2a35a01cb318", "value": 1216000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635924435, "uuid": "4d0eed69-2daf-4b5a-b5be-cd98cbae7f1b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635924435, "uuid": "0da8955f-b323-4a5e-8895-413dfee8ba19", "value": "Draft-Copy-Bill-Of-Lading-1049005B561815.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41deb6a0-3c85-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635930357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635930357, "uuid": "4d6c30ba-a8b9-461d-b97f-2e2606437ea0", "comment": "Malware payload (Loki)", "value": "bd437058e876256b95daf7366e2c6523", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635930357, "uuid": "db009f26-6ebe-4310-85a2-d68938a2f1fe", "comment": "Malware payload (Loki)", "value": "39f3d4b071ee3577785eb09530063a9c92afb19d68f21df09aaceb87bcd5b447", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635930357, "uuid": "d18cae10-5a20-40fa-bcda-329968253408", "comment": "Malware payload (Loki)", "value": "4ef738281ff54ef16cfab8e8471e9413716811cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635930357, "uuid": "288117e8-ede0-40bd-bee4-639d17c92e7e", "comment": "Malware payload (Loki)", "value": "b54e001d083152dea4a7e73f21ca63b28f0d2bb2768d5110aaf9a0ac7b7c974827b8beb5b2012435e204d4a17e37f471", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635930357, "uuid": "73c9d853-9e1f-4529-899e-2ee6a84e825b", "value": "T12F73D0487B88BF21C4341BF6489AE7D503B2C30D7052CB5A6C8A55F6AE51BDD2650FE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635930357, "uuid": "986e3b38-c25a-4e0d-8c33-b152d793492a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635930357, "uuid": "fc120d60-1380-4b80-99da-c198d7b32c17", "value": "1536:9ps24n1xGQS0Cy74CT3TrYz6vDpMQ43+41xPNfad0:9Ps1xGQS0h0CTXYmvFMQ4b1LfV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635930357, "uuid": "83b623c5-a11d-41a7-aae1-ee841ecdcc90", "value": 77824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635930357, "uuid": "f97dfeac-a456-4ea1-920f-db0a2230fcae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635930357, "uuid": "8281e314-2ea3-4e0b-a3dd-10d4c168217f", "value": "P.O-2021-6237235Weitzer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b073223-3caf-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635948492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635948492, "uuid": "7c003f78-4e19-49b0-9775-3ea6b321a1b4", "comment": "Malware payload (AgentTesla)", "value": "d4d98bce50d6e3ffb1d2ced7afe12eaa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635948492, "uuid": "2a3a17cf-73f5-41d8-a754-dc4b0617f70c", "comment": "Malware payload (AgentTesla)", "value": "3a526f88ad49057e96c10cff01a976b6b51a6d5a3d09a1053416fa73c1c4b1fe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635948492, "uuid": "f4c77bfb-d7b4-4973-9642-ce9999beb26f", "comment": "Malware payload (AgentTesla)", "value": "155bce963d7a40b0f53567f7e0c48d60033699df", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635948492, "uuid": "c7554c4d-4546-4fef-b7a6-fd590922684e", "comment": "Malware payload (AgentTesla)", "value": "b48dd00780593aebef8694bad2b2d33fd748247599f504b3d1a219e37ef80adaf606c09e826cd72c9bf2463f23089978", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635948492, "uuid": "f00c3e33-f063-432c-a8cb-da89c07a8df2", "value": "T1A884125417F8AB13ED3C57F5619203004B71F2292023E35C3ED679EE5A66B4A9A50FB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635948492, "uuid": "66f4556a-78ab-40e3-b494-3479a5c99135", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635948492, "uuid": "958466c4-6611-4125-9600-0698ae41a0c8", "value": "6144:FPch0SPrEsB85UQ/CVoCDR45hwaZMVHsEasO+Bpobrz1MHiKS5SFr+sBvqVnUlTQ:FCPrH+HgoC+o2iBEziHiKsyvq615m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635948492, "uuid": "61b307bd-f4da-4170-96a9-3d10c2e73c15", "value": 401408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635948492, "uuid": "c47411aa-36c9-4ff2-a63b-0affc8d49ee0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635948492, "uuid": "d57d0710-2111-4bc6-81b4-0fce3cdfeddf", "value": "TBLFG212020.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b73969bb-3ce1-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635970068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970068, "uuid": "3b076cd1-493d-406d-99a6-f10a517d5a10", "comment": "Malware payload (RaccoonStealer)", "value": "c534d06294163f23c9fd1360dea6e242", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970068, "uuid": "e95f38d4-2a34-4717-9438-afb1f2a0e3f0", "comment": "Malware payload (RaccoonStealer)", "value": "3ab9187b303ce5ea46b339686cac12039ca5eac841efcc843b8c1029b8e2f730", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970068, "uuid": "04f65629-2e97-455c-b107-9b185256394a", "comment": "Malware payload (RaccoonStealer)", "value": "95d8f0d2491e1a6f6e862526ff1fcade2e1805ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970068, "uuid": "a8e24dde-a937-4f4f-9527-10e90c9f2721", "comment": "Malware payload (RaccoonStealer)", "value": "afd5ce4cbbfe1beefc5ef071ef23cad9a973c4b47a4d1b05a78397a65b1b19ddbac52f77e06e628351b6b354be0a3457", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970068, "uuid": "536542d7-8a8b-4be4-81e8-76a615cbc1ee", "value": "T114C4E100A7A1C035F4B652F44AB693A9B53FBDA0A77840DF13D466EA4B34AE1EC71317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970068, "uuid": "2b3424c6-d12a-45ff-8877-e7c2dcdc8afa", "value": "e024db68009cf7f32dd817cae1867bf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970068, "uuid": "7dfce95b-04f0-4e8c-8c23-99a9f45c2f75", "value": "12288:bOw6ENGHqh6mvEwK6FiZ43TW7ZsgbQJGwu9VGOLUK:aw6K0qh6mvEw3F24DW7Zs2rV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635970068, "uuid": "5fb15d34-7823-4dbe-87dd-82f045efab2d", "value": 552452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635970068, "uuid": "676b9d59-2df4-4001-a1e4-bc136c650fe3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970068, "uuid": "899167ad-30d8-4010-8713-40d9185f628f", "value": "c534d06294163f23c9fd1360dea6e242.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74da75d2-3c7b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635926148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635926148, "uuid": "bf816da0-e706-4071-906f-6bce3b30a72b", "comment": "Malware payload", "value": "3c40dc189fcc4636f8733704b19eadd8", "object_relation": "md5", "Tag": [ { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635926148, "uuid": "c9762b65-6765-4f76-b623-a9bf6506d0a0", "comment": "Malware payload", "value": "3b87f9d5c85e475e0035353688ae385f11af3733e15232b1f7c5d3042b44f052", "object_relation": "sha256", "Tag": [ { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635926148, "uuid": "a5fc15c1-f020-45cf-a59c-9cccf96c56fb", "comment": "Malware payload", "value": "74516eded62c1d9d1b55c38d92ee35a4954c66f4", "object_relation": "sha1", "Tag": [ { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635926148, "uuid": "c50534f5-d9d8-41d5-a416-06b956ad1033", "comment": "Malware payload", "value": "6d7255f7d1ec33c65a2d1329243e75537c0b50974553ba0b30184006bbbd90fc94ec9af6970ddc25be690404be089471", "object_relation": "sha3-384", "Tag": [ { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635926148, "uuid": "ae5019b7-299b-4a69-b3d4-879e26265d30", "value": "T110B52843BCA065EEC4BBD3358D9182A2BA3078891734B3D71B6197B52B33BE45E76341", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635926148, "uuid": "49482009-0d86-400f-b3bd-ee60733845ea", "value": "49152:GOAAzrb/TYvO90dL3BmAFd4A64nsfJiTZxwuXf9nTCqw0Xfgg778laMex5D1C:G1Dw+b3+Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635926148, "uuid": "d07f28f9-231b-4d43-942d-2dc7a3f3ab73", "value": 2359530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635926148, "uuid": "0fd3d120-e727-4908-9620-9c62da8e5356", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635926148, "uuid": "2aa8e22d-478a-463d-b65e-f3bede24842b", "value": "3b87f9d5c85e475e0035353688ae385f11af3733e15232b1f7c5d3042b44f052", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca3c19d3-3c8a-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635932733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635932733, "uuid": "bf9df1d3-2347-4dd2-b61b-a732e683a047", "comment": "Malware payload (AgentTesla)", "value": "798c47df685198a290ee41b5293cfc06", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635932733, "uuid": "10a10689-0567-4471-a57b-0be02e130361", "comment": "Malware payload (AgentTesla)", "value": "3bf1a0a8dfbb3674f958ac689c9da714d254cea2405f7d11d1f6196328a9a329", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635932733, "uuid": "f9c6c56c-cb72-478a-a8d2-8f8657344b98", "comment": "Malware payload (AgentTesla)", "value": "d3245df65461432cbe3a42fe7457618e04ea3e2c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635932733, "uuid": "d2716523-4edb-4e1f-8443-908ddfe3cd24", "comment": "Malware payload (AgentTesla)", "value": "44e068f9588b89e6f716bc063951b9190fce455cad23236ee687380bd50b629f29ede2cbc0d81034eeb378bfcdef3389", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635932733, "uuid": "17b28fff-7d0f-41c5-a36f-0c42702ccfe3", "value": "T177E4D081346C86C7D66D2BB1789AA23033F43DAE5586D40F29C9B7CA10B33514D7EB6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635932733, "uuid": "826d67bc-a8a3-47a0-a10b-6e876f0ac812", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635932733, "uuid": "c254e641-2e28-430f-b5cf-f177f632fa6a", "value": "12288:tQIbw8eGH+H6/6uYpUjbud67Etl9C/Vl8a91dlyAKp:tTbw8eGH7AUfuY74EV1dlWp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635932733, "uuid": "92c7e62b-52a1-4970-a88c-01c1c341e7c2", "value": 695808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635932733, "uuid": "6ea31795-ecab-4026-93ee-a29d6744f0b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635932733, "uuid": "803b4bcb-98af-40e5-a1ba-37f11538003b", "value": "Company Details_Broshure_Catalogue,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea1f6b06-3cdb-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635967576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967576, "uuid": "a8957da1-ff79-42ad-8fc7-7de22b6b10c2", "comment": "Malware payload", "value": "e5a51838eae3e43c3de36c099bf6523c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967576, "uuid": "23b94516-2e03-4ac2-adae-a79a870cb226", "comment": "Malware payload", "value": "3bf8bc75f8f23650c36a706eac9d2ab371ec5e9c25b1559c8d1ae789955efaca", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967576, "uuid": "a780dca3-1a21-4246-9a74-73f9045604db", "comment": "Malware payload", "value": "9c6620ca5a1b6a5e1c0e53c93c6e27269a9d2f6b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967576, "uuid": "7839ef5e-cb73-4e29-b0bd-08d6cbc0d55d", "comment": "Malware payload", "value": "df249704b53f607a9e76d3f504be4a7581ef0af6f28d774a1f3f8d594155dfe33e917a70f8c8ad55083da275b093f761", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967576, "uuid": "1b53a979-f3c6-48e4-8525-283526cd6953", "value": "T17EA3024EF4E97898C0F5A8BDC9C62CF5983305094506FE1EBC6C526C1AA118F9F7D62D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967576, "uuid": "cf15b454-2dda-467f-ab2f-808dae6e7591", "value": "1536:8CW+PFFxgFzx5YVqHS2YzayhpSW4vHR05Q4r5UZKUbkXkJM67z7jqYrQV:835FzIsj8aipSW4vHREQ4iZKUbPJM676", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635967576, "uuid": "af350860-5720-440d-ba26-5734c4e81df1", "value": 97690, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635967576, "uuid": "0407c8d6-f12f-4f67-ad27-95ef7e1366f9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967576, "uuid": "f3da8b79-7888-4a22-9b22-24c3d98bda01", "value": "Invoice-633132.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e02a90e2-3ce2-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635970566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970566, "uuid": "5ef86428-fe48-4145-beeb-0221c9dc02bb", "comment": "Malware payload (RaccoonStealer)", "value": "e04a2a4a47ac34195ccd97b37f083fc4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970566, "uuid": "9166109c-c8aa-4d7f-ac75-81aebf45ccd5", "comment": "Malware payload (RaccoonStealer)", "value": "3c4f29d76096fa9aba1b1301ebd63af8ea64efb339432baa454b38ca890f4fe2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970566, "uuid": "f49a73de-a8af-4c0d-88d0-86d6f4a56d75", "comment": "Malware payload (RaccoonStealer)", "value": "bfde2514d2e9a7ca32959d57237d9a0926b79b5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970566, "uuid": "fef4da52-0b7e-4705-b178-5bce6f34d53d", "comment": "Malware payload (RaccoonStealer)", "value": "553fd3b5aa613523efe4cd298deaf56faae51f75d26ff2c1fa41a16d5557eb9ade281f28bbf6f612b9c739b08cdf09c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970566, "uuid": "a5d3920a-1de9-4310-a0bd-49414998533e", "value": "T120C4E000A6A1C034F0B652F84AB69368B93F7EA1A73491CF17D956EE1774AE1EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970566, "uuid": "727f26ad-6592-40de-9afc-6ec13c59280c", "value": "59ee824971f432b778ca9bd24dd5ed5f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970566, "uuid": "a2e968d8-2f7c-45a0-8bda-54c28845dc8c", "value": "12288:nVOF1TIhcsig3SDU8j+5yMvFLleCVMLPOmf3pQR7wJTfK5A3Ar:VOPEhcsbSDxjkrFP6P3ZRff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635970566, "uuid": "f2c4b8bd-6ba5-4e4f-8f45-56fc947b4e20", "value": 552452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635970566, "uuid": "440c77d7-56d2-4cc7-82a0-7afdaebef498", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970566, "uuid": "d782b820-20cb-4b32-9ad2-0264db355fb9", "value": "e04a2a4a47ac34195ccd97b37f083fc4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d66e0c8-3ce1-11ec-843c-42010a9c0014", "comment": "Malware payload (QuasarRAT)", "timestamp": 1635970024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970024, "uuid": "53a1785e-62f3-4ee5-abd8-af4913128ee7", "comment": "Malware payload (QuasarRAT)", "value": "0b1906293450341a4fc2d4cd2d4f1b48", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970024, "uuid": "0dd36bfe-da19-4d7a-bd3e-69048c2f1ff0", "comment": "Malware payload (QuasarRAT)", "value": "3c70bee98b3b7ec593a986787ad60f4ad8c1161e48986d3ed254886fbadc55d5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970024, "uuid": "31dc6078-238e-4f82-9232-b8f367954b7e", "comment": "Malware payload (QuasarRAT)", "value": "0f9a4604fb09b2262c8a99653e856ed71dbdc054", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970024, "uuid": "04c299c0-2b7e-4c7e-aeb7-6b8593136d88", "comment": "Malware payload (QuasarRAT)", "value": "8bfff719220da0dc15300b7fa311b22bd4cc2148cec890f8e0857e458c476f583df34d7a625968c8fb669ba1744426fa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970024, "uuid": "6d909556-7e6c-4f6c-8de3-6e5e501b759c", "value": "T10EB46C4067F8852BE1AF577AE871042597F4F407B2ABEF4F4A40A1F92C66706AD80773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970024, "uuid": "95b9a9ff-d651-48c4-8c12-5e42a54e1ded", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970024, "uuid": "6e54467b-7814-46c6-9256-7c00bfdf783d", "value": "6144:5TEgdc0YFX7IxUpGREW/88WdTEDRKBDkQfocEUOb8F9Ff1cRcTR3v:5TEgdfY+xUstMDkkpPgcdv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635970024, "uuid": "3669d8fd-5e01-4b87-b111-45ef3bc0c5cd", "value": 514048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635970024, "uuid": "2526a8ee-da62-49e4-8edc-d064c58dbfb2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970024, "uuid": "850dc9be-8368-4ff4-a6b2-374bef45d3a6", "value": "0b1906293450341a4fc2d4cd2d4f1b48", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7bdf1ab-3c8c-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635933588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635933588, "uuid": "8366439c-b572-48af-9e41-fc1b1de599ae", "comment": "Malware payload (AgentTesla)", "value": "592cc7f287b358b269dfb32ded2c6c4d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635933588, "uuid": "cc454aaa-3f27-40e8-aec2-6a3a7e096c33", "comment": "Malware payload (AgentTesla)", "value": "3c88c276b1b61d290f8ae3054c74347110736a8b55ae2d562c03d6c478d06fa0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635933588, "uuid": "bc550426-92c1-43e6-ac76-bdea0406b7fe", "comment": "Malware payload (AgentTesla)", "value": "5a6d889c128dac013c52aca8a5bdd9cc1c906003", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635933588, "uuid": "6c2fb15c-ff8d-4d42-80f1-3be3f0b0030b", "comment": "Malware payload (AgentTesla)", "value": "4fb1f6bf5cb2a2aaf2ddb1e9d4c931c8fd91f4ec31ed5ef5c207c26ae2ee4891e3cc2bb144b4911f30a22f2a775cb26d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635933588, "uuid": "d66d2e75-a561-4fe1-a18a-f3db691fadc9", "value": "T1F29423C480966F5347D616A051F115BBECEAB0DBAE790C4CB129EE81E097F0F1BD6322", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635933588, "uuid": "e74722e6-1ef9-4e53-ad63-31f9b9c9559a", "value": "6144:XiD7MbI4X5rNuPSGNi9qrXip7fRfQZaA8/lK2JJSne8pIFudo2d10B1j1A7BVv69:EIbI4X5r0q1Ui7fRQaNHuY1cz6URo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635933588, "uuid": "77b63ec4-83ea-42e9-a03c-472b7dae9e60", "value": 446711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635933588, "uuid": "a1a5678e-1c58-4adf-9004-6b2e336a0d11", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635933588, "uuid": "29f47c19-f3b8-4015-9583-e2cc19bcbda3", "value": "BANK DETAILS.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c39b211b-3ca7-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635945178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635945178, "uuid": "6bb4afe9-b92f-48d7-bd85-474a0f417a4b", "comment": "Malware payload (Loki)", "value": "1ac26f3bae620dec7d0bfcbbebf545f1", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635945178, "uuid": "59ed69c7-4760-4893-83d6-e620e7e37c85", "comment": "Malware payload (Loki)", "value": "3d59e3ef2f57332820630743b058bc3ca35fd00b8bc983020a7bebe51993985b", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635945178, "uuid": "cb27ceb4-e6a5-4ce9-9efb-4f91a8b32fbf", "comment": "Malware payload (Loki)", "value": "124b424d7b6ac58fcc6fb33713d0be493190e349", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635945178, "uuid": "b6d0ac1f-a735-49f5-8e85-83d6f02d5162", "comment": "Malware payload (Loki)", "value": "d604996f534a2d6e81638fb1ae1f904c9b5901cf577a882a2a766b509cae685241585fea676abc4956eb20e2c884b4f5", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635945178, "uuid": "71ba904f-dc8e-4eb4-ba98-e9b148923461", "value": "T1EF6423B136D3F2D3DEEDD12170531C9A9E008A1BCAB4CADBC98C81BB27295506F185DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635945178, "uuid": "d54cd884-5511-4525-adf0-53f74369a5a3", "value": "6144:j7UBpqTg/Yn9fea6KVPCKUDY3sJgkjBQ3biwgebBsnvYwjiV:jQBpMgAn9ZJgnMcJFimwRbtwuV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635945178, "uuid": "f8e3e9df-3394-4843-9759-6db9ea1270e9", "value": 315601, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635945178, "uuid": "b6c3c432-9fc6-40b6-9a4b-c9592e999f25", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635945178, "uuid": "61ad6562-3056-4a9d-bdfd-a6075c4fd057", "value": "payment advice.pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42c4c23c-3c8c-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635933365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635933365, "uuid": "63c35367-3f2c-4288-ab8d-da13b8e1267e", "comment": "Malware payload (AgentTesla)", "value": "db65362f5d3f04c1e71f3ab313084115", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635933365, "uuid": "faef9130-385e-498b-b44a-19bd5f4333f0", "comment": "Malware payload (AgentTesla)", "value": "3df8c0daeb451b3c9d9778849314fba9f20abba4411a1d2478106120f22cb929", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635933365, "uuid": "8c0e0c8f-5032-46b8-ad69-46d0be99b4f7", "comment": "Malware payload (AgentTesla)", "value": "3da561abe398c8576b9a5357e439c1188b900d9f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635933365, "uuid": "1e0469a4-217a-4795-8f20-75f139d046e4", "comment": "Malware payload (AgentTesla)", "value": "11c9f36922d327c5277f962823e8a31392b2d062937392fb2fe82e72a223ef1323d5f79a99215a7301e966547f6d2651", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635933365, "uuid": "bb94e465-c7ab-4903-8f7a-34a217ce7a42", "value": "T12FB4F196316D9B00C72DB7B170A6D310BBB27D3A2542EA0E1DCA75CA4A733018F36E47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635933365, "uuid": "2f09470b-3b9c-4d4b-beb3-76fe1ac06087", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635933365, "uuid": "29e046f2-8755-466a-935e-88098fa43780", "value": "12288:5LIbw8eGZ5j64iZV32yZp+arwJ1BhzmBIl1:58bw8eGZ01ZV32ymarSJpl1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635933365, "uuid": "a859dddf-93c4-4bfb-a0dc-aea7819dc385", "value": 494592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635933365, "uuid": "fd0a1b71-f153-47ef-91ad-0092f13ff363", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635933365, "uuid": "03a21051-aca6-41cd-b00c-fe15158d9bbe", "value": "2021-08-30 PI #0001 & Bank Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7db2d2ac-3ca2-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1635942913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942913, "uuid": "83da79b7-2490-48c6-b75c-b07b18861bc0", "comment": "Malware payload (RemcosRAT)", "value": "56a32ba9e009a7cbe0c1071aeaddcddd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942913, "uuid": "3be85f8a-8dd3-464a-8ef6-2dc65541bc2f", "comment": "Malware payload (RemcosRAT)", "value": "3e02da634bc84eb76e92890a518a878a809cbc68281fd9fc0ac237bbe05ab1ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942913, "uuid": "0b7bcbbf-46e3-429d-9c4b-0a7f6db61fda", "comment": "Malware payload (RemcosRAT)", "value": "47c7e5f03cefc13f969eb5de45c1abb383d906f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942913, "uuid": "737c0f16-2e87-4bfc-8e2a-c2da1d09586c", "comment": "Malware payload (RemcosRAT)", "value": "b7f4f8bc3fc474bd23755686a1669d56d21ae81e6d4bbb17c9ca3f7fab8b819906a7cfd7519e34e97a66ed523858375d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942913, "uuid": "7d3d7d25-d227-4f55-bfeb-2ff4bd5e9a21", "value": "T1D5F40102762D9B11C3AC73F260DA9361B7B47D2A5842E65D1DDA36CE19BB3028F71C87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942913, "uuid": "ba0ae9cf-9642-484e-a8c7-9873bbf093ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942913, "uuid": "b23224ca-d8db-4157-85b8-99092c6b4145", "value": "12288:YCIbw8eGJxXj3sh9ss6o7EK1n3dV5qm/BLZAm0rlo5BIl/gqRIR6vnWH1:Ylbw8eGJxXoh9eo7hvqgem0K5gNRFfc1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635942913, "uuid": "4b4db668-7c41-45cf-853e-ef0c7968a8b9", "value": 758784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635942913, "uuid": "b393a768-0a1c-4fae-a700-2aa56f837971", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942913, "uuid": "fd24e76c-c17c-4f27-afb4-280fc0c90087", "value": "BL-NO ASIAN SHIPPINGS DOCUMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efccb5e0-3cda-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635967156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967156, "uuid": "1da94d9a-e687-41a5-be6b-f5d71062d085", "comment": "Malware payload", "value": "bfcacc8d5aaa387bd37484b7a83f96ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967156, "uuid": "5097699d-4678-4930-88a0-10a0ba3e8eb3", "comment": "Malware payload", "value": "3e4575383e55b6d8ba2ac45d2cde04b2c682562d8f86ba6e62fc151d131b3ac7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967156, "uuid": "feeee781-48a9-4d3a-8d97-b109fd67b22c", "comment": "Malware payload", "value": "0002302be69006b53d77420f177c2df1f4217299", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967156, "uuid": "74990e30-71ba-46ce-ad76-acbe7e1665e1", "comment": "Malware payload", "value": "36d7ae0cc6e5ea3d0ed586e060c2506ea49fda8109f2f0abff34db9a054f3bcf988720a4acc42a791978d7967a0ffc08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967156, "uuid": "78824394-3b94-4120-9e3f-38b5a8e83e96", "value": "T1F0A4D010A6A1C035F0F252F44ABA9369B93F3EA1677490CF23D526EA66746E0FC71347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967156, "uuid": "de1baeb4-3df4-47f4-ab61-6ab352ecbe8b", "value": "7e51d9833813c1a3fb57baba54855909", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967156, "uuid": "1ba837f6-bd9f-4030-a190-bc044592ddf5", "value": "12288:5wNA97PPKNJTLceYpTAgX8vuu30+reK4/0uHkHf:iNqPyNJceYpR7u3fbu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635967156, "uuid": "61cbf5e0-00d0-45df-8865-5f22ecc6f67c", "value": 479232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635967156, "uuid": "5a558906-ba08-4c75-a77e-eff0afc1e348", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967156, "uuid": "1fe20607-9ada-4a3d-a861-f9ca73573fb1", "value": "bfcacc8d5aaa387bd37484b7a83f96ee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18651e40-3ce3-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635970660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970660, "uuid": "6eff0be0-91bf-4e1a-9286-125e001bc070", "comment": "Malware payload (RedLineStealer)", "value": "b5b1f83525d80662248e101459354a7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970660, "uuid": "60d12a94-1d45-4538-a6b6-1f87c4058fe3", "comment": "Malware payload (RedLineStealer)", "value": "3e64d7c3c2fc7e7b55352165b23986bf8fde895b989c7c9a8480130666a546bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970660, "uuid": "15afb7e3-ba26-42c0-ab21-91760aad8f32", "comment": "Malware payload (RedLineStealer)", "value": "c0aa6c0eaaee32131fbec95897bc5022d7deb71a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970660, "uuid": "333d3420-386c-4726-9709-0d36dd721911", "comment": "Malware payload (RedLineStealer)", "value": "1b6a23963c1cb41bdbb65b3d62d002ca5987d6340fb48669e3151edf0b028ef933d933ffc6f1b04545424285943dfca9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970660, "uuid": "50019bc0-e2d0-47fc-86aa-7c45471ccb5a", "value": "T12184BE00EBA1C034F1B216F84AB99269B93F7EA1673450CB53D516EE4638AE1FC71317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970660, "uuid": "e6a58cde-c8ee-4ee0-a8ed-028865f407da", "value": "e024db68009cf7f32dd817cae1867bf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970660, "uuid": "0a924486-30f5-4c1e-aba4-89cf65819b83", "value": "6144:crkmDhFh/mT++w5MDZ7bMeHXRjaxPEdxxr9k90RJAFf:cwwFm+B1e3RjaxPEFr9kKR4f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635970660, "uuid": "bef56803-166f-4cc1-b5e1-d8688349a76c", "value": 407040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635970660, "uuid": "33fa9f64-308b-4713-b80c-b95aaaa4d160", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970660, "uuid": "bd126325-33f3-4de1-ad83-8c758ea5415a", "value": "b5b1f83525d80662248e101459354a7f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "601c1c2f-3c81-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635928690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635928690, "uuid": "3de45336-62dd-4bb1-837b-06fb69a544dd", "comment": "Malware payload (Loki)", "value": "20795e246cdfbeae65f0327b30e29e55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635928690, "uuid": "38c7a2e7-1ef0-4d0e-ad06-5d04b53cd983", "comment": "Malware payload (Loki)", "value": "3ea6b264f188f2206dfdb837c6c5c367c3b89dcc97c6116aee99ec7caaf99e35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635928690, "uuid": "4434f6dc-0e21-4bf8-ac85-f1d767b9f390", "comment": "Malware payload (Loki)", "value": "f77af7cc2e0b650365a8834fd065bd8b70334c4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635928690, "uuid": "515de788-ebb7-491f-b464-05d940e607ee", "comment": "Malware payload (Loki)", "value": "069039f028661a8e8dc82fc9403cbe1237861ffda1cecc76280db01d0ff8bdc9d2709fdd114973d8e54bb72ec83b7995", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635928690, "uuid": "89c58bea-cb66-4b33-aeb4-c0a291aed075", "value": "T180F41620B35D49C9C6FC3734CF25D1B017A16C6E2A10CA5924F43DFBBABD6136631AA9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635928690, "uuid": "e90d2032-fedf-4f55-9992-8b9d63a022e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635928690, "uuid": "17a8e82a-11bf-4c8e-b6dd-0fc03aef3880", "value": "12288:kOT6X9iRqcUn95mVlihCSx1gyuF7EzqZyJjLTGg0:H6EdU95mVliIm1gyuNNZyl6g0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635928690, "uuid": "7ed8145c-91c8-4660-acc5-13c318e3e528", "value": 733184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635928690, "uuid": "270b3afd-2bfb-400c-9f38-710182cdd544", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635928690, "uuid": "1020da81-bc4e-4fa3-98dd-cc63635df3b5", "value": "csrss.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d91ab58-3c98-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635938510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635938510, "uuid": "82ee8bfc-48bd-4ac8-ac96-3be38b91e64c", "comment": "Malware payload (AgentTesla)", "value": "568fbf93c9a9ba65e7d003cd930c9f92", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635938510, "uuid": "85d45afa-a966-4a3a-a499-68a60938627c", "comment": "Malware payload (AgentTesla)", "value": "41ed6024d8a826f7326a11694920ea340164c35d97910b6971e2c029a1774ef3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635938510, "uuid": "3924bcc0-7dc6-4012-9bb4-9b125d324d24", "comment": "Malware payload (AgentTesla)", "value": "abce361a3d3344d30d0505d95a527ad41333e8a4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635938510, "uuid": "7ce407b2-ac19-4183-a123-d6b79a3ec7de", "comment": "Malware payload (AgentTesla)", "value": "bf83aabecdb40ac9a11948b9f77cfc3bc09161667cd0a2d2fe04fe2f12d55f1809d1dced6f5ec85a5e575ad56834f90d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635938510, "uuid": "dfe14bec-3c60-4a51-95e5-06529ca1800d", "value": "T16835603538E8748CE9D6483044DC2C521D5AF9733D9AF15A90E3AC4CD47A087AEAEE77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635938510, "uuid": "3416208a-4c89-40ca-9080-5b65c1f402ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635938510, "uuid": "52f65193-56b8-479d-901b-31cf047c506e", "value": "12288:3UXTWyCES8qT9bRZ9bRoqJFTPqAN20uAJJTJYOWmXcjxsNGIgbO07GiRJMtugdY2:3UjWyCESFtDtoquiXunOlqxs9t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635938510, "uuid": "3e180edb-e231-4273-bc32-9aaacc99768e", "value": 1149440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635938510, "uuid": "830c8f6a-32ad-4760-8d37-838681c42d0a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635938510, "uuid": "17b4b14b-274b-4f79-a129-1d0ec63fd049", "value": "wPZ1ZEOY4zzYMZC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62176264-3caf-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635948450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635948450, "uuid": "43dd41f7-ae24-4a42-b5dc-a9550f80b79c", "comment": "Malware payload", "value": "d9023f6c5760eaa89cbc81c7361dafa0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635948450, "uuid": "998b2c77-cf97-49dc-9955-8b969e3e7736", "comment": "Malware payload", "value": "420328bee55ac22a09f0ddea0faed388178ca735dfbe3ea2ae2f24b30f620279", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635948450, "uuid": "5ce08bec-85b7-4cbd-bf64-43843cd2f614", "comment": "Malware payload", "value": "3c8db4aa626f6f28cd7172c46b290d301c1ac938", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635948450, "uuid": "97a01f76-fb0c-4ce5-bf68-324df1c7cdde", "comment": "Malware payload", "value": "4408b1161dacc28795cd6d11f48d9e69bc103850f0fa1ecc2bb0f2788de7fc10861b8add9dd53a18310395ba57ad6ab8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635948450, "uuid": "af1d817d-61ba-4991-9df8-feac8385b3b2", "value": "T10A81871613F5B08ED82A2DBBBE6D8714C04AB2D1D352852E7363BD523954C399D60F25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635948450, "uuid": "54b1eed4-0801-4fe6-b2af-a5d81b82765e", "value": "96:/12nIlIv2+nkLk2SHGSj3CKie2Hf1THOXgsc:0nuIv9nkrSHGSjy3/1Tuc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635948450, "uuid": "10e3f16d-c5e1-422e-8821-70ed74e978de", "value": 4096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635948450, "uuid": "de4f63ac-4960-480f-a0f7-72dd05d1d012", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635948450, "uuid": "209f0f62-0c23-498c-98d6-1124ed6e6b3d", "value": "test.test.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff8cd2a4-3cb6-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635951721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635951721, "uuid": "9837ddc3-918c-4116-ad82-3192e033df25", "comment": "Malware payload (RedLineStealer)", "value": "2005fa74046056c1ff4cfa93ceeda649", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635951721, "uuid": "03585d35-0522-4409-ac71-0db8b87ace96", "comment": "Malware payload (RedLineStealer)", "value": "42691ad32a257fc039ac17e842f2a988d851b6324d0041dd68e2ad845603a634", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635951721, "uuid": "e0bc8d72-6ec3-477a-a76e-9f5cb59204ca", "comment": "Malware payload (RedLineStealer)", "value": "92c436011d4be28b88ac5045c0839d67f83ee132", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635951721, "uuid": "70475fcf-ea38-4f87-9c45-b2ce219a385e", "comment": "Malware payload (RedLineStealer)", "value": "46f964f8282a4543165ac67845495bfe12fb805ed885c0e28b4adc73a14b0714456b00afc02f2a22c97ff57e5693c12b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635951721, "uuid": "84c88793-bbe5-4af0-8571-d8db00a429c5", "value": "T169C40F1C36C2C254FD67B9B6C7A3E610BB7230E5432F6BC89B8896CC96091352FD1E95", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635951721, "uuid": "180a653f-e0a9-4147-b892-22c9bd210a55", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635951721, "uuid": "17eab351-7b68-49c1-8f24-bf71162960d7", "value": "6144:4Qt+NHosZHQKqvYtl5hSHFhbdALfpAHaAL1/0ADFyQ2xyhUn0o:v0osVQKMYtlvSHFHIWaARyQ20a0o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635951721, "uuid": "af734bcb-6ea8-47ce-9197-7a9b2fb3aa01", "value": 569752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635951721, "uuid": "d0943be6-1aa3-49c4-9c31-30bc9e147bc0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635951721, "uuid": "fcb03278-df83-42cf-a124-74a574bfcdb1", "value": "Fortnite Pulic Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82a69bed-3c89-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635932184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635932184, "uuid": "4230d2b3-4973-40b6-9530-4d49e8b34a9d", "comment": "Malware payload (Formbook)", "value": "466e23c6251eadd8438db3c5178d7c46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635932184, "uuid": "5384e344-4078-4c3f-bddb-3396ce749fd9", "comment": "Malware payload (Formbook)", "value": "42ce908f714ec90cab2783d0fd28287ed0aab681db276b69f247f2279a4119da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635932184, "uuid": "256b596d-a1bb-4add-bd9e-5f72cd1a7bf0", "comment": "Malware payload (Formbook)", "value": "dee504590de16151bedead2a2fc87c3159cafd37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635932184, "uuid": "bcf771ae-49db-4e78-ae88-6156d1c04cfd", "comment": "Malware payload (Formbook)", "value": "7d47355baaa61b8f8d2f3f9dda9c5969947d9d7a5294dad66394a656d7baffb0adcf69e97646cf43a544f79f589a37a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635932184, "uuid": "14bb8aa4-80c2-4931-bca0-0cd726b077c1", "value": "T171A46A96A28E1A03DDDBE371B2F26B18A7BADE741E33D64E714E34250F32BD31605485", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635932184, "uuid": "a66840a7-ee18-4e99-8250-322a90786770", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635932184, "uuid": "424748bf-de79-435b-9ea9-8d5b51ae3104", "value": "12288:uvUqf+zgYgAqasbVH4h1tzvtJHc1fvow+Be/+rYK5kt:uvUqf+zgYgAqasbVH4hPz33W4Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635932184, "uuid": "e16d2051-6af3-4cff-8f96-3fb9649072fd", "value": 477936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635932184, "uuid": "48652f58-ac21-4ba3-aca9-0e0f9db0155f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635932184, "uuid": "ec5baf96-f760-4598-b592-28b494a5ca72", "value": "DHL202038,PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "219c3b1c-3c71-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635921713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635921713, "uuid": "7773e56e-e871-4798-b417-fed74091ea98", "comment": "Malware payload (AgentTesla)", "value": "25e205a6c388b74fff3cd401a9c3a8aa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635921713, "uuid": "d8862dd8-4c27-414d-80d3-d5e96293bf18", "comment": "Malware payload (AgentTesla)", "value": "42fd3f9621d174a744f6adc12743ff498cd8beea73d52001df290b4e63226f89", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635921713, "uuid": "1e253e14-8089-49de-b1fe-2f41d04b5bd5", "comment": "Malware payload (AgentTesla)", "value": "dde48e2980b8b17f12f30f419a4ab544f2db9904", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635921713, "uuid": "b7e453ec-339c-4bb9-8eeb-91e580e322db", "comment": "Malware payload (AgentTesla)", "value": "58a8ed733edb9bb8725a4a3cd9ecf145dd9ec9dcb02b2ac7d23c1e9bee735b629ec2f561e41b6d668a2b14942f1c49cd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635921713, "uuid": "2fe5c790-e419-4715-84ba-d36560b3b660", "value": "T18E32AE66B58AC12ACDB142BCC11E6E3B3A1ED0E00664667E6163F2280B734D7270F665", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635921713, "uuid": "12374b89-5e9b-482c-9b9c-602a7f97827b", "value": "192:xrXP/840SdSxjOFE+JScOGP6glQjFiAFs+j8joAmphUiSL4oRYbr:dXPB0SdSFGGGilns+ojoPUN4oq3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635921713, "uuid": "1ddecf64-b61b-4640-a138-77acf03c5755", "value": 11881, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635921713, "uuid": "496bfe44-8b72-4439-a746-4366234e3032", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635921713, "uuid": "bc409a51-6bcb-49b4-bf89-49f2c6419b1f", "value": "Purchase Inquiry_pdf.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f0f1e47-3cdf-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635968953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635968953, "uuid": "037cfa23-eb0f-4c2a-b57e-1e40b2f80b1e", "comment": "Malware payload", "value": "b421fdd683ec8ab4487756a7583f11a0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635968953, "uuid": "1e2d3577-7388-4111-8641-504280823f09", "comment": "Malware payload", "value": "430294a75c0360ae893f412d8d82451aa5c9c073761e53bbf2a2a924772c5e4d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635968953, "uuid": "b2562e52-76ef-4e15-94ab-bf8c96312447", "comment": "Malware payload", "value": "29f2f216ab3a74e4d840929a607c87b73768c43c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635968953, "uuid": "9289918b-105f-46ff-b3af-94d2676ad55d", "comment": "Malware payload", "value": "36ac77677a4de8d2239837d97e0f1edce3f614f4c0e71fe3e34909d54dbdcd866a2aba90f2ba925a38da0d512200a788", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635968953, "uuid": "52e3646a-05d4-4df9-be20-dbe51f28968b", "value": "T180B3715131DA688BEB7659F98FC5F01D0BA6B1675805F1C86C5193DA8983F808EE2F33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635968953, "uuid": "7155070c-b311-47c7-aeef-a8984861c97a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635968953, "uuid": "45d2a50f-de59-44c4-9035-666365e9f090", "value": "1536:N2O2WPo/6vEw9cHWBH3MfeOlMyiWYY1QCw8J9VTliZfTZfe8:N2O2qoSzXXMfeU1ii11w8J9VTl6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635968953, "uuid": "c4c4f8eb-5793-4dbd-8129-628140dab572", "value": 117760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635968953, "uuid": "6d31c2a0-040a-4043-9117-4612567764dd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635968953, "uuid": "3948e61c-f66e-4341-bf3c-f163f59bb774", "value": "b421fdd683ec8ab4487756a7583f11a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24de3309-3ca1-11ec-843c-42010a9c0014", "comment": "Malware payload (Kimsuky)", "timestamp": 1635942334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942334, "uuid": "4aad113b-dbfd-4663-902c-4af6ecf9940d", "comment": "Malware payload (Kimsuky)", "value": "939143071f46d4fc67e7e4896483863f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942334, "uuid": "2acb7f02-c8bb-4cd0-ac80-bb7df3bf38bd", "comment": "Malware payload (Kimsuky)", "value": "43cd47c84af6fe498e108ec43eded1b3de5e1501cffa0d1e7cda7065480de6f6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942334, "uuid": "0321d3cb-720d-4eae-b878-2281d37aa222", "comment": "Malware payload (Kimsuky)", "value": "68dac8149ef5c3ea79b0e0eaea8d8d7d8f00367b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942334, "uuid": "73d7ac15-26c1-4320-8e30-00030d42cbda", "comment": "Malware payload (Kimsuky)", "value": "53f2811036443ef1917f7aca1ce78eb945e2e8ea254da8ec69590c2a18d581b141a8f6a2424ce3a3b70b34ca8ae93958", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942334, "uuid": "31d9d8c9-449b-4e76-807e-8b00c28460a3", "value": "T16AA37C4174D0C471E1BE1E3D0538CA611B6EB930EEB8AE9B238801795F742D1AE3AD77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942334, "uuid": "51ecbb8d-0003-459c-b0aa-6247d88a2f01", "value": "84690a811e80002f2e6f102dd58082fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942334, "uuid": "5cd47e55-8f8f-447e-a18c-4f98bf16f809", "value": "3072:bMdDmngUpDgAqAoNgG3/F+g7WHc/kcVaPAxrIJiGT9LsZ:bMdigS/qAI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635942334, "uuid": "31413091-0b22-4990-aac0-330bfe852a18", "value": 105984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635942334, "uuid": "7c05c9c3-7aa1-4fda-b311-4cbadc8251b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942334, "uuid": "8d1e24c7-b4fb-4e90-97e9-9f0fe044c95d", "value": "43cd47c84af6fe498e108ec43eded1b3de5e1501cffa0d1e7cda7065480de6f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19cf13d0-3ce1-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635969803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635969803, "uuid": "21d7817b-c018-42ca-b23e-7869d241b412", "comment": "Malware payload (AgentTesla)", "value": "cff91f81353d03534900b8cdfa8d36af", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635969803, "uuid": "a6c0313f-69cf-47de-9d65-276c4d6faf2f", "comment": "Malware payload (AgentTesla)", "value": "43d33500b0ac9a4aca4b2229b0a01c2cc1582ce3b74fad6aed5915a4d380143f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635969803, "uuid": "9fee571f-35f4-42c4-bbd6-4a40fca6bd7d", "comment": "Malware payload (AgentTesla)", "value": "73068d159e81ab666e588896d3d773ee639cb496", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635969803, "uuid": "2929dd20-b9ca-4521-b67b-436a19dc12df", "comment": "Malware payload (AgentTesla)", "value": "4a71d251aa0f1380c24bab83a8fd0d2ee8e728d29d180b1db53a69fb065e93c91374ca1a3be256f3336e28ace3d34c0f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635969803, "uuid": "6c3a81b4-aeec-4480-b79b-22f511bb665c", "value": "T142141207F9ACF123EB5C5C3F8C448E302D26EDEA73E56A979285F1A44A308D5693513A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635969803, "uuid": "38b7f240-c054-4ce4-b7b1-71e67e1103d6", "value": "3072:aCCuDCsALA4eYIfiHpIbSZQlOVcqQ0ruGl0fzCOI3ri/GwmCDhl:aCjOs6A4mSD6r+tlC+O0rieTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635969803, "uuid": "dc2c43be-8009-4c09-9d48-27dfd669292d", "value": 206616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635969803, "uuid": "848fbc4d-c598-470b-bde5-f27c119ce4ea", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635969803, "uuid": "2ce7a5a8-1f5f-4f9f-a3ff-bd730f3969a7", "value": "RFQ_MMC Cotizacin.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9daa502-3ca0-11ec-843c-42010a9c0014", "comment": "Malware payload (Kimsuky)", "timestamp": 1635942262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942262, "uuid": "b0e0b866-38d4-410b-8bd5-746f8ab8bb2c", "comment": "Malware payload (Kimsuky)", "value": "d4533b73569574c9b702f95a0928a81f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942262, "uuid": "20f6f5ff-be86-4280-8f16-3a658db3da4c", "comment": "Malware payload (Kimsuky)", "value": "441209705c902473baeb51b1a0594b999026d42d2d64b061081350835ff3a143", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942262, "uuid": "0359b2a9-190f-469f-81c0-cfd345b5ecd2", "comment": "Malware payload (Kimsuky)", "value": "e79a47ef184d245e4e808b1684cfac78ee2966bf", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942262, "uuid": "9651c8ef-e4b3-49ce-a8ea-8108a1bddb05", "comment": "Malware payload (Kimsuky)", "value": "fe2306f59b70f0bd81836f28bbf1535b94db386e201117a88a06efa805b56b5a256ad36a96de5e70efddbde85eeae8d6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942262, "uuid": "ab4c3fbb-1174-4006-a7e1-0a5cddfee4c6", "value": "T15FB36C11B1C0C030C0AE6E3D4530E6A29B6D7D61DE69AE5F1399023D5EB02D1AF35EBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942262, "uuid": "296cfa4a-b969-4060-ae9b-b4898cc7c50a", "value": "8308fd527beec1685acea37090f5c599", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942262, "uuid": "0159b0d0-cf28-46bd-ad9e-0bffedcdec5b", "value": "1536:F73ZXNSZxIQR9m+skJPOWHwdzDdShjPrLFMq/Zl2mfpJAWHKKsWi3cdAUkM3FIXC:F2/Iem+skJCD8hjPrLFMVIHxAUkuI4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635942262, "uuid": "b51a8453-04f6-4c94-abf2-4e735f004db8", "value": 115712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635942262, "uuid": "b7e3b2b7-c29c-4736-9d6a-c0028e18bed7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942262, "uuid": "4fbe0eef-846c-4585-bc48-da552a62552f", "value": "441209705c902473baeb51b1a0594b999026d42d2d64b061081350835ff3a143", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd0307e6-3c9a-11ec-843c-42010a9c0014", "comment": "Malware payload (CobaltStrike)", "timestamp": 1635939690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635939690, "uuid": "c86d107d-ea36-44f5-8384-c5cfd7d20f5c", "comment": "Malware payload (CobaltStrike)", "value": "edffc9d24eb8447e66648c540c79af86", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sangfor Technology Beijing Company Limited", "colour": "#10F549", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635939690, "uuid": "6ca4da78-91ab-4d82-af8c-44a2ea05bbce", "comment": "Malware payload (CobaltStrike)", "value": "44361b7ce67a65f91046f374c44850b141f96f640464f96dc89c286ba5a44782", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sangfor Technology Beijing Company Limited", "colour": "#10F549", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635939690, "uuid": "ff607530-e7f5-4263-9018-9268dd136433", "comment": "Malware payload (CobaltStrike)", "value": "76014afeffcbd143432a4fb29ead8c4ff8b92bb5", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sangfor Technology Beijing Company Limited", "colour": "#10F549", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635939690, "uuid": "e2e39e8c-843f-42bd-ab4a-3a056f30463e", "comment": "Malware payload (CobaltStrike)", "value": "9f80bc8b6d441f38716ec663016c64159f150ff9b24e6f0a0b27b8e694c482c05a5cf0fed269cd3df87691dc1ad5f128", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sangfor Technology Beijing Company Limited", "colour": "#10F549", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635939690, "uuid": "0ba8e0f7-4050-43cd-8a7a-d39583e3a166", "value": "T1D345CCF55C8A603CF05AB57E272D79B309C23F1126C0FF519749ABAD4A32A7297D7280", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635939690, "uuid": "a3d90f6f-e63a-4214-8987-0e23b7f157bc", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635939690, "uuid": "373e8282-0d6b-489a-86c9-78874389347e", "value": "24576:ORBqJZ+qz8viwT+x+Dlwx8z4LxKNjLyL8K6m7+EHmwdG:OR2+qc3NlZziKNaL8jm7VmmG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635939690, "uuid": "301e6103-4245-4862-b1dd-9383bbf07525", "value": 1219416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635939690, "uuid": "b3915eb3-0b02-4a16-9b2e-390b3553cdae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635939690, "uuid": "2b8b73f1-eb92-4234-9a22-03c554648bdc", "value": "44361b7ce67a65f91046f374c44850b141f96f640464f96dc89c286ba5a44782", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62a4216a-3cdf-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1635969067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635969067, "uuid": "400c0330-0d1e-4596-b96c-fe443c0b029e", "comment": "Malware payload (Dridex)", "value": "4e71e77f2cde09b76e04977b79c437e0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635969067, "uuid": "bcd36284-1f5f-4c9a-baa6-3e6c609a9f7f", "comment": "Malware payload (Dridex)", "value": "4470d60c8c503b8f30aff165c39785cf95a9fe29e1b4326008361daeb11099cd", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635969067, "uuid": "a2d4744c-d182-4e1e-9512-d5ae5ca98c58", "comment": "Malware payload (Dridex)", "value": "f71863d8c3dd68ed51e81af6ed7b47db247cacb3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635969067, "uuid": "1f504647-fc19-4fd4-b72f-88ee10200b76", "comment": "Malware payload (Dridex)", "value": "433aff5b22cca1d525f82e07e678f2e4bb39fe33daff1471e5b280ea1dde83dcc0907acfbfa27665347ccf16ebf1093b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635969067, "uuid": "e18c60ae-b0c2-4961-9b73-ae7ccae3657a", "value": "T15F83010D2A6A21D0F694EF3D8B4F48E2145F3A136D15794F194C9EDC8B19293FF4B24A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635969067, "uuid": "fe1f65a1-d4f1-4d2d-917c-f88dbc4a6bee", "value": "1536:8CWrPrX6Q3cWViBN3yKqxyeHw3vRMgF3oKy5hFzZsIAoakRr2HQom669qVXM4w:83Hqmc3/q0dfaguKyFNzAo5RiHQom6oT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635969067, "uuid": "c55ddc3d-ebec-4e92-b2f1-ca67a6bbc66a", "value": 84951, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635969067, "uuid": "51a60be3-69aa-409f-a3cc-0e8e31e1a286", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635969067, "uuid": "fa7d1698-b55e-46fd-9bd1-a26034fdf6d5", "value": "Bill.356244.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d92b9b4b-3cc3-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635957240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635957240, "uuid": "f31eaf61-1f2b-4fdd-af66-021361e45a96", "comment": "Malware payload (AgentTesla)", "value": "ac2f2eb80b86802f2a618c78f618fa05", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635957240, "uuid": "434bbb8a-a52e-4140-ad09-ba7aa2e01523", "comment": "Malware payload (AgentTesla)", "value": "4580cfcfd3f651090bfc5056e9e968c547139c8e93e41fac508ae35d06f2c5e9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635957240, "uuid": "91843b55-73be-4b36-a658-7d6b7393bd5e", "comment": "Malware payload (AgentTesla)", "value": "4648d5cc9ec8c990b734f23064c5bf6ac13c7835", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635957240, "uuid": "a4903c6a-fc85-4293-a6d6-b9d3db34f7fc", "comment": "Malware payload (AgentTesla)", "value": "1852c2d2f70effa397f99a90f2ede6d04995707fbc577ba0584c55b3aeb221477a8e03d85afe15fa998ed7b564112938", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635957240, "uuid": "eb1e2b80-b624-443d-885d-81ea028bbfe9", "value": "T111C423D799C0F393A7DAA05BD1856868C120197C4DD9B4ACCAE2285CFEF41E1CFD90A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635957240, "uuid": "f0629a60-a673-4255-b8e2-d97b0f90260f", "value": "12288:AR89hVE/2gKtg5pPY1lbAOP//RHetLjVDgJ/wtUM/2:A6VEugKtQtY1l3XctLpA/wKM/2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635957240, "uuid": "6fe351e8-134a-43b9-9bde-dd2a8116bf26", "value": 571877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635957240, "uuid": "baab1af4-3251-46ef-b475-3e4da3510677", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635957240, "uuid": "d10d8d79-1a57-4438-87e5-0800015c7157", "value": "Kopie von Kopie von Kopie von Data-Matrix-Label Yeso- 2021 PO45179437 Lot 2.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e8778e2-3c74-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635923077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635923077, "uuid": "342211e1-6ec2-4ba7-8be7-aebdf9cef850", "comment": "Malware payload (RedLineStealer)", "value": "79c84db0f4654d84699aa78e5d9cc182", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635923077, "uuid": "bcd7ef9f-abc5-4a69-8a89-bdd7f88a2300", "comment": "Malware payload (RedLineStealer)", "value": "46a8588f910985090eef1f0088b1cf13487ef877102e89328319a5293f6694db", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635923077, "uuid": "4523d90f-8a53-49f7-b3bf-d4cf0ecfdbc0", "comment": "Malware payload (RedLineStealer)", "value": "c16dea342e0d0a6a452fb186db873a477bf213c0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635923077, "uuid": "66c87d4f-aa31-428e-8129-29e9c035d818", "comment": "Malware payload (RedLineStealer)", "value": "d5ab9ec2c454d6a629c46ee81831725bcb7d9d7da58ad1a6e5ca1d43fd670b0eefb4a74dccbe5f77246e496e0e881b38", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635923077, "uuid": "396c6559-ca18-4f51-839f-c0c07d489c30", "value": "T1D494CF00A7A1C035F5B212F84ABAA368B53F7EB06B7494CF12E516EE56346E1EC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635923077, "uuid": "2815ea48-1fd6-4cae-b463-763fb7591178", "value": "e024db68009cf7f32dd817cae1867bf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635923077, "uuid": "74480854-cf89-40ab-bdcb-eaa03eefc05e", "value": "6144:O7kE2BpwBFgvJhk0QnmtGrt3QMNwY4aLyEvwxzJkr0y3LaI:OgE2BSNdt3uY4aLyEQzJkYs2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635923077, "uuid": "ef7067d7-ad97-4291-ba8e-d2eda583d0d8", "value": 408064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635923077, "uuid": "e6e28952-1c80-4477-b231-c8fcd666f174", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635923077, "uuid": "3de82b66-83d0-4ec8-92c2-478a69293338", "value": "79c84db0f4654d84699aa78e5d9cc182", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a50d8651-3c97-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1635938254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635938254, "uuid": "fe9df0c5-f70d-4e95-8936-3212c61c5fdb", "comment": "Malware payload (GuLoader)", "value": "2f81138cd8f82bde22a40ece894c8199", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635938254, "uuid": "4bbb36d0-1d67-4882-8623-2fb047014986", "comment": "Malware payload (GuLoader)", "value": "4797b4b672a93427a126361e058d86c443c4956255624bce2ff2e5d129f88eaa", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635938254, "uuid": "98d55220-43f7-45ee-8e44-861da962bcfa", "comment": "Malware payload (GuLoader)", "value": "8311653a1a087d985181be16b399e09812ca926b", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635938254, "uuid": "58788716-4f1b-4a8c-af86-f5f8dfe34def", "comment": "Malware payload (GuLoader)", "value": "59c0af4522cabf7a9cdfa87975a396bf75d10f1e0553ecb396f41bfe88f9afe3f4966cedf3d3d06523b31f048849fb98", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635938254, "uuid": "301016cd-b1ec-43b2-9a89-c6fd305524ac", "value": "T193227E38D206F81BD111097CD06583F1EB686153F7227D2C7095B29E07605E797EDEAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635938254, "uuid": "79126571-e189-4461-8fbe-89840adbb6d1", "value": "192:ScIMmtP+RyLG/bWo+pYOWCamWBXjtc3GJJ:SPXWR9B+pYOWCoTtMGD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635938254, "uuid": "6dbaabc1-e227-4214-978d-914c4bb1a29d", "value": 10331, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635938254, "uuid": "caeb73f7-b5cc-4e66-8ed0-2d1b20c53dd3", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635938254, "uuid": "f7cb2639-d4e1-4293-be09-0f890e05e7f3", "value": "Purchase Order PO03112021STK.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a45a391-3ce2-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635970395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970395, "uuid": "c25ab4fa-dc73-4d7f-ba17-fe38d722381e", "comment": "Malware payload", "value": "9b3768c1e2eacc3359f9f0b7f8216792", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970395, "uuid": "bee437fb-f9dc-484a-b5fa-5c69a514ffd7", "comment": "Malware payload", "value": "486e887577e346ee0bef05224b02af94cef3fbf59d293180c246ffd0228e2ad6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970395, "uuid": "5d9b2638-1a08-4dae-8d60-72253fd2aea2", "comment": "Malware payload", "value": "9ec68d6a35b663096d1292cdadb4014c04c1d91d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970395, "uuid": "034497a3-0b55-4942-ac1d-c47ca5c809d6", "comment": "Malware payload", "value": "a0b34084b50ec6da26a593026288bb7ebceab856c3404707d180e5ab88080fc79015b0d270243a21ce78062253bc84ac", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970395, "uuid": "70fceaac-3c29-472f-a06c-5de19f1602ae", "value": "T10AA3010FE1D67888C0F8A4BE828D18F18536111F550AF91F3C9E217C567528BE79FA5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970395, "uuid": "4806ab75-4d04-41b0-87c0-2268aaa9c8cd", "value": "3072:83HFzIsj8aipSW4vHREQ4iZKUb5uoJNKPWi56wlD9+D:8SOipmvxpZ/3JNK5m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635970395, "uuid": "eee4d513-bb93-4b58-a813-c4d92eba1df8", "value": 102951, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635970395, "uuid": "a273363d-aa84-4172-8405-b0635b6b7afc", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970395, "uuid": "f65c4ee6-9764-44e5-8c20-50d467af27bf", "value": "Order-3957.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea9257a4-3c80-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635928493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635928493, "uuid": "fbe3ce8a-f833-43b6-b4ad-a065d8e0d935", "comment": "Malware payload (Loki)", "value": "2634f1923b31df18f876261359afb84f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635928493, "uuid": "b3bc1ada-173d-45c0-a401-670803f36339", "comment": "Malware payload (Loki)", "value": "48b9399a27f331f20b91a7c283aa62a8600f9a817366e88b7029aa3955636fe7", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635928493, "uuid": "e41f6006-05a3-45b6-8b7a-53a443ef72f1", "comment": "Malware payload (Loki)", "value": "18ca1ca3f524f6f17fff1d8bae60846eedb4a9d2", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635928493, "uuid": "6e7bf2dc-4a58-40bd-82da-287c19a5ef4e", "comment": "Malware payload (Loki)", "value": "a977ede9830e4e14f540beff07be4a1ad0d6fb530834d5ba2cbd0fabd0796c6022e9d90c872e2cbaec56d669f0d83056", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635928493, "uuid": "53e904fb-64ec-40e0-b9a7-8c078f745c5e", "value": "T1D2141206B9A4F0B3D1DC6E7D1B11F678B3B4DCE484E39946B934758823B7301E4A256B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635928493, "uuid": "1cd3dedd-7120-4604-aaef-1e6dabe46556", "value": "3072:ftwuKBKIfkdLiNMi2qBjO+9DP8qDqFuvsQh/AnWyLOE4n8Fvgqj5/9LQgG2NdMR5:1bpAB4oOYNDqHWS9gwVdNd0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635928493, "uuid": "e1694ed8-ad51-45fb-baf5-5c3409d99390", "value": 206424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635928493, "uuid": "a6fd91a4-f724-4c4f-b298-404733bcb1e0", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635928493, "uuid": "729d3ff4-f233-4cff-8697-c045ad45f4ed", "value": "HBL#VRNA090867U6.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c5cb82a-3c73-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635922644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635922644, "uuid": "865b4bfb-81c3-43d7-bbbe-e91ae2da5084", "comment": "Malware payload (AgentTesla)", "value": "1b10f05a02211d710e91f6055b32c2fa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635922644, "uuid": "117d7332-df57-41bc-847f-17200d9e39b1", "comment": "Malware payload (AgentTesla)", "value": "4919940dc5b5eb15866941edd66d4386a0e26c67efe2bc5c8c40cdee5450d702", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635922644, "uuid": "036a5f76-3d89-40a7-a3b4-180abdf6ce0a", "comment": "Malware payload (AgentTesla)", "value": "9ed3c5bbbe0e550126f8841fb10e559444705fa3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635922644, "uuid": "d1e32a65-48a2-404f-9c78-7bcc746a9a6e", "comment": "Malware payload (AgentTesla)", "value": "9b3e7bd536943605f37b38e1fe7cdf72cd19ab05d40d7dc04257853d9ca3548ad602e16bdd8d4c6bbcdfdc9ad8fbec10", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635922644, "uuid": "03c9ddeb-53e8-430d-88f4-45c80d9d1118", "value": "T1D1B42335167D8F68639E01FAB7DDA81770EA7881929B62A36F05E807CEF75C09C452C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635922644, "uuid": "e8be2c8c-a0f3-4528-a68d-b5123637b944", "value": "12288:+Yn30/wIZ32KrcBk2oQwqLWJJuqM26sZYuFKKfCv7EzOZNpF5yk7Xmv:+0k/wHBBk2NTCJJuT26sZjFHKDTZvFAT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635922644, "uuid": "3b695730-6df4-4b9d-8404-bd1d6475292f", "value": 532810, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635922644, "uuid": "931918fa-54f8-4945-b67c-2c903bf7d880", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635922644, "uuid": "2da4ab37-bf27-4f1d-aa39-d32b5207cce7", "value": "TRANSFER SLIP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9f8ab15-3cb0-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635949134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635949134, "uuid": "899161eb-c4fd-454f-ba3b-e8e98b271d28", "comment": "Malware payload", "value": "7a7e9ec19a3fbeb8509eee79cd1d0e20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635949134, "uuid": "286adf43-9a47-4470-bd30-a4a1b66dad27", "comment": "Malware payload", "value": "49718dc1d190378688288a45d510a304f9556e2a6549f3ab3a645affeef5bc8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635949134, "uuid": "ea711045-32ff-4ced-b723-aced03a17203", "comment": "Malware payload", "value": "c4c85235ba31bfe80ebf17f9a117fac9affa0255", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635949134, "uuid": "270b3a09-b1b9-4033-b631-fe53300b2697", "comment": "Malware payload", "value": "4da64e2163aa7e6c609cdeffc843de0d8e246d63d4ea00bcdf12a22c0adb2f90c17d9ab5ee45cbc0c866eae0687ebd78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635949134, "uuid": "99f1cdc3-8dda-4d44-993f-2256c072e5b2", "value": "T1DFA49D5AB2A900B9E477D178C9674602E6B278650720CBDF13E0C63A2F77BD05A7F721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635949134, "uuid": "34621828-5907-484b-833c-757f863b7e7f", "value": "e4c88f9b8687adfc9390f0c6c4c525c7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635949134, "uuid": "921dc3c9-f8d3-4085-849b-9d8f05253bbf", "value": "6144:k2YdjzVKp2fjDXBV+n6mDqHs8Y9SOJ2FdDohiTJBcTaR:kVBzoWBy6w8IZ8DoqJB/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635949134, "uuid": "29c9ad23-ba14-4c71-9fcc-f8b4132f5971", "value": 470528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635949134, "uuid": "4fb63dfa-03a3-4530-b4c6-b42d6882a13b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635949134, "uuid": "2e810518-c8a2-4d66-ae5e-b358ba421ab9", "value": "test.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11a58f96-3c74-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1635922975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635922975, "uuid": "e4b3e6e2-e1df-492d-9d0b-86573bdf0cc7", "comment": "Malware payload (Dridex)", "value": "74a46948774bc7b1d7664dd54f4f7a73", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635922975, "uuid": "3d0a2205-ca86-417c-a01f-5564039ceb79", "comment": "Malware payload (Dridex)", "value": "4b033ec1de6ef16b79adeed9ccd5c14d867babef169109174f4d82226bb86b82", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635922975, "uuid": "6e7e2eb7-9f0f-4b47-baab-c291d6837bc5", "comment": "Malware payload (Dridex)", "value": "49a6c5bb01334d95bddba9d14103bdb364fc8af6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635922975, "uuid": "86043d0b-e2aa-4b2a-be1a-0c7230ae5037", "comment": "Malware payload (Dridex)", "value": "49c14874ff8bae3ec034c8d28f3e5eb9099dc995ef6ef24b717a5a540cd69190ab5dcd266134cb929259d2419c9bf248", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635922975, "uuid": "d0eecbbb-20c3-4b3c-b607-ade8f1232903", "value": "T17683F15EEAA8A1F2C3FCAC3843CD1CAAAD55D6657884877F6454B2091AF4387B34A40D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635922975, "uuid": "cdd51c3e-d27e-4fc4-9cd8-97c2593d4d2e", "value": "1536:8CWbPZZKz/1eCzbqzLkh/OPvTFVnxYgnqwc5S/m:831Ez/9qGWPvZVWgnqwNm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635922975, "uuid": "0652eac5-ac26-4442-a1a5-482679c81d39", "value": 81652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635922975, "uuid": "5afc1b47-0c21-4ef6-a3d7-bf7c5bf27426", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635922975, "uuid": "ab776a38-9be0-405d-9ad2-2360254cc075", "value": "Order_07664.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bf97641-3ca5-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1635944225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635944225, "uuid": "4fe23e6a-142c-4173-9331-a200ea7561b9", "comment": "Malware payload (AsyncRAT)", "value": "f5be58f17adacda8406b89b8d5327d6e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635944225, "uuid": "16cbc281-d05e-48d4-9f54-00fdb2a06d95", "comment": "Malware payload (AsyncRAT)", "value": "4b07a5d35729069069d708cf9987b1523cef04a7cd5fd09154b740bf4c93e273", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635944225, "uuid": "06c571c2-739c-4300-b3e8-cbcb1b66b347", "comment": "Malware payload (AsyncRAT)", "value": "d90c7ff8fe918382efa8c146614832a114e90040", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635944225, "uuid": "6c33410f-88f1-4e97-8ceb-5d3faf48025d", "comment": "Malware payload (AsyncRAT)", "value": "3fb2f8f3a91118ddae0f90d9ec53776b3ecd925c483c88bc2087d807b4d3d24d00db01a8c83827fbfa05b520a4c6a35b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635944225, "uuid": "056d2a2c-ef7f-451a-ab00-f6fabbba7a1e", "value": "T111D219206659093BCB7B4E37B0968111F23C5356BC1FEA4E38EA581E9DD334227527AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635944225, "uuid": "58664db5-c24a-4d56-817c-c9ac1d6b3489", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635944225, "uuid": "9d1cf598-27d5-4eef-a141-af28a65443f0", "value": "768:w6DdWSQSaS3SyA3A+ogTBemsvJCQJ1joh7:NDdW3Aq8msgi6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635944225, "uuid": "56636652-d340-444e-8e28-65d7136f589c", "value": 28600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635944225, "uuid": "e9953307-8e96-4b77-8a80-5c0124d3ed35", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635944225, "uuid": "0fe1a29b-bc16-4090-85ff-74c541d3895d", "value": "20211102_7892630.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4170c76c-3ca1-11ec-843c-42010a9c0014", "comment": "Malware payload (Kimsuky)", "timestamp": 1635942382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942382, "uuid": "9eb04710-c1f4-4120-8040-2504b761e963", "comment": "Malware payload (Kimsuky)", "value": "d2c534d1213882b62c28def230ad1745", "object_relation": "md5", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942382, "uuid": "5e8d90d5-9b2d-4183-b205-4ac17e41b77b", "comment": "Malware payload (Kimsuky)", "value": "4b244ac09e4b46792661754bd5d386e8b1a168cb1d5ed440df04c1c2928cb84d", "object_relation": "sha256", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942382, "uuid": "d165dc9a-23da-4564-b8b1-00b1fa3b7997", "comment": "Malware payload (Kimsuky)", "value": "2c1b4890e7b7cf1bacdd9bb84a72c0b586dd328d", "object_relation": "sha1", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942382, "uuid": "002f5674-88db-4adc-bf47-19cb6ec9a2da", "comment": "Malware payload (Kimsuky)", "value": "2042ee890e982f0079576ef7b5c6148ecaa61bb5abc720983275cb103444ae3dd554f9e75c926f0deb9f72aa6a8aaea6", "object_relation": "sha3-384", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942382, "uuid": "0e0d26be-76f1-4cb6-8d3c-6ce9409ef3fa", "value": "T10422B559A596126803A362E2DEDF448A8EF0990674B1E5007FCC88541FA7D7FB2F09FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942382, "uuid": "75487079-131a-4068-a94b-ace6763e4ab5", "value": "192:V0Jar+oa3lgTEDKioZ83bNRp9ck9aKm+Wzs0zv8/4XhtS1KBaYpR7e+5wXF+lHDM:V0Jar+oKlgTEDKioZ83bNRpeqaKdWzsD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635942382, "uuid": "d078ab9b-2647-4b85-b7e1-a9719aa0f572", "value": 10865, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635942382, "uuid": "7219d82f-d127-4fbc-9039-fd88a7af75e2", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942382, "uuid": "4ca40b63-d495-4cbc-a2d1-9678205be460", "value": "4b244ac09e4b46792661754bd5d386e8b1a168cb1d5ed440df04c1c2928cb84d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16e8ed04-3c57-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635910528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635910528, "uuid": "024605bb-2f2d-4551-b213-1490623a3364", "comment": "Malware payload (AgentTesla)", "value": "1f168feb6b954a286034cd271b6ecf55", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635910528, "uuid": "de7419ed-c4b2-4ec2-a1e3-5c94c18d7c63", "comment": "Malware payload (AgentTesla)", "value": "4b42aa65fb23f209b17bd48f78e498e73d78af85661dedf3429c3a552f205034", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635910528, "uuid": "19c5be8a-8cdb-4d5f-9c5d-16c2b858eddf", "comment": "Malware payload (AgentTesla)", "value": "02f8bf8979c150744e25010041f81316aeaa1d6b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635910528, "uuid": "491df6fd-9a19-44e6-aa94-e74e7f5c766a", "comment": "Malware payload (AgentTesla)", "value": "b9acc908fc7476fda7b18d6b60935aa12f7c8736b67a73b8b915884e2e54c71dd9d2846ac25f9893ffaac4e966bf562a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635910528, "uuid": "211cf4bc-16a0-4743-b881-98026dcdb7eb", "value": "T14B45713134E8748CE9D6483084DC2C621D5AF9733D9AF15A90D3AC4CD47A097AEAEE77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635910528, "uuid": "5c79c2ca-4f29-401f-86f0-c27f6e13ad0c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635910528, "uuid": "a5107fd2-cdb6-4110-9725-671bdea5ec42", "value": "12288:y6U5zgyRshQHg9bRZ9bRoqJFTPXq/yZU098NitAu7yxnUKElajGorU76upOwrcft:yFzgyRsh3tDtoq+/yZJ98NX4Sft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635910528, "uuid": "4d4c3d82-03ff-49f3-b14a-0891d3202542", "value": 1190912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635910528, "uuid": "ae8b0951-cd84-4780-8119-9da6d5b30329", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635910528, "uuid": "2bcf1f11-e6ca-426b-a7b2-be4cc2e39fdd", "value": "QUOTATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b3ba124-3cdf-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635969162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635969162, "uuid": "5ce57bc1-3a40-4a99-9356-45dd70f524a5", "comment": "Malware payload (RaccoonStealer)", "value": "c83c3e2f58f137bd4c40cf4d1e3376e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635969162, "uuid": "851542cc-e8f8-4aaa-94af-667bc023be7b", "comment": "Malware payload (RaccoonStealer)", "value": "4b512e2fc16ed63873e6ebe3afc4a667ed2b54193a6f589dc4c30d0bc2c50c23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635969162, "uuid": "356ea95b-2af2-4778-afb3-e07e92357f06", "comment": "Malware payload (RaccoonStealer)", "value": "1b43c98c620d2c0df9f801b61c2775f50af2d47a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635969162, "uuid": "c8242b24-1abc-4abb-8afe-2529df7f4af7", "comment": "Malware payload (RaccoonStealer)", "value": "90d3f36940f86d4661370884562318a29081658c6e0825c88cc6e65e984e04cdf61b5d6185cbb2264d3d7e7875dbbb27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635969162, "uuid": "230705d0-a88b-4359-872c-22f769718dd7", "value": "T166C4E000A6A1C034F4B756F849B69269B93F7DA0A73494CB27D427EA0774AE1FC31367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635969162, "uuid": "0102bdd2-b111-43bc-9935-cbefda4cfbda", "value": "59ee824971f432b778ca9bd24dd5ed5f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635969162, "uuid": "ffc1d579-2950-4ec7-9a6e-29d6abc0f0cd", "value": "12288:0Pxtin6eq4uwHrhcs0EDnjBW0cE9++8eSSQawwsGYfyMV9:UI6ebuwH9JYTE9++BJ8fv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635969162, "uuid": "12dac7fa-1970-4d46-b083-53fd3eaed19c", "value": 551424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635969162, "uuid": "d83edeaf-635f-45df-bf3e-7bbc80855fb8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635969162, "uuid": "521952e5-6fab-4d8e-a5d5-75936d48414e", "value": "http___backupsoldyn.duckdns.org_11d_solex.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c94679f2-3c55-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1635909968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635909968, "uuid": "34aa814b-154f-42a1-b5e0-da98bf6c891e", "comment": "Malware payload (Heodo)", "value": "c9a3e5480af67a12da322b152b87f8a6", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635909968, "uuid": "65c6d2e9-6ce3-44f7-801c-ff4895cd93f3", "comment": "Malware payload (Heodo)", "value": "4bc115f3873bd7a9eefbb239256c9abc1d42645e4c81081d5e50212f7ae93b06", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635909968, "uuid": "9a01e5eb-fff7-4846-831a-2d1efd37684c", "comment": "Malware payload (Heodo)", "value": "a34e39e2ac66abbb628f3651fd36179829c0d892", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635909968, "uuid": "fe3de483-bf41-4690-8d7e-69e728686afe", "comment": "Malware payload (Heodo)", "value": "d710325831cf35fb0c63afcbe26cc9d6f55c324322910b56905e770ed4e359380caf6d5105d213beed708256c3f08d2d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635909968, "uuid": "41cdcf09-4fd1-40fd-89d3-7d9323aced3f", "value": "T12E055920F35D4D89C6FC3334CF25E1B017A16C6E2A108A1924F43DFBBABD65756316AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635909968, "uuid": "181c91fc-950f-4115-b36b-ac3248f757a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635909968, "uuid": "bafc03ac-5166-4d17-b1db-450a337abf09", "value": "12288:NJrW3dZT5fq44WDNUzaucA319yuF7EzqZEJNLTei0:7qZfq44oSzak319yuNNZEnSi0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635909968, "uuid": "9a49381e-cb3c-4b2b-8e5c-b4a5622fd453", "value": 868352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635909968, "uuid": "1437dc1d-0590-481b-b6f6-fb806d152208", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635909968, "uuid": "46c2a48a-6ae2-4467-bcd0-39c7ba41ba0a", "value": "\u6211\u53f8\u5df2\u532f$23856 (Our remitted $ 23856).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b225954e-3c48-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635904346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635904346, "uuid": "c5d1929c-1941-4b15-83f3-6a9f0c447ea9", "comment": "Malware payload (Mirai)", "value": "4f596a5915c7a5b3fc09299b21a35d4c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635904346, "uuid": "bda452de-a0e8-4a5e-bb8c-20e169bcb4ed", "comment": "Malware payload (Mirai)", "value": "4bd66f1ea51ec4139e19b60c50d93a69533950e019242a18e14af0bedca0100d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635904346, "uuid": "1caccc93-c85b-4c8b-9070-f6651427fd5f", "comment": "Malware payload (Mirai)", "value": "d742a46c030059360ac8df6499e80b298c9f8ffe", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635904346, "uuid": "3e5aacd3-7b3e-4c4d-a3f0-8e86c9461690", "comment": "Malware payload (Mirai)", "value": "f1c4632ce36f5e1a9b9195abb1cdff34a9d0b4f72b4a6f84a9dde920a071423a9ec49419cf8e2527595a384d9b1b4060", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635904346, "uuid": "928e612c-abc8-40e8-9d2e-863624e6314a", "value": "T105C3740E2E259F3CFFA9423987B78F25964833D636D1D585D15CFA022EB024E341BB99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635904346, "uuid": "e349eff0-dcb0-4497-b492-09f06d5be23e", "value": "1536:lB8hJDwfMjYbfRbjIy0IpvuIqTHR+Xk5+RnQ548pHta3msG4sEReansw6ZI8ATFZ:kUkICy0Ipv9nRQ55Swcsansw78ATFHQu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635904346, "uuid": "b0c26c15-adc3-4288-bcf3-73347dba29d8", "value": 121016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635904346, "uuid": "f176ef0e-e228-4d34-b53d-a006f5a2f762", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635904346, "uuid": "a3e58b74-c3cf-4313-b3c8-3e001f15e963", "value": "mips-20211103-0152", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bdfe79a-3c9c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635940306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635940306, "uuid": "6f2b0962-2099-4200-bc56-1868b4db5ea5", "comment": "Malware payload", "value": "9fcfea1d22b1c54b2ebe02e0ba344bbc", "object_relation": "md5", "Tag": [ { "name": "empire", "colour": "#D9A909", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635940306, "uuid": "9d29fde4-71df-4b3a-b40e-1be9e0a16416", "comment": "Malware payload", "value": "4c3857d1b17b76c2520ce3892dfd7c527332910c4795e1ef029825504d6b907f", "object_relation": "sha256", "Tag": [ { "name": "empire", "colour": "#D9A909", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635940306, "uuid": "ee63f031-6322-4642-af7d-aa4c4fb1deab", "comment": "Malware payload", "value": "92e03337e0d9805fbd610982cb5bff2f3053a0a0", "object_relation": "sha1", "Tag": [ { "name": "empire", "colour": "#D9A909", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635940306, "uuid": "27c4516f-899b-4992-9b19-c5b57b55ae8f", "comment": "Malware payload", "value": "912672fb159c7f26797436a415682602c6dc1e3354fbedfebe29b97bcf0fe228505fee1051b1482dbe4f1c0bf09cffa9", "object_relation": "sha3-384", "Tag": [ { "name": "empire", "colour": "#D9A909", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635940306, "uuid": "a5a0f02e-5808-408a-ad17-d63ba93023b6", "value": "T175447D30DA604E5F23B362DA392078E02F7BE2BF41094867F0E5E65D7C97C65E693216", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635940306, "uuid": "3c26ad44-4148-44c0-93b2-489dd19579ed", "value": "3072:IGaSqgnCVGykNhsXXUKvmHp0DDGNOqw9HIX3UHkliWh/jPjRCfvQ++d7yu8m:IGaSVnCVbOKcaDD0Oqw6UEM8/pgQP7rH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635940306, "uuid": "70ace71f-8cae-490c-9be0-f51cda77c9a9", "value": 273299, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635940306, "uuid": "bc7a65d0-f445-41b2-9898-6d9590eaa58d", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635940306, "uuid": "ea794b3e-2fc0-4f81-b9bf-bc8c64e5656a", "value": "Kensington Palace Letter from Harry and Meghan.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43375795-3cb8-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635952264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635952264, "uuid": "579544d9-7d53-4ac6-83de-ed33bbae5776", "comment": "Malware payload (RedLineStealer)", "value": "987bdfc2dffd12c87070bd3a4571b9d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635952264, "uuid": "47ca2b24-1335-4b1f-976f-0ad1973e22f6", "comment": "Malware payload (RedLineStealer)", "value": "4cf53287961a89ed4fc71cb7dfdf03dfc41c5c21c0d3eb1985a68f9f8ebbd7aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635952264, "uuid": "b86f8203-440e-41f9-9c36-71d6b5080214", "comment": "Malware payload (RedLineStealer)", "value": "e63fc5097f4f465b6fd2fbbd85c9ffaa3b550abd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635952264, "uuid": "80930548-dc1e-4909-9dc1-8955ed7db4a2", "comment": "Malware payload (RedLineStealer)", "value": "c26b1be241e9ebd4650e892d141854e986a1cff1d02e1c0ee83088f45260ec6fea9d2a5c5d82efd8b8a0fe93ff899523", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635952264, "uuid": "ba556d65-ae5f-4af7-9407-14fac548d693", "value": "T184C4111821C28F51FA9556BA87A3AD00BF5224C382AF57CB9B498BCC4705731EFC9F95", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635952264, "uuid": "8050eff7-e1c0-4095-9f47-07268a63bf72", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635952264, "uuid": "4b050b32-02e7-4928-aa68-55217e703641", "value": "6144:uVv+WDUibIgmR6C+TeaJs+FRT1m3nyM2BzXHyWBjzTk3IYZkkwzmPs+QD:uVv+WDUi7LKX+Fvm3P2ZSsykkwz8K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635952264, "uuid": "081d4bb7-1cb5-4435-b268-0293052dc0ae", "value": 591768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635952264, "uuid": "ea6fb422-d1b4-4689-a63e-fd7126bca521", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635952264, "uuid": "540a9a36-6f61-405d-9feb-ab3adfc27560", "value": "Fortnite Hack v3.8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8dfb911-3cca-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635960219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635960219, "uuid": "c094b692-5fe0-4d14-9d4b-620e6ace8050", "comment": "Malware payload", "value": "4da8c38808017d5f01ba220a5e02944a", "object_relation": "md5", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635960219, "uuid": "5a32b919-11e0-45c4-9815-eda18e18e59d", "comment": "Malware payload", "value": "4d93f2c905c4bd34bbe79e8cf8e8eba3c8cc3078335ba9eb31551c3b0ba24e01", "object_relation": "sha256", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635960219, "uuid": "50f4d0c3-c763-48de-9b7c-5516aff28d75", "comment": "Malware payload", "value": "84df8f6fe52cd80df820c279710648ed9e9d81f7", "object_relation": "sha1", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635960219, "uuid": "04ea5089-7062-460b-88c6-6de3dab75f96", "comment": "Malware payload", "value": "0e5531d0e8438eae7836199eb8b2b6eeb76cd21ee6c0fa12ae51b0308a4696fc600abf74d756317ef12a41a93ca695dd", "object_relation": "sha3-384", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635960219, "uuid": "232fd9bf-6048-49af-a837-71b145bd9644", "value": "T141C2647EF58B0E48DE56C66C060A7B65064DF52D72C480E23AB8DB38795D85B8B23D3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635960219, "uuid": "f5e8a248-9b89-4a69-afa1-45d66dfd4550", "value": "768:7+jO/O2+SZjzWPLOK15jnB6WHmUVOyRRAAntTEOYV:8R2DpzWPLOK15jnMWGdYEP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635960219, "uuid": "2677edee-07e5-4ca9-bc57-a9e34674043d", "value": 27315, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635960219, "uuid": "811d0bb3-e104-4380-8a75-feb7666cb8b3", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635960219, "uuid": "8d9c4d78-f86d-4b7e-8324-3bce58994456", "value": "4da8c38808017d5f01ba220a5e02944a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "787e0f75-3c4c-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635905967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905967, "uuid": "a22c459c-839e-45fc-a232-ceee7b44c9d2", "comment": "Malware payload (Mirai)", "value": "09f3916841211512f5cf2b0300fbe8ae", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905967, "uuid": "a6bfc38c-3ca7-4f5f-95ed-656cca281db3", "comment": "Malware payload (Mirai)", "value": "4da8f508e77355cbaf54fadcfa3eeac3cb55bf085d5fd51cfced19830403f206", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905967, "uuid": "f80ae4ec-c026-41e6-9d16-dd589dd7165a", "comment": "Malware payload (Mirai)", "value": "745021596727127e33397271e637543e1bd6114f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905967, "uuid": "c701fd08-0b65-401c-b6b2-dbd78397a827", "comment": "Malware payload (Mirai)", "value": "63f1101c32e4aec47ee6abd097531e6903a38b55e6e086e675ccdd10403a476dc4b313f2b3b112d5ae9c5a62095fdd0a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905967, "uuid": "edb1f28e-f733-4dd4-afcd-ac3e38a469e7", "value": "T148A2D01822CDEA32D1B0943AE23CC357AFDB47F652FE317A1E180B99E44091AD7BD945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905967, "uuid": "c89f8dae-160a-4794-9cbc-311d726a4895", "value": "384:Yzmog4c6L5i4+stIW01vhQIE2TQKMpI8QwxZVFjfPnSbqINhymdGUop5hXl:YKoh/DxCvhdR4IjWVFbSeINs3UozJl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635905967, "uuid": "d0e9dd53-d887-438c-8918-763d6105e562", "value": 22132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635905967, "uuid": "9fe74b15-352e-4f0d-b5de-b8709a1bd36f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905967, "uuid": "789360ae-a1b5-4b15-b76c-29e6a5e6e08c", "value": "09f3916841211512f5cf2b0300fbe8ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd69ecb4-3c5a-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635912096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635912096, "uuid": "fffeed6c-ae1c-4890-bbbf-45ae417da47f", "comment": "Malware payload (Formbook)", "value": "f7025588aa5cf18492f97526ebdebd7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635912096, "uuid": "70818687-a995-4baf-9cd6-5f3ffd5ffded", "comment": "Malware payload (Formbook)", "value": "4eae4ef0a29b60c3886d69412e45a908b51eccbdb8b6a8f2590edc9de2a692b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635912096, "uuid": "76112f98-e092-4c40-8e7e-7c19cae575d2", "comment": "Malware payload (Formbook)", "value": "bfba4e17afb7ac913ad7ae084c4d475cb972266d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635912096, "uuid": "a1b6c58c-aeb6-443b-b274-a7ed5140b91a", "comment": "Malware payload (Formbook)", "value": "ebbc38105dc6f2c5708f65adddde9d5e1deb6c3c28e62cb689425c793e71871856fdf59c0aa32e0e8627741e9cd01434", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635912096, "uuid": "78ebe96e-9abf-41aa-ad6e-db22de9ad450", "value": "T12B054820B75D48C9C6FD3734CF25D1B007A16C6E2A10CA5924F43DFBBABD6135631AAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635912096, "uuid": "29468f73-323f-4dd4-9f11-5e629944e54a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635912096, "uuid": "70ed9a2c-04f6-4a33-be24-ce210ba0d2b6", "value": "12288:zBl2UyILiCyBxYf4Hkru26mh4l1gyuF7EzqZpJoLT2R0:1pL/cGAki26mh4l1gyuNNZpuqR0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635912096, "uuid": "516da1a0-a113-47ed-9dbe-6e7794d63fce", "value": 803328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635912096, "uuid": "c28a480a-1e12-4310-aa8c-a4dece74b467", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635912096, "uuid": "585f2d6a-d6f6-400f-8a76-18b768ace631", "value": "Order Information.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4930e88c-3cda-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635966877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966877, "uuid": "bea6b951-e4da-4320-9055-fc1b0b21b202", "comment": "Malware payload (Loki)", "value": "1ae623aaaac52a7a3d2e34aaa51deb85", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966877, "uuid": "be50764c-0a5b-49f1-8fe1-5d940df91f27", "comment": "Malware payload (Loki)", "value": "4f9219a947f5bbea1498cbe91184b3fbe1371485678e6d955914ce6c15444970", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966877, "uuid": "686be885-7b93-4325-9148-ad1be21dd740", "comment": "Malware payload (Loki)", "value": "35d1ae88f430e25fe97f3ccf282e839b5964319b", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966877, "uuid": "2a87b963-b84e-410a-b556-e6b526f63413", "comment": "Malware payload (Loki)", "value": "60b4a2d2996df4b870b3af331d0c2e04809fa67044b18170cf1c018bc323f9c1be442b777439ea7ee3719c660cf3ae4e", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966877, "uuid": "417bc50a-081d-47b7-a9f7-24249732c96a", "value": "T12D1412B1329A7183D9E4DEF43E64A23D599FECA1DCA5807B18253336973900EED72523", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966877, "uuid": "487c9ef5-bfac-42e0-a0fe-e27a90167ea8", "value": "3072:LuT9nOvkVgwMaDm+9wM3rrU9//TweSzITHaVL5hT:E9OsRM3+9pvUpTDu5T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635966877, "uuid": "24459e9e-2b17-4c4a-8b3e-4d2ef9694b04", "value": 190824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635966877, "uuid": "14b91c7c-a0ba-4257-ad73-4cddb067fdf9", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966877, "uuid": "4635da29-658a-4787-a383-2096fdc48c47", "value": "Urgent.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c039443-3ce1-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1635969780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635969780, "uuid": "9c847dd8-b1df-4854-ae18-b1a5d6dd4b49", "comment": "Malware payload (Dridex)", "value": "486dc0d8a1cc4af230c8774944d58821", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635969780, "uuid": "1c9b3bae-3306-47a3-8a1e-f5df31c478b9", "comment": "Malware payload (Dridex)", "value": "506e808afde5120dd33f4ac510a45cf7a0f640809b659c46542eee1da721396c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635969780, "uuid": "cbc58c2c-050c-42f4-9d5d-62704f4439c3", "comment": "Malware payload (Dridex)", "value": "f473a5b98be9dcd08166d9a968fb57077466b06f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635969780, "uuid": "70b30749-a400-45e8-bb28-9fb2110b2bde", "comment": "Malware payload (Dridex)", "value": "06b96b92591a01fd3f2d5b154ed985e5771fcf0946f0c81608aa210f3ebea08be31b65ca1d52291fb8da2f31ffe7666d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635969780, "uuid": "c023c022-3c49-4931-a649-ada451129388", "value": "T124A3F21D90D63563D635EB3E6B0A09E37C6933615F14ABC7088EDE8C87629C2EF47116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635969780, "uuid": "65e064db-ced2-4072-aa23-0f178edcdf33", "value": "3072:83wqmc3/q0dfaguKy6ZgT8KbS/u3bL+B8k:8Aqmc3Cufne8kWuny3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635969780, "uuid": "e809dd64-a2b4-408f-ab14-beec7df6f347", "value": 98359, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635969780, "uuid": "49415b4b-d422-4403-a6dc-5f803b1daa1f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635969780, "uuid": "c5f9daaf-e2a9-454a-866b-12be4399c564", "value": "Order-202580.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ad07ed8-3c62-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635915313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635915313, "uuid": "ad7cd8be-0e7b-4631-8cfe-94cae209553d", "comment": "Malware payload (Formbook)", "value": "61518d5068ba6e4254ec98dd6595b414", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635915313, "uuid": "8ee71f80-4aed-45ca-afd5-0efef88faea2", "comment": "Malware payload (Formbook)", "value": "50e44d136155717880cecf8fa05cf41587ce2a95845b024c7965f187cc758a9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635915313, "uuid": "49f3a34c-84ed-443c-b51f-172a2596a6a9", "comment": "Malware payload (Formbook)", "value": "e1656ac364dc7f4ae2d4a4293b1abea9509d15c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635915313, "uuid": "2b67d5f1-0af7-45a7-acc0-8338a55cbd3b", "comment": "Malware payload (Formbook)", "value": "c1f5f4bcc8da4051be38b809d71c5dbddf7088b06a8d25dd1b28f5146c5744ef45d5d2f6e4afafb8132ae8e37eda8d1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635915313, "uuid": "8649aaef-48d4-470b-a31a-c09c140b0fd0", "value": "T1BF45813178E8748CE9D6483084DC2C521D5AF9733D8AF15A94D3AC4CD47A087AE6EE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635915313, "uuid": "e62aa831-a1ec-4699-ba5b-4ef207436786", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635915313, "uuid": "85e80787-294b-4856-a808-82fc7dc853f0", "value": "12288:R+d7LN5KdVyQvmHqI9bRZ9bRoqJFTPLVpfrRBQAezE8ibX9PkWwyqZ6iTvKoKc/o:cKdVyaAtDtoqtp1uAezubXObZ0t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635915313, "uuid": "ec63980f-95ce-4f9b-b514-b5c1d8aab98e", "value": 1213952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635915313, "uuid": "1cef7d2c-6858-43a6-8784-bfaa5368df20", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635915313, "uuid": "fff127b3-fa2a-49a3-9788-021e984d79ae", "value": "IN32860Q0000678INBOM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c7e753d-3ce2-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635970264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970264, "uuid": "65523f95-9298-4861-8768-6bffa7d40090", "comment": "Malware payload", "value": "f5845dacda5a3648470655a32b46eacc", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970264, "uuid": "aa33946c-0b65-499d-96af-87eaa0173098", "comment": "Malware payload", "value": "5105f629084a6018f9e4435205e7b7271e1e4287e2dea057b62da6c720580e1e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970264, "uuid": "56c8ee96-689c-449f-8b7f-72edfc80d18d", "comment": "Malware payload", "value": "0a8a536408aa0ab392ac9e01061c74179b18da92", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970264, "uuid": "fe02d8b9-a293-4735-9f41-f85bd0de3045", "comment": "Malware payload", "value": "df7e6e4c7332bd27de0be7183c49f61439eff58dbd6f1507ab6611039973a433989f71912e43d2878ab24ae031642503", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970264, "uuid": "f201fe60-a510-487f-a5ec-060c8555f385", "value": "T1D853F15A53A5B80FC100AD7AC7058CF4141E30EA98469B0D3C95BF5752EE1E3DBAE7A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970264, "uuid": "b219cc8a-bdd8-4a38-93f7-17128a12d0a1", "value": "1536:8CWyPIbZ853SAJbpWqGqZtHcJDB7XwpO9B6zdV:837bC9JcZFApOP65V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635970264, "uuid": "4a2d2e4b-668f-413a-8f6d-04aae262f9bc", "value": 63996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635970264, "uuid": "4fbe7687-5e6f-4f67-a8f6-d9b630e12e2a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970264, "uuid": "70b54130-7b16-4698-a5a9-f244c3629a74", "value": "INV-493317.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32b78e9c-3ca0-11ec-843c-42010a9c0014", "comment": "Malware payload (Kimsuky)", "timestamp": 1635941928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941928, "uuid": "0fba06bb-33c8-431b-a620-b185f3a133bb", "comment": "Malware payload (Kimsuky)", "value": "b5d214930094b4bd9fd3aa76d4df56bb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941928, "uuid": "3575185e-ed15-4dd9-b7af-ce2a787a34b0", "comment": "Malware payload (Kimsuky)", "value": "511292e25c6624877a74a57f72b8ab363c2aa30d96983fdafa57b7cc7d45bdec", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941928, "uuid": "c6412fee-c07d-4d5d-9b90-fcdf74dd06d0", "comment": "Malware payload (Kimsuky)", "value": "e19aac917f576e38c9d23385a9cdf4c4add35b08", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941928, "uuid": "e07314e8-2323-44cb-bc9c-05e25a0916a8", "comment": "Malware payload (Kimsuky)", "value": "7f22ecd16fd02ece47eef34a53063be948efaa7782e90f120d8862dd9effba91fb0602fd7f20945ba6210d92b9042338", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941928, "uuid": "2daad97c-34d9-487e-bd90-f6f1db4b121b", "value": "T1F1D4AE01B7908034F5FB0AF894BE65A9583D79E06B34C4CB97C46AEE5A38BD4AD30717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941928, "uuid": "1a2d0ff7-3641-4c14-871a-6f70588b6f4e", "value": "869c528228af8b0b0bb001808e96ee3b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941928, "uuid": "ee129837-5e97-4991-90aa-ece1404df544", "value": "12288:ZcfAoR4HsodWu6pnNUAHRSHsT8JbVeDIoocjL4:A4HExNUAHIsT8JaIoLjM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635941928, "uuid": "55f65e5e-d449-4714-b213-a37723f3759d", "value": 648192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635941928, "uuid": "1ca86f5c-ecc7-430a-8d46-c58f9715c980", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941928, "uuid": "4ea0b7ab-454a-4a35-9f49-85fd604f2bbc", "value": "511292e25c6624877a74a57f72b8ab363c2aa30d96983fdafa57b7cc7d45bdec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24fab22c-3cbb-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635953501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635953501, "uuid": "0e000f44-1b9a-4b75-94ba-c20acaef4cc8", "comment": "Malware payload (RedLineStealer)", "value": "455c84f9480cd3e401255c14d3799296", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635953501, "uuid": "42c69153-cd9b-4941-b6ec-59baa21362ca", "comment": "Malware payload (RedLineStealer)", "value": "51563e103448249416d298e4f74b6a3bf3894043b49390c2d154eb67e718f08c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635953501, "uuid": "a3bb9ffb-b64e-41f2-9b2a-d6d9d4e451e2", "comment": "Malware payload (RedLineStealer)", "value": "3aed5a70080a671abb7e21dd89a5c7ff71278208", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635953501, "uuid": "6a538699-0aca-4a02-89db-ad43f0f8ffe7", "comment": "Malware payload (RedLineStealer)", "value": "f591420561e392cb1848087405e95f367366f102b9dc1189f24d121ae3ec2bf48d0e77d8be4f554c73b558c2e6a7bd9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635953501, "uuid": "ddf3d7d2-3e91-401b-a794-c6dfe41ef614", "value": "T1C784132864BFC05944E3EEA52DDCA8FBD99A55E3640C703701B4A33B8B52B84DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635953501, "uuid": "a0f4d13e-03a7-48ca-b142-c1e279635743", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635953501, "uuid": "ff8e83c1-f04b-47f0-b874-dc035b24f39f", "value": "12288:4QPVgJpNBGJU52r9SB+atXURnNOezdDEKqV:dSJp0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635953501, "uuid": "06ae9ee1-d409-4562-9a07-e3f0199e83d5", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635953501, "uuid": "2bc52c19-4db0-4938-9f10-ddd00ad3ab58", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635953501, "uuid": "b3cbb23c-ef25-41c0-9200-8d7ae7ee27f2", "value": "GTA5TerrorMM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ebf2ce7-3cc5-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1635957893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635957893, "uuid": "89c76295-7975-49cb-9f92-82d493e3ab25", "comment": "Malware payload (ArkeiStealer)", "value": "44d57bd9b9006ac10bdf35f7d347037f", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635957893, "uuid": "146486d1-91b9-46ab-b385-68d126b3da2b", "comment": "Malware payload (ArkeiStealer)", "value": "515d537093956f134ef3bc3037b609afc47dc225964ffa527bec9c1be7243d1b", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635957893, "uuid": "3708925d-e476-41ab-882a-d49bcc6360e7", "comment": "Malware payload (ArkeiStealer)", "value": "7a4e7d527f0dd67d00b38c4893800998ed2ca4df", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635957893, "uuid": "d618c113-5277-4099-a850-b294e8c082eb", "comment": "Malware payload (ArkeiStealer)", "value": "a9c3f40c79870019b78a1d1b6e435ded36ee1fd9cfbad05939e5b4d5ee2095375056235ad59284930f94fbd5e3a0b87d", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635957893, "uuid": "3b8f1842-6df9-46b2-8730-684d20af2124", "value": "T196649D10B7A1C035F4F222F48AB69279B53F7AA16B3454CF12D526EE5674AE1EC3130B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635957893, "uuid": "36fe57ed-3109-4dcd-a9ca-df82edfdcf13", "value": "59ee824971f432b778ca9bd24dd5ed5f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635957893, "uuid": "b4ed4fd9-f89f-4d4e-8c5d-6ea8a1dbf9d8", "value": "6144:UEkoyMvUNtSVeWL1xtRPU2z8K5Bstmbra4U:UD9M1VH1xtRPU5K5BymM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635957893, "uuid": "5e8752d6-5269-4eab-ad21-ebd65d803ee9", "value": 321848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635957893, "uuid": "22f4326d-dbf4-43b5-88a1-7a860e33ebd4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635957893, "uuid": "f760fe6f-f044-4932-aca1-42c384a94f2f", "value": "44d57bd9b9006ac10bdf35f7d347037f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e88fdbe-3ca1-11ec-843c-42010a9c0014", "comment": "Malware payload (Kimsuky)", "timestamp": 1635942350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942350, "uuid": "90aeb4c3-a04e-4085-bab8-0066777e209e", "comment": "Malware payload (Kimsuky)", "value": "4f01950be1af645812ef894060589297", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942350, "uuid": "652b9306-8bf3-4454-8086-41c3dc72de55", "comment": "Malware payload (Kimsuky)", "value": "51e8ac86d15128644d5a6432b41ec16d7ec6d6825852a1809f4f09369c0591b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942350, "uuid": "433d1451-14a1-47ae-bd3b-e8e99569df11", "comment": "Malware payload (Kimsuky)", "value": "6eb40d133e27baff5b907e561cfe44112b776dda", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942350, "uuid": "7c8987aa-e7e6-4090-9776-bcaf2dfa795d", "comment": "Malware payload (Kimsuky)", "value": "6a0af7bfe657a67e36bebd440f9578176e6cb9836c9692fe06285f6818bd689dc12c746b470085560c518be8834f3d78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942350, "uuid": "2883ad33-601a-4099-a1b8-020a64080dc2", "value": "T1D0835B03B8D18471E5B64D320874D9B15A2EF9210F65DEBB2798033E4F781D29A36EB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942350, "uuid": "05899276-1cd6-4181-ba9e-5e0e823c1cf4", "value": "88a063ed43fb0eef6ea653d24d378821", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942350, "uuid": "e4d49a19-75a7-4d21-ad67-f402c2898271", "value": "1536:eoh4LbjnKc+QnPhkqV4Ca9Ia6IKIAYzNnQJFIsWNcdWAd249Cq/o:In84Ph1deI7LIpw7WAd2wC0o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635942350, "uuid": "f699f970-3c21-405c-8f3e-ee51fac63d65", "value": 81409, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635942350, "uuid": "c00f845d-1dc1-4df1-9855-f69e429fb547", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942350, "uuid": "d4fa5805-3453-42af-87a7-cb6bca9dd2ef", "value": "51e8ac86d15128644d5a6432b41ec16d7ec6d6825852a1809f4f09369c0591b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae33cae1-3c48-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635904339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635904339, "uuid": "78fd27d7-78a9-4283-82fd-ed2df03e934c", "comment": "Malware payload (Mirai)", "value": "db6b32a046bda52e16062fbe65c533c8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635904339, "uuid": "81eecb4b-0269-46f7-a036-6ccde2ecbf63", "comment": "Malware payload (Mirai)", "value": "529ae85152488e88b4801ef47d613b6ff67ef28fb0878289834182ed7add7e05", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635904339, "uuid": "85be8464-5601-4104-a5ae-28b9ab86dc11", "comment": "Malware payload (Mirai)", "value": "2f6613288def946bbb9ee82165fdaaa1b254c05e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635904339, "uuid": "65429d81-0eed-46ad-b85a-9a97f7a69315", "comment": "Malware payload (Mirai)", "value": "a1cb636a74651193a5b80918d57c471c16e76d3639cf35551e078f0f86f333b043ae4393b06e5d320f5a849edd9c17fc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635904339, "uuid": "148315a2-ffcd-41fa-a94f-764637e94681", "value": "T1A7F35D46EA818A13C4D6177AB9AF018E3332A7D4E3DB73078D185FB43F8665E0E63945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635904339, "uuid": "1312f301-6520-4175-af92-96cf8437b95b", "value": "3072:d2nHsiNDOkYol8Gs6cGQ+9tn0zOXb5D2f6StkhM/9DIk:dIHsiZCol3vV7tn0zOXdDNStuM/9DIk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635904339, "uuid": "b64b4646-23a4-4a5f-8688-72a728d82f7c", "value": 167894, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635904339, "uuid": "22b6b248-361e-4300-8b1f-d672f9f907a0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635904339, "uuid": "8e083d39-7e74-4bf6-b170-a8d377cc67ab", "value": "arm7-20211103-0152", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1787aeee-3ce0-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635969370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635969370, "uuid": "65693f12-a4c5-48e8-9aeb-f40bc04760df", "comment": "Malware payload (Formbook)", "value": "ce44d33b7dadb6c6f15cc7a4052e8dbf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635969370, "uuid": "03f56140-7e0b-4397-b7a3-60f676fbced7", "comment": "Malware payload (Formbook)", "value": "52afa148015bd64b56fc7ef78182cefee2d3e9372b1aa5096a9ba2f563ab4bd8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635969370, "uuid": "63d71c06-cf7c-407e-b8b1-a70471f01b94", "comment": "Malware payload (Formbook)", "value": "87e0f6b9f22afaeacdaa596096cb3f28b8fd4f5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635969370, "uuid": "a33a18b0-2962-427e-afa0-ab4ecb905f5b", "comment": "Malware payload (Formbook)", "value": "fdc0ecc20197e8e9b68965a43a7671036adebdb9cbb94b23a3b6a148ed4f0c2e3575ae9396c50c9a374c14bfb7f8f984", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635969370, "uuid": "f7bff1e6-ce66-45c6-b701-8cb4e35b37cd", "value": "T17F7402A06BA85B63D87F17F9707542541BB1AA932543F34E2DCE70EE671AF404A81F83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635969370, "uuid": "8b35f5f1-cf43-47af-bcce-52a2393b31cb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635969370, "uuid": "17ebd3c7-00b8-4489-8f5d-436a2a049924", "value": "6144:xboo1a1pyYQf+jmwrgHhy638zo16+d0ORziaLS5erCBEOUblTTdbeN:xd1a1pyvIT363Uoo+dhRziaLSkCBEz1k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635969370, "uuid": "6d5e55db-47d2-451b-ab5d-d8ee82728123", "value": 361472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635969370, "uuid": "038bae46-6028-45a1-bc9d-6df9c2435499", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635969370, "uuid": "1cc879af-0b29-48e9-8bd8-f3cd99f41edd", "value": "vhJA4tqSpiN6pEO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f4ad4d8-3c82-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1635929145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635929145, "uuid": "b38f533d-8874-4ccc-ab17-6201697e41a1", "comment": "Malware payload (RemcosRAT)", "value": "5ba1639d88c4956f7b068c4ca308f24a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635929145, "uuid": "ec9d0f16-47fc-4870-95ad-e0f76fec1081", "comment": "Malware payload (RemcosRAT)", "value": "5319f3410910762ce2ce6846ee27fffcb22673693874bad5844510b627d0f715", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635929145, "uuid": "1dcad019-400c-4d24-8fe0-22870d3455c3", "comment": "Malware payload (RemcosRAT)", "value": "29a7b1eb1e5f8fe1961492a8f5facbcfbd271922", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635929145, "uuid": "97e9d38a-4621-4c31-899d-2f2475c1e752", "comment": "Malware payload (RemcosRAT)", "value": "ef0a78d2b01905d8dee64e7a3645abaab8c00a1641a74ba667d15a0984505e394438ebbf41aff57c366a79755ec1e485", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635929145, "uuid": "ad3e2148-4aed-461b-a232-cb56aeacaab7", "value": "T148159E72E0849A26CC263FF98E97DBEE14EABF03295454076BD83F07CB351A53926513", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635929145, "uuid": "2bf372a0-5576-4bf4-bfac-b45da448ad63", "value": "3513b15d2020b37cf2b66a761c75ed57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635929145, "uuid": "9caba1e1-2f96-4f3a-8990-166ede4de246", "value": "12288:WxBZN9xp6/Yo9sSbJ+RLbKvOS9cr9BE6ZyxDcC6CoueU:WF/C/N+1KWS49xy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635929145, "uuid": "e6bf5629-fb63-41f2-beae-84d59c9c9053", "value": 887296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635929145, "uuid": "1776dc16-1c97-4f3a-94d4-ac51ab6f3934", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635929145, "uuid": "cdaa7e9c-07cc-4e8e-b5f2-94b101755ee3", "value": "X\u00e1c nh?n B\u00e1o gi\u00e1 ??n h\u00e0ng-00132E,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4d370b7-3c9f-11ec-843c-42010a9c0014", "comment": "Malware payload (Kimsuky)", "timestamp": 1635941797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941797, "uuid": "88325330-6592-488d-987a-e932d466d664", "comment": "Malware payload (Kimsuky)", "value": "e5fc4a3ee89a401972108ab9726478ac", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941797, "uuid": "5b865e2e-bc4c-4f14-8e35-7c5f02bc66ed", "comment": "Malware payload (Kimsuky)", "value": "53956def0ed6398bd41029593a74c58040018ae5351059b6544e7af2879b0146", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941797, "uuid": "fd67e201-9310-4c8c-93b7-ba3173577bdf", "comment": "Malware payload (Kimsuky)", "value": "81651b23745d3d46be06255d178f9756b81a9cdd", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941797, "uuid": "82491d32-9709-46f6-8388-a45230839dbe", "comment": "Malware payload (Kimsuky)", "value": "b5f7deea34f7a9c6156d6d01b68b6e74750dd9349f9b10cdc08f4c31dcebc1c75b04604046f86113292d73ba1d37170e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941797, "uuid": "07df4e45-d079-4e83-8859-87b8970b786f", "value": "T115C52BB2B509B1CFD48E27B8957BCE83691D07F847244863AD6DB4BE7DA3C812587C24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941797, "uuid": "aa905351-69a2-4530-b89d-57a9421e5eeb", "value": "74c18d2564058cf2aaf7e61eda41c07b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941797, "uuid": "4859d864-4bd4-4be8-8993-743a43db85ac", "value": "24576:eic4Z36WjBpzrB9qHIsT8JaIoLjMQ8QwX+9GWFmnqwMVFrhZZwX1279Y4/hWi57e:dZVLxso0JLjMywuB9FZYIxe9z4G9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635941797, "uuid": "aefeaa1b-5e3a-4110-b236-ddabacaf8063", "value": 2585879, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635941797, "uuid": "c63d27e6-84e7-4db2-8f46-5858975545f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941797, "uuid": "efdccdf0-e7cb-47a2-9f41-eaaffbcb0283", "value": "53956def0ed6398bd41029593a74c58040018ae5351059b6544e7af2879b0146", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b230b3ac-3ca5-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1635944289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635944289, "uuid": "6a7f847d-b957-4e23-945b-c03f8a7f93bf", "comment": "Malware payload (Dridex)", "value": "6940de6ca8fbf01ff29889e4fa6cdffd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635944289, "uuid": "217c678d-99eb-48cf-a4f8-f2d0eb2d2aee", "comment": "Malware payload (Dridex)", "value": "53f3655f8ffe59482ccb7b5bb2a54555c7ee6dda4407146bfb81e9e6a12dadcf", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635944289, "uuid": "32defb3d-f901-4bd9-90f5-a4a28a62c367", "comment": "Malware payload (Dridex)", "value": "d2771e97b2880d48009fb45ae592587f49268536", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635944289, "uuid": "dc0f1258-4190-4073-92f1-902b8dfcc500", "comment": "Malware payload (Dridex)", "value": "d092db40567fa22fbcf93b00d548e2b1719be3bb59746ee54f230c29ad468d344cfc99d5343bfcd00d84513ee4348cea", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635944289, "uuid": "10acf9e2-811d-4fcf-878c-2b0c33e23e88", "value": "T13053E12F1B15201BC0143D3E8A4D9CF4B9AD74AE9C06E60E3458AF4F05E91D35BADA5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635944289, "uuid": "0caa7d88-fb55-46f8-9a89-d8f8c6e7afda", "value": "1536:8CWnyPIbZ853SAJbp3Wq7mk+LVsvV6JF1rL0TCD:83n7bC9mJBsvV6JnUc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635944289, "uuid": "f09e04d4-767e-470c-afe2-de64eeccf8c8", "value": 62418, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635944289, "uuid": "85fc69f8-e077-4c8b-97fc-ee29ba1879a7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635944289, "uuid": "51592dca-bac3-4c98-ba29-8fd46e665ff5", "value": "Payment 846725.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce773242-3caf-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1635948632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635948632, "uuid": "3eb52cf0-a145-4b66-8db0-0c13e6e3d9c8", "comment": "Malware payload (Dridex)", "value": "be816f75d4a32f1288893ebb8038c72c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635948632, "uuid": "11f63311-a7a2-413c-a89c-4d8b58965f3b", "comment": "Malware payload (Dridex)", "value": "568c9641ec9a32aefdd46ecde982f3f2b5a136ea02b43d355478d4622a9f8329", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635948632, "uuid": "426807b1-3f9c-4405-b7ae-f7791ec5d43c", "comment": "Malware payload (Dridex)", "value": "40fcd8ed5a2e1e971b975b728768b241e17b63fb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635948632, "uuid": "7c8841a5-35cd-477f-ad89-822161094c2c", "comment": "Malware payload (Dridex)", "value": "d18048eb250c97eb726f3b1a2b40157fde855a6ea19119999371c98bb0bffe8cc15a1d9fa9d8592e361ec5bcee591032", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635948632, "uuid": "560bd172-d401-4da0-9544-fc5e73dbd5fd", "value": "T1DFA3020D92D53461C624EF3CDF0D1DF6992E23320E317ACB18AA9E9C42B74569F1B61B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635948632, "uuid": "ef0adec1-b193-465d-861f-ac2937f912f0", "value": "3072:83rpqmc3/q0dfaguKyeln1OpLxPeNW5Hh6:8dqmc3CufneU1yPeNWa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635948632, "uuid": "6fd04820-6755-4f76-9695-bb71246b9618", "value": 102053, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635948632, "uuid": "aa1abf9d-7f89-4d47-abba-a69f11accf4b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635948632, "uuid": "8023e88e-e9fd-4773-b398-787ae773a47f", "value": "Bill-80249.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "156e2fc9-3ca0-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635941879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941879, "uuid": "72c07fb9-9ebc-475c-a822-8486ea8ca20b", "comment": "Malware payload (Loki)", "value": "95df65718a5589f3f1427191bfbb2039", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941879, "uuid": "89cc6a26-89a3-44f9-bf5b-288dc5a1d47c", "comment": "Malware payload (Loki)", "value": "57342c01a9b9aa799928677f9f97f07f819b18bac8f865d47a0826baadf0148e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941879, "uuid": "5f88a5e2-ba25-40e3-83c6-4dadc65bb635", "comment": "Malware payload (Loki)", "value": "1be108ce25b8a12517d68391cc17e71db7fefdb1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941879, "uuid": "eeea43e6-f5c0-4fc6-acde-ca9b53da44e0", "comment": "Malware payload (Loki)", "value": "ceecf462fc761a127f59e249eee5ee47766c5bd3e37d492632e31b49ee82206042b70062c5721a367b190280b55eab94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941879, "uuid": "b2f10d74-be69-4306-a981-08dee9e691e7", "value": "T11C94CFC2A7D48512D96E0F3191316C214273BFAE3E09F28A7D9C78A776777CA0121B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941879, "uuid": "6f5c5b8a-8b10-4644-8d81-027722be23de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941879, "uuid": "d22eb9cc-557c-4602-b472-dbf9ad9c9afd", "value": "6144:gqjbw2+RYOc4OFgagTuoDjJnvmNsTDnhQ2cTrsaPPjZPBk57Mprvl1By:gqjs2b95gTl5vAsW2qsanj1BkVF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635941879, "uuid": "21ca5825-4203-4d9e-ae5d-477c10fd3ebc", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635941879, "uuid": "df41b003-c2a6-4f3c-b146-c583dc25f71e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941879, "uuid": "fdc03d7b-785f-486d-bceb-8ef05821458f", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91bcab14-3cad-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635947671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635947671, "uuid": "a73dc0fa-e6f1-4c74-b800-c747fb3102ed", "comment": "Malware payload", "value": "b50a55a0ecdf8bc5ba578a061b651f02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635947671, "uuid": "3dab54a8-137a-415a-94a1-febbad133ed9", "comment": "Malware payload", "value": "5791b27e20fa666be3f44f75942070fda981fc2fadaa4e6d410376a41bde0d89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635947671, "uuid": "93363abc-0203-45d6-8789-d923d2f802e1", "comment": "Malware payload", "value": "2fbe5f14787a95d55167de33c12af11f10e21a51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635947671, "uuid": "b8b3c18d-fe15-449e-a93c-e85a1c193921", "comment": "Malware payload", "value": "7f3fb58ca4259e4fa0f367e3a9a0f8d04e3e82db567ab32dd08ca0588dc1c993916a7f47ceeda73e160a843beac9f1d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635947671, "uuid": "5882cb98-5c87-4d5f-b74a-5541e9778378", "value": "T154158E57F0D09566D8167FF89E87DBED14EABF122D6060067FD83F4A8F30AA42419A43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635947671, "uuid": "27656b5f-de88-42ec-b193-79ecb6fdc00c", "value": "3513b15d2020b37cf2b66a761c75ed57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635947671, "uuid": "ecd34b56-9126-44ea-ae2b-29dd23ca1a7f", "value": "12288:WxBZN9xp6/Yo9sSbJ+RLbKvOS9cr9BE6ZyxDcC6CoueU:WF/C/N+1KWS49xy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635947671, "uuid": "ed2513e3-3cdb-47e4-803c-b1632e3e224b", "value": 887296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635947671, "uuid": "22df8893-8bf1-46e8-bf41-5a7db427ed7d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635947671, "uuid": "a72e8a7a-aae6-41fd-9e87-1bf231d22cfc", "value": "Sghzguwameybzriiwpflupyisqxvypakot.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "278c6730-3ca0-11ec-843c-42010a9c0014", "comment": "Malware payload (Kimsuky)", "timestamp": 1635941909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941909, "uuid": "cd410d53-fce5-4f9e-91a0-592327844dc3", "comment": "Malware payload (Kimsuky)", "value": "430fbc40875a218058b7a7a94115ce1f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941909, "uuid": "40072385-6cb9-418d-b4c4-85761cff3d5b", "comment": "Malware payload (Kimsuky)", "value": "57b8fffc55ca873ef1777feb40aaab8ad4318f7b0f6295d6abb4022f84d3739e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941909, "uuid": "9ba29645-fa39-450f-9a92-9693ab0b2a10", "comment": "Malware payload (Kimsuky)", "value": "b5973eb4db79ed01880300a0abc512493b77a179", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941909, "uuid": "dd425221-e333-496d-8b81-fb4ed59510c2", "comment": "Malware payload (Kimsuky)", "value": "6bb2ae0c2f9ae8248b83a647bf101d8e698cf760675799b79b05b74162a80be2870f00191337f10960a3b59265140d58", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941909, "uuid": "01a8a68a-db8a-4842-9fd3-450d19f0e588", "value": "T123F423413EBB50E1F09A8BF4C783C58BB179058AEA24441291D51566B3E9A533CBFFF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941909, "uuid": "b42ca1b3-8abb-49be-88e0-8c1942bb3020", "value": "f8704bf2101dfb081e307cac458471b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941909, "uuid": "e105ba20-5c6c-4ef3-b52b-72850fdbf2e4", "value": "12288:Vlc3yiSlPLe9airFAXDf2EuzENrIpT46jhAjHZ3t7Y/OSvtMqSUKqcbmhIDKWF6g:VlBiSpLe9zIuzcrjtj59WOSvtOUJcmIV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635941909, "uuid": "e96bc5d2-135e-4ba4-a4b5-ff5e173280f1", "value": 776704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635941909, "uuid": "de5368d7-2eb4-4f97-9f4b-bc799b9a0f8d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941909, "uuid": "e59bd85a-33c2-496c-86c3-a8fb9cac1b5f", "value": "57b8fffc55ca873ef1777feb40aaab8ad4318f7b0f6295d6abb4022f84d3739e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea43882e-3ce2-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635970583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970583, "uuid": "dba2cef4-6f90-4411-a85a-40391303f6ac", "comment": "Malware payload (AgentTesla)", "value": "333044e1194315682a5c5968784dc144", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970583, "uuid": "6c727d77-f819-48ae-b0fc-bc9f6c7e5df3", "comment": "Malware payload (AgentTesla)", "value": "57d8cd0a066d7963ed7c82eadc4b15ac16ddb994ab5db6718be0ff3441d7f384", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970583, "uuid": "27b5450f-3547-4a1d-9711-5cee3e31972b", "comment": "Malware payload (AgentTesla)", "value": "a74bea399e726b1bfc4c6a90449c413b265528a3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970583, "uuid": "3b8a999b-718b-450e-94c0-5103f6c86002", "comment": "Malware payload (AgentTesla)", "value": "b7619a91177b95a6f5cedb15c6d48c1597d58982bc18ff66ee06de354a979314e02d2d9916368145a1cd87e31357aee2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970583, "uuid": "bc37d6b7-9c8e-4839-ab7b-6efd4c4d925f", "value": "T1E3056920B35D49C9C6FC3734CF25D1B017A16C6E6A10CA5924F43DFBBABC6135631AAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970583, "uuid": "a228e869-c8d3-494a-82d0-060263ccb733", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970583, "uuid": "4659549b-4cd2-4786-8730-87af83e24766", "value": "12288:ANHcylWo7MSJQigZakw85q1nyuF7EzqZEJNLTeR0:y8yldMBZaSq1nyuNNZEnSR0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635970583, "uuid": "ceeb2a91-39d1-40e7-ba34-a9507e09ff76", "value": 851456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635970583, "uuid": "7d892109-8178-4d67-a486-e4f91f21ae3e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970583, "uuid": "e2fa3370-83c2-4041-8b00-01b18006dfda", "value": "ORDERS QUOTATION FOR COSH.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "482a1d0c-3c83-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635929509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635929509, "uuid": "a3d9fc3b-3b39-4454-89a9-9b897ad9f4f3", "comment": "Malware payload (AgentTesla)", "value": "fcac122e59a956f8b1656f7e7a2f15a8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635929509, "uuid": "616eb169-7a94-48e7-b193-e7c39f07a545", "comment": "Malware payload (AgentTesla)", "value": "5800ed28fd7ac1512651989ddeed8500aab9dc67ed322f02ec9c6b9ffd154090", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635929509, "uuid": "c9c4c927-8cfe-46b2-b838-89e47421558b", "comment": "Malware payload (AgentTesla)", "value": "f6f552457aa9e981486aabd15e85be9833f1a68e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635929509, "uuid": "ea31dddb-f0a6-4d76-acff-65658a84184a", "comment": "Malware payload (AgentTesla)", "value": "edbdf15be328de32264f532424838fe48c72b8efd11789e28722ae77674ee9a50988ee4c9d88e5dd008d92aac70e11d4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635929509, "uuid": "317b1302-2378-4d2e-b90b-d97f44d2f89f", "value": "T19EB4DFC262E44352E56A5FB460706D2143B73F9D7C54F2886EA9B8DB7A737C24120B93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635929509, "uuid": "0dffbd25-4508-400e-8180-705794e6fed9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635929509, "uuid": "b350492c-f576-4234-b8cf-9941dc9e250b", "value": "12288:2wKTl03UcjwgiVBxQjSIoTMhOOL7JwsydYjm0hrPFfBi:4TG3UcwgiVfQjXE587JL9S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635929509, "uuid": "56d9e25d-e5a7-4a42-9289-ada2a8439d22", "value": 497152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635929509, "uuid": "881d8e57-bf98-4e02-ae06-c90591bac32b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635929509, "uuid": "d95b268c-5b56-40d7-953d-a1d0c7540b54", "value": "FB-108N & FB-108NK \u8a62\u50f9 - \u7530\u52e4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c383f76b-3cd9-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1635966652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966652, "uuid": "4167d976-d55f-4d45-99e9-2df2ff9bceb5", "comment": "Malware payload (SnakeKeylogger)", "value": "aa84becc9a51460f48bc90bc7cd56ede", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966652, "uuid": "3ddc8b87-a428-473a-a507-59a6c6a8afe0", "comment": "Malware payload (SnakeKeylogger)", "value": "58cdd4667316903c2c814f1c5748d550f151e8f577494c314218301260a53d14", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966652, "uuid": "ee1ebf58-631f-40a8-94c0-0fad6bfbee73", "comment": "Malware payload (SnakeKeylogger)", "value": "084927cfd0cbc91ad1e85f98c285c1721f1d151d", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966652, "uuid": "f0bf4995-acea-4f0f-b3aa-47e606bd65ea", "comment": "Malware payload (SnakeKeylogger)", "value": "d534825d688453b084368308f08ba29f90fc1d7a01913b2ab9409b6a5aec727ab000ddb56bbe64488bc249c84efb6aba", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966652, "uuid": "81a4ccf5-11a1-4104-809c-c27b66c0ceac", "value": "T152F3029579018308EB76ABF4ED1EF1B96AA4AC01359D26C73C18737AB533C46CC58B1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966652, "uuid": "e8a21567-c77d-49c1-9d72-e2615ba75041", "value": "3072:01BGrJj5oqUf0idk8xf91InCIF26aCb0DsLfLnaaMZ+G42uwnXVIRy1J:08JFliK8xf9Q2XVDsfLcZ+GruAVUU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635966652, "uuid": "833cbfa3-4d1e-4a53-ae0c-e37b1b495c58", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635966652, "uuid": "bf17bb95-40bb-470c-95e9-8b7bfdef9e09", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966652, "uuid": "6078d723-b07e-42af-9398-1c23e9883a06", "value": "BL_DOCUMENT.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a61bc771-3c70-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1635921506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635921506, "uuid": "84eb8716-980e-4bf1-b9f1-1d73f62e089f", "comment": "Malware payload (Dridex)", "value": "bf069dde2c174c9ef630adec7e159aa9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635921506, "uuid": "f58cc01a-8147-46cf-b146-adce6e070ea3", "comment": "Malware payload (Dridex)", "value": "58fff05fa0e86643cef0ef6457c994937dd929f2ae845752b61103847730c6f4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635921506, "uuid": "624528c6-94db-4e7c-bfd9-004b717fe983", "comment": "Malware payload (Dridex)", "value": "fcaccb7c2ff27162a2f6d4525eec9bf35fc57ff0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635921506, "uuid": "b2a3b815-8244-469f-82ab-384c4943a6eb", "comment": "Malware payload (Dridex)", "value": "49ad66cf6aeb11b689536a7465e303bcbac224fe67839f92a0baa19dad2d91c0352d3aba4c783ddf54622cc3ce12b810", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635921506, "uuid": "0c4ed56d-017e-49f6-9ae3-36fc6ac8c929", "value": "T1C483F1EDC686F867C352CEF9DB631DE1825615923C44C64B28E9B20CBDDAB831FA9114", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635921506, "uuid": "65dd6390-f4e3-46bb-8e4c-30eae01df9bc", "value": "1536:8CWUPuALLImemeKHqeK7YncUrPB+AJjEpXzt+nhNImwV/NdA:83L80XKUY32pXzknhimwV1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635921506, "uuid": "1ea73682-ea57-4495-a512-f98104f48cfa", "value": 84275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635921506, "uuid": "ae9db970-b6a7-4352-9428-8c5b3d1bab0c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635921506, "uuid": "f616ebdb-0216-4344-aa14-de292b9b918b", "value": "INV-894177.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "051f1abe-3cd9-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1635966333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966333, "uuid": "3c9e7489-af2b-4474-913b-8772dca879c7", "comment": "Malware payload (SnakeKeylogger)", "value": "69dc888fa1d2bcfe92d23d9124450862", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966333, "uuid": "a859da5b-3e43-4a73-9f45-fa152947994e", "comment": "Malware payload (SnakeKeylogger)", "value": "59312b3c0f39d289fd69ef3e03a590930a5194ac6431975dde2e339d53aa25c6", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966333, "uuid": "e9928d92-cc91-4630-a1d2-44565130ff53", "comment": "Malware payload (SnakeKeylogger)", "value": "54589264a7bab78810fd9cc792d98eacccfa51c8", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966333, "uuid": "1272192d-2c62-44ef-b580-1c0ec6120e83", "comment": "Malware payload (SnakeKeylogger)", "value": "655c845b2564d94b667704b6d854a95ba96b70f9788a0b82636f8a0a3872cb497bbe96e964edcfa2a7cabf7446cd87e2", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966333, "uuid": "c6c11365-d0d6-4126-abf9-dab330c960d4", "value": "T15541BE1107F55708E3B28E3DFC73E211D6B2BC52E9168F7D1120908428AA211F5B1F2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966333, "uuid": "62747329-7b8d-45c4-b219-b2130ef5a4a1", "value": "24:8WeqOJSYg8C+pKBWXkAtWC+/CWjXCIazIlPefk4o0aYrabVIJ0wm:8WSJHgqXzmXCVmgoOraR20w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635966333, "uuid": "521021fe-0f9d-447f-a88e-a7c5ae0cc6a9", "value": 2351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635966333, "uuid": "226591d1-7107-4e12-85ef-99a6c567f93d", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966333, "uuid": "753ec655-b84c-4099-8cf5-70890efc5d2a", "value": "Specification 5372.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0cfaa32-3c4b-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1635905740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905740, "uuid": "e6c7e06a-f6b3-4ec4-a447-4d028bb724ae", "comment": "Malware payload (NanoCore)", "value": "9a6877f51a146efe5c857f8d171f245a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905740, "uuid": "d6a65b6b-92e3-4617-81c3-fca7b993ef7b", "comment": "Malware payload (NanoCore)", "value": "597b37383f0db8f45ac44bf4b34b8ec275e5f47dab27a03ac79d33790298a42d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905740, "uuid": "dc52d4c0-b36c-435b-9117-37bee1a615bb", "comment": "Malware payload (NanoCore)", "value": "85774403fd829863e3e6cccc34df66d6ac5c92c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905740, "uuid": "09e83664-f744-46a0-aced-f2bf2c14fa16", "comment": "Malware payload (NanoCore)", "value": "11a0b71b5d75ae902f7b10d99cd259d99c2c63c0d5c442d0ee13f1c5424856e6bc9efcd07e8b2df08ac44a0dd2879814", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905740, "uuid": "89da9131-9f6b-41c3-9ed9-31cbbf42f7b6", "value": "T1A9A4DFE292E44321D96D4FB460B06D2543B73E9D7858F29C6D54B8EB3A73BC25120BE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905740, "uuid": "d628b6d7-f6e5-4b46-86fa-197373417b00", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905740, "uuid": "192f57e1-3aff-4246-bccf-4bea4ebc5808", "value": "12288:mC4TlFiSPDsDfk/5+gFpMGQ+dRuMuB5Yzumxj:kTGSPDszkhl/MGXcZB5Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635905740, "uuid": "651bad82-18fa-4c8d-9ade-75c23bff1ed7", "value": 492032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635905740, "uuid": "2d805980-87e8-4225-9aec-3978f7f5fecf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905740, "uuid": "4f4d4430-bb22-48ed-95ab-4bb49da68611", "value": "BL draft.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e598d55-3cad-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635947477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635947477, "uuid": "7f44f26b-378f-468b-bd18-d06a115db94a", "comment": "Malware payload", "value": "60ab74bae025e18e5c145bbdb0bea831", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635947477, "uuid": "b0ff8329-e2c8-42a5-ae02-075ea6f0597f", "comment": "Malware payload", "value": "59807105de803c6e9b5b415a922338d8495e028fe1253e6ead77d950a4a14c56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635947477, "uuid": "49fb4820-72db-41b2-9519-9f5e714d1bd0", "comment": "Malware payload", "value": "a24beb5ea2665af0f3970155e271d923fef7fddd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635947477, "uuid": "e53eddb7-52f8-45c4-a16c-34a3e6d15d54", "comment": "Malware payload", "value": "45fb63f9f7e09146730ec99278f7bd54eb373490c387d7b741af108158a494ceb656dc1c39ee15df34cf9da019e9c99f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635947477, "uuid": "b4485db5-ffae-4af7-bb28-d0a4b47627c0", "value": "T11D539E2877E8C7A7C13B26361C2900618F34A9B18D35E59F385E11ED3BA1F521AA1FD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635947477, "uuid": "243b759b-38af-4d21-9d4b-0e347cd349ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635947477, "uuid": "4c4b98ff-183f-4637-9c22-329e34a3e0af", "value": "1536:p5lNrb21N4RTvCyYKbhT0GAkeMIF7u7QLiOIA5Se9d0YkKVwVcl:3vr61N4RrpYKblPAkcu7cIA5SvNKVqY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635947477, "uuid": "6f673e6c-93d2-438e-9a3a-6320d99f0a7e", "value": 66560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635947477, "uuid": "9282b094-fcaa-4fe0-a2d2-10a00f3de15d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635947477, "uuid": "a7bfc6f8-7fae-4b08-828d-4dbb92e58d85", "value": "59807105de803c6e9b5b415a922338d8495e028fe1253e6ead77d950a4a14c56", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e0cba56-3ca1-11ec-843c-42010a9c0014", "comment": "Malware payload (Kimsuky)", "timestamp": 1635942377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942377, "uuid": "c08243da-0930-4dce-a83e-46d010d59f3f", "comment": "Malware payload (Kimsuky)", "value": "8fe657c175deb4f13bb166e7fce45be0", "object_relation": "md5", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942377, "uuid": "2d8b8214-289f-4229-82f2-a71c773320e7", "comment": "Malware payload (Kimsuky)", "value": "5b23d027b902ce2e220c7da0ab777efe96d96954007ed2a8f3a4daa34935a8bd", "object_relation": "sha256", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942377, "uuid": "c3cdb29b-5962-48d0-a503-b08f812cc205", "comment": "Malware payload (Kimsuky)", "value": "fe390a2a63ed5eaf34f003dc8d7c678849a47441", "object_relation": "sha1", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942377, "uuid": "2985ddb5-567c-4a47-b81a-6e9475674651", "comment": "Malware payload (Kimsuky)", "value": "a1ee291e2ca88ffd77f1dd784a9bafeffb396bca8a6b45606fc95d78a1e94dc2ed2324d63de3636de17dccb4d6b83db0", "object_relation": "sha3-384", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942377, "uuid": "d0a49029-3fc5-44ad-b981-5ae78bfc5c6f", "value": "T18AA2AE243B0B5F6477B75DC36A8FC888D45421CA72631C2ABE9E4B412F16F7863C6266", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942377, "uuid": "67bf9b15-b469-466a-9c25-f8e0f0e93088", "value": "96:SGaCd2QKp7FCousll41AXATAZpwZ5uGe6ksaT/AMJMGMITMRMqMdlMYBMnMgMz1x:BewZ5uGasajVNHe3XeFbwH+j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635942377, "uuid": "1dffec71-26f1-49c7-8390-99ebaac07c3a", "value": 21372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635942377, "uuid": "e14ace0b-840e-46d8-9f00-bd52e56445fd", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942377, "uuid": "0bc68402-560d-48cf-8aa5-e515de22a8e0", "value": "5b23d027b902ce2e220c7da0ab777efe96d96954007ed2a8f3a4daa34935a8bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c7f19bd-3cba-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635953165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635953165, "uuid": "c32ed129-7d76-4d92-a4be-df45614ceb45", "comment": "Malware payload", "value": "a65d7448f8b432c75a34fd8dd377fcc5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635953165, "uuid": "56bf7110-bc02-4ead-a97d-1b42adff3c95", "comment": "Malware payload", "value": "5bda547c8fa0efa9b9afe4539e966286fbfb8583710416ea13b471e709c86b97", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635953165, "uuid": "bcce74fc-b5f8-43ee-b279-8308cbff87c6", "comment": "Malware payload", "value": "233a5f8c82c709811f3afd7e7be62851b43ce929", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635953165, "uuid": "38606fa6-8fb7-4945-b522-613b337fd1b0", "comment": "Malware payload", "value": "1f643ca11e9cfb66f310cdf13fe8ed5f5571d347abc3bdba5362ff61e82d4dd038c42e3d5439ffede87878df663ac9ee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635953165, "uuid": "bb3fc0fc-bbb9-4f30-8f86-04ab59c45635", "value": "T11C91D8A7FA61DF29C41F603127730304777683622981877BE65C04F9DB8E802799B35D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635953165, "uuid": "760dca95-afa9-44d1-abfc-4501f3b23892", "value": "4bfde1223391e32fec766cd1d41fa3e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635953165, "uuid": "11ca55af-2d28-4f41-9816-a51273c40b29", "value": "48:6Gu+Z2WzJ6KcMU6ZjYqLxmUMZv8B13aLlzUR:hZ2WQKJU6ZjYlkv3aLlYR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635953165, "uuid": "bf042950-281e-4298-abcd-0f564d308ba7", "value": 4608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635953165, "uuid": "da360586-3c08-44c5-8925-cd66458507a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635953165, "uuid": "d30bafe4-40a7-4344-9fef-69fb12a340fa", "value": "a65d7448f8b432c75a34fd8dd377fcc5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0baa6550-3ca4-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635943580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635943580, "uuid": "c152cb14-ef24-40aa-bcb7-fdcacdc0d178", "comment": "Malware payload (Mirai)", "value": "5fe33cf30e900cb2903960d16f1f3ace", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635943580, "uuid": "dd251c2f-bdb9-48c2-98a9-4a65594d4bcf", "comment": "Malware payload (Mirai)", "value": "5be14a462004f551c39bae8155098090695e6dc2ad48219a7792bf4d28a364f9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635943580, "uuid": "9a6c2d16-e6c5-4a94-b43e-79a39be5fd72", "comment": "Malware payload (Mirai)", "value": "92f9cdbf6ca4efdb09a48714907913a74b70bf9e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635943580, "uuid": "130edb89-ae82-47f8-b333-a285bf624d46", "comment": "Malware payload (Mirai)", "value": "ed6cf0609a12a2e6e1edbe217aa0d408236f86a3056c84a173cc51ead1540c2501888826419926119df22c394b2833c9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635943580, "uuid": "11fdc06a-ea9c-4d52-9d3e-875783fe81e5", "value": "T126432BD6B802AD7CF94FE6BE8423090DF661335051930B2B67A7FDD36D321A86E52D42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635943580, "uuid": "48fe2715-1343-45fe-b9fc-e53f27c68784", "value": "768:uMHejQFpI44XZAJ0xwv6qOl35a7SP0ypuo8Wh2QCfBqntyzruCi:uc4QFpUZAJIwv6qwHsyIo8Wh6fBqozrg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635943580, "uuid": "cde64bae-dd39-49ad-a340-04d708452266", "value": 57092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635943580, "uuid": "30199495-0fc3-4109-aa17-f90d2607a8a4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635943580, "uuid": "c5126489-f07d-4297-aa35-b246b2290dad", "value": "5fe33cf30e900cb2903960d16f1f3ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6e3d88b-3c73-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635922849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635922849, "uuid": "cca65779-09df-4f84-8d84-e1068c66cb1d", "comment": "Malware payload (Formbook)", "value": "22f4705405f84f78650b3092fe605b60", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635922849, "uuid": "210fc094-145b-4dc8-9c5a-da17879cf789", "comment": "Malware payload (Formbook)", "value": "5bf69230fca22f7c053b8af4e33fb5cad4e2fabd4290d544e507d52ae7d57186", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635922849, "uuid": "4e7f6af5-f5bb-40f0-a76b-747a136990d2", "comment": "Malware payload (Formbook)", "value": "52aa17eddfc8b4982ad01b4f8d50a3cacaf96b0d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635922849, "uuid": "fdfb95e8-588f-40cc-b4b7-4a064e41dd17", "comment": "Malware payload (Formbook)", "value": "ebf81c9ba88c2ef2a1b5db3d096a93617aaa05deb4f830e88281c3f9bf0ba7eb1c68b91d3a38f374869d0c5e2a075710", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635922849, "uuid": "0837c9e7-b463-4709-92f3-a6083df63c00", "value": "T1179423D3E870ED2AD105F1825D3A274EC0FCEA532872EDD6D0C99B6A069C815FE1B49D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635922849, "uuid": "a1ca7b17-432a-4ee8-8019-02d761ffbd7f", "value": "12288:D5Gj31557TORjsA9WjSLhbttDZnSEvC6rUAP01j+i:FGjZTORjsAFhJtdnp647k+i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635922849, "uuid": "3019d4ff-b3b0-4124-832a-9c10778a5fad", "value": 409321, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635922849, "uuid": "8fd0d103-460f-4d19-876f-fd82e6416839", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635922849, "uuid": "4a3fdae4-0506-408b-a510-bc1acf32c064", "value": "PO #20004235.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff6708c6-3cda-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635967182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967182, "uuid": "e94d9cd5-ce11-4947-8ad9-b02be6c606fe", "comment": "Malware payload (Formbook)", "value": "6d75065e6589828a413c701fba62b34c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967182, "uuid": "1e50af70-779d-4016-8453-39aec131ab67", "comment": "Malware payload (Formbook)", "value": "5c71206ac73757fa7bb3582caaad50dc63d72c24a4b1c3e36f84e464c97f05f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967182, "uuid": "621a46c5-4365-43af-b1f6-dfb9518267be", "comment": "Malware payload (Formbook)", "value": "c2d4cbc7474224afe8ab5b0669f72ebb95864bef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967182, "uuid": "cfe095e3-27e2-4366-aca1-c0142975aa87", "comment": "Malware payload (Formbook)", "value": "04ff0df36486be4ad5878d80f19168716bddd5fba109c07a67cb4cb4c7f4c4de19d8cc3626736c1e70bb3691b26772dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967182, "uuid": "0a2420dd-e597-4b3a-914d-96b621308934", "value": "T1F2054820B35D49C9C6FC3734CF25D1B017A16C6E2A10CA1924F43DFBBABC65766316AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967182, "uuid": "c864997d-a606-46bb-9e26-443412d269cb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967182, "uuid": "5775ec49-68d8-4d30-929e-c19985aec8e3", "value": "12288:OiGM5+AItiK60pDIGKiKCikN/INiC1iyuF7EzqZEJNLTeR0:OdG/ItiKFDI7ny/INiC1iyuNNZEnSR0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635967182, "uuid": "fe3b4c21-4138-4434-bd20-e5b2d9815b0d", "value": 829952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635967182, "uuid": "4c89a522-e6fc-4cea-88db-c24a74322809", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967182, "uuid": "8feb44aa-48fe-4cf4-aa16-905ab99c01b4", "value": "6d75065e6589828a413c701fba62b34c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ec5aa8e-3c7b-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635926218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635926218, "uuid": "603e04a9-0692-4f8e-9a8b-ada6c024748c", "comment": "Malware payload (AgentTesla)", "value": "4d366f8df5e1c5b398f9ef8474cb1cf6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635926218, "uuid": "8b229992-2973-42d6-b301-06ccabd2ab05", "comment": "Malware payload (AgentTesla)", "value": "5c7daeff932f45285dd3f3446da1c708085de0b9236794f7467f8c5a97b5b757", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635926218, "uuid": "e93d6de3-955b-42b4-93e1-b728b613afaf", "comment": "Malware payload (AgentTesla)", "value": "715eaa7d474e48c5f4c98f691d569df005aed593", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635926218, "uuid": "a081e6d8-1ab2-4319-9270-634b41dea6ac", "comment": "Malware payload (AgentTesla)", "value": "f0aa07f4e69f4dd269190961f87b559a4cb230387b0f1a00c7585ca4a58e115064acdb1b6c0a41f5a99c8f0ae1294ada", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635926218, "uuid": "6e51361a-551c-4064-ae99-8732ef9f2bf8", "value": "T14DB4EF5636AD9721C72CB7F1A0D68311BBB47E3A1402E64E2ECA75CA09BB3518F70D43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635926218, "uuid": "8e283792-6b48-423f-903a-c83af886fcaa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635926218, "uuid": "8d43da55-b103-4243-bbb0-fbb454e3e29a", "value": "12288:t+jIbw8eGT0AIqI6jZAh+lidw9sgHcOnUqHamMF1:t+Ubw8eGYAIDeO+8Vg8Iim81", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635926218, "uuid": "15ad4b06-19cc-4a71-8f35-016de5920277", "value": 497664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635926218, "uuid": "e814bad0-7bc8-43af-a4d0-0770a3739108", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635926218, "uuid": "69b274e3-1a53-4d2a-97b5-8e6d277c088c", "value": "N0wgaIiUJ2LPTpP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4055904-3c91-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1635935783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635935783, "uuid": "d08de4ec-ce8c-4d0e-82ae-64b44dc91bd8", "comment": "Malware payload (NanoCore)", "value": "1d68c4ca95f314a678a8418604c93f1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635935783, "uuid": "22ae8f9e-a893-49a0-a801-80f38746731d", "comment": "Malware payload (NanoCore)", "value": "5cd8071ec090fea234b83b04c9f616699cc004f1c2bed58bd6cc583dd1216469", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635935783, "uuid": "9de66031-4311-4281-91fc-3216837c542c", "comment": "Malware payload (NanoCore)", "value": "4c984525ea04df4b80113554a79f515a86485460", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635935783, "uuid": "e8a00519-049d-4bde-b118-28d57c6f785d", "comment": "Malware payload (NanoCore)", "value": "c10892315e775d35e85158966a5ba27cdb6c73cd4997a1c4ca2de6ea492a971a4f6b61ac2fda5805fbd20f1447e18c22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635935783, "uuid": "4e8b8c33-710e-443f-a1ee-6c838261bbe2", "value": "T195B4F142366D4B15C72EB7F124AA9300BBB86E3A0552E64E2ECE72CE09773419F35D47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635935783, "uuid": "73914409-9560-487b-98cf-45cc113ca999", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635935783, "uuid": "4596c6d7-7f52-46f9-a1d5-0c2071d0647f", "value": "12288:B0Ibw8eGvwmu7LadOiIr/fG7xNug996TUHMxCbjl1:BXbw8eGIzL6OiIS7b99hHNjl1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635935783, "uuid": "d91b0198-4b17-465a-a20b-810e249d0564", "value": 496128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635935783, "uuid": "a5f2eeb4-8f9c-4d09-87df-83aac32f3cdc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635935783, "uuid": "d193caa7-f942-4f91-851f-14a996d08da4", "value": "NewOrder.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3fd62f2-3c80-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1635928374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635928374, "uuid": "9cc7685c-8869-44d6-bdb9-1b8bb723f50c", "comment": "Malware payload (Dridex)", "value": "b0732a124dc78cb62099958f83bac00a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635928374, "uuid": "adb4ebf1-ad58-4374-b910-9ecf1056a937", "comment": "Malware payload (Dridex)", "value": "5d7a975ab4831c5b9d316f8a3b71fb633eb44d8ea6072a18e96f0acec15d6cf5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635928374, "uuid": "257a10d7-8751-491a-8bc9-ec7ce96e1194", "comment": "Malware payload (Dridex)", "value": "4b43e7b2023df522af375627fd1847818523cbdb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635928374, "uuid": "91949cec-f140-435b-ba06-10a0f3a5b165", "comment": "Malware payload (Dridex)", "value": "f7e286bc97a1531e505d23554b2bcb49a589c5891b816d164a2fac552b8226af14a2ea3fe2967cb7ddf59c4344e07a45", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635928374, "uuid": "b9edd831-360b-4dd0-aea2-190151300ff1", "value": "T11943E05F77367467C018BD39DE0988F1385A34EEED02D60A38555F8B01B92C78FAA627", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635928374, "uuid": "fb8218ec-9a42-426e-ab9b-1a4863d7cc6e", "value": "1536:8CWOPIbZ853SAJbpW2eps/AWpRDHqfK/z3:83vbC9V0Q3HWi3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635928374, "uuid": "5d808773-d887-4b0d-b3af-46695be01f20", "value": 59854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635928374, "uuid": "595da626-1847-4e90-8560-6ea8149dd86b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635928374, "uuid": "8eec5e7b-bc23-4e00-a053-9f19503be98c", "value": "Bill_3264.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fab3927d-3c9f-11ec-843c-42010a9c0014", "comment": "Malware payload (Kimsuky)", "timestamp": 1635941834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941834, "uuid": "ad887f46-f413-4acf-bd10-74bae374988c", "comment": "Malware payload (Kimsuky)", "value": "8edfa086de4dfdc93c0551bbb08cd5a8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941834, "uuid": "28ed8230-e018-4218-8280-4eaef7cc10cf", "comment": "Malware payload (Kimsuky)", "value": "5e3907e9e2ed8ff12bb4e96b52401d871526c5ed502d2149dd4f680da4925590", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941834, "uuid": "26ddfdc3-8218-4e63-a1d5-5eebed35ae29", "comment": "Malware payload (Kimsuky)", "value": "4b1b5bed35bc676e835de14ee033339d37f4549d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941834, "uuid": "e077feff-bec8-4aec-9b0b-efe1224234f5", "comment": "Malware payload (Kimsuky)", "value": "527e9818f6aedb5c6adf08b7b840192201833feee9ab8911cf7010a27f28ea9995eb2368241638c2f84edc44f292e151", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941834, "uuid": "6bc0a92e-a5b7-48b8-b876-a9068c85590e", "value": "T1B8B509A1B94772CBD49E27F895A7CD82793D47F847214803986DF8BE7E63C8125C6C28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941834, "uuid": "476d4661-321f-4ab7-b41d-4b8b3b8c120c", "value": "6cfc78e272a5312f54fe96bcd75731b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941834, "uuid": "beb6d1e4-5524-4422-becc-6ebad2d8fd22", "value": "24576:SdimFPqIwKa4vP8up7Exb5gczxXBvGvo/8vgH1LYZE7sAEsYt7RlPIUhjneH1Y3s:SdiIwKtnYxVHzksYJJ8YFC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635941834, "uuid": "2255c43e-3385-4b07-bbdf-f55d47e65e87", "value": 2414542, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635941834, "uuid": "18323fb9-daa8-4834-9a17-cb5f4f02bcfa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941834, "uuid": "8ed50839-b5d2-40a6-b664-146adcd7d6b2", "value": "5e3907e9e2ed8ff12bb4e96b52401d871526c5ed502d2149dd4f680da4925590", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f669f60d-3cdb-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1635967597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967597, "uuid": "c803cdd3-7eba-45fc-91d8-219d0018d2bf", "comment": "Malware payload (Smoke Loader)", "value": "8db1882ec5e13514974199b1d7ec6b4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967597, "uuid": "3d2a7ee2-6747-4894-8a39-446a9e0e0832", "comment": "Malware payload (Smoke Loader)", "value": "5e62c4c0f696125e1b468a13e252f190d11999b9e4be77a3a703797bc3ef4146", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967597, "uuid": "c95a862e-aa98-4bd6-8b3c-5aa9c1cd1ce1", "comment": "Malware payload (Smoke Loader)", "value": "d3d56cec11582c90df612d506be3d4eb730c5f70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967597, "uuid": "4cf33dbc-e4ae-4a66-a76e-bc94716b8972", "comment": "Malware payload (Smoke Loader)", "value": "0b61a62f9769cfef95759a34f33d97c69f30d6bbd49e47a54a0f981de5fbd87deb991fbc67b9e81ba9825358cbadfb5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967597, "uuid": "a4ee207c-708d-4ca1-9219-9a55997ed1c8", "value": "T1B3E39D25B2E3C073D5A355300870CBBD1BBBB832297D499BE7A4163E5EB42F04A69717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967597, "uuid": "2a3ab729-d5f8-449b-a506-6c72437bb271", "value": "adc309f4258aa7e488ca350060834acf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967597, "uuid": "914fc64c-0535-4b72-b5d2-4001f02ba0e2", "value": "1536:UWl8jWeyYwl6ilZDWDlHPImK+euiFDn9l3PaDsXLa5ALCHaQukBlPE76+daoV0Gv:aKY26iHwAmKzCggTaXalPC6+daCwI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635967597, "uuid": "9bdb3de7-d926-42ef-92a1-8c73d5877198", "value": 148480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635967597, "uuid": "c429666d-5646-4c90-b675-1c9658331da3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967597, "uuid": "98580335-3502-47b0-b44f-8006546fcaf7", "value": "8db1882ec5e13514974199b1d7ec6b4f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfc9d567-3c70-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635921576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635921576, "uuid": "a029daf1-98b8-48d9-bfbc-0a5405a22fda", "comment": "Malware payload", "value": "e86fb40f602fa48bc13b2c366a4da0de", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635921576, "uuid": "9471dc2a-6d00-4587-a013-f17e28303265", "comment": "Malware payload", "value": "5e642867f91affd913965e6f9ef300e06f59e9c493a1d2d25671dbf6057f340b", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635921576, "uuid": "f32f96fa-1497-41c5-bd06-ed16f86a1c9a", "comment": "Malware payload", "value": "9f4e92b6e9b055e6f9ab5f5337de06fbda037ac9", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635921576, "uuid": "3cacdc8d-337c-45c8-a2be-d2e50c0ddbf0", "comment": "Malware payload", "value": "51467599311a683842553904044fb9c89fb44ab67d65fa18c149f119284cd453b34c57badbac6f7a1a024db51048461b", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635921576, "uuid": "4da3d108-2c16-413a-ab7f-b04ec24497b6", "value": "T1A893F175FBD3F622C74341BE126C3EB3E61D34D67794682F9E8766499510A22122A0B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635921576, "uuid": "2df7f37a-4e18-4e81-b20d-16353e486b00", "value": "1536:lAq2iaFepGgbvnfR3Dl2036Zqf4GW4QIwf8rdhTfgA4i6WKLkD1kwLIg8fW:lSiHpdrnfR3D4036Ys4IfYdx4i6lQDv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635921576, "uuid": "1749ad57-dfab-4866-b445-e4b4c5351ec9", "value": 88814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635921576, "uuid": "2a961c31-caaa-47d9-bffa-d1827d7c7696", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635921576, "uuid": "7096e7e0-a1a1-43fc-bdf4-ef7e7528d248", "value": "DCO Q3 2021 Earnings Release_vFinal.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb85f705-3c7e-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635927555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635927555, "uuid": "f2797873-5547-4d33-b7ef-5d5be6e84e27", "comment": "Malware payload (Formbook)", "value": "d1ba9c31918b143a613f1bf7773f5e24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635927555, "uuid": "14fda48f-1d8d-4a6c-a591-a7780c3f71dd", "comment": "Malware payload (Formbook)", "value": "5e81e43a3786941d213c0f822d65bd6442a87dd97f6ca544bd4aa4dd37ca3f9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635927555, "uuid": "150fcb53-1d49-4ef5-99d2-5128d9e0f923", "comment": "Malware payload (Formbook)", "value": "128af2d5f2237b9e6b48c960603589646831d5b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635927555, "uuid": "2fa648f0-2998-4d58-90be-5bb0892e438f", "comment": "Malware payload (Formbook)", "value": "4bd99624aa244e51f3f765a3ba31322b3a85dff8322ae861efce7690810d314ceea06ebb743ac3a78a09300e5ca96dc4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635927555, "uuid": "1336ef4f-45c3-4d8f-85b0-4c0e9b2afb85", "value": "T19CE4BF82A5A0019AEDB55F72D83B4D2956533F6EBCB8F48D1DA6F52137730F3022A907", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635927555, "uuid": "34bc750f-350e-4785-87a4-5ad8bf86382b", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635927555, "uuid": "6f3ce11f-e8a2-4cb3-869e-4a7c932ef005", "value": "6144:e8LxBBWYFgyl0d0hlw9DKlgjvsUQct+MYLeEBM1HbzsDC9pLQnmM/YzIQJJQ14Lw:i0vwJdYxzwxQmUYzIQvQZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635927555, "uuid": "958848d5-39e5-4774-84ab-754addffbead", "value": 658017, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635927555, "uuid": "7226e794-6291-44eb-95f6-e1f3b2643383", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635927555, "uuid": "ea61c37d-1e77-4c5c-8e2b-cd884807eedc", "value": "TTCOPY03284848924 (1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8351295-3cd4-11ec-843c-42010a9c0014", "comment": "Malware payload (Hancitor)", "timestamp": 1635964513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635964513, "uuid": "adc115f8-1c07-42c5-b824-a7f4485350c9", "comment": "Malware payload (Hancitor)", "value": "35104785ec21f85a33fd06ed01995cc7", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635964513, "uuid": "bef2bbf1-ce17-43fb-9c17-40cd0590d8e5", "comment": "Malware payload (Hancitor)", "value": "5eb2832fe7f133fcd216539e62ec89777c191cef5709d2e447a57d38b24a246a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635964513, "uuid": "0d29bf0d-4da5-41a2-be48-b1f9de3615b3", "comment": "Malware payload (Hancitor)", "value": "9698950a3ba07101b628742caeebb01d2c2482fa", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635964513, "uuid": "fb2825e9-b46d-45dc-a010-6da1448bd79b", "comment": "Malware payload (Hancitor)", "value": "e119397cd46278b7c37d79cf881b1155461bc71f5f8993e699d2b54e25097ef31732bd823556f859d90625193dbd2f7a", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635964513, "uuid": "cbd0d281-68b5-4c75-b372-ba04e84345fa", "value": "T182C40103F9959F57E51BC3B87E628C696B6DED494B08B7CB10317F0EA7B03609C4264A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635964513, "uuid": "aeed8a01-b1f1-4ff9-b959-758e7bc4919c", "value": "12288:EV9iQsDr8N50tEILt/5J0RiCFNpQU0czk:EVXkr8NqnLl08CDkco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635964513, "uuid": "14d71aee-e944-446f-9521-005ba6bf208e", "value": 589824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635964513, "uuid": "71af2d7f-7c0a-4294-a830-6761204c4488", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635964513, "uuid": "349c7698-3483-41c6-be90-b46cf6a82ff1", "value": "35104785ec21f85a33fd06ed01995cc7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a1eebed-3c59-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635911580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635911580, "uuid": "4723face-848a-4242-8f0a-74ff85042a87", "comment": "Malware payload (Formbook)", "value": "068b5c216553c58c1068819bb8bd0195", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635911580, "uuid": "ed6e108e-3f55-4285-aab0-6306a776a36e", "comment": "Malware payload (Formbook)", "value": "5eca5808782c82666c8bc694f1908fc5b685a5310c9fef5da618853e5f7bd846", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635911580, "uuid": "f8183f29-168e-4f33-8925-c8132d7a840b", "comment": "Malware payload (Formbook)", "value": "728bf8c7cbdd6eeac55836e86f0a17ff23390de2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635911580, "uuid": "56da6173-6788-44ee-9c4c-5418052b422f", "comment": "Malware payload (Formbook)", "value": "22723e51b7ee362ee0a8103c301010e6b9c828e4af720c0b9523987e7abb2c255d14cfdbb2d722ae4ed3e9b2e010340d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635911580, "uuid": "4a10538b-bb4b-4581-8afb-072098637802", "value": "T132A45E9CB6014A72EC1E85798C134A147B271F371A54AA89138F3ECA83FB6DD1F15F86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635911580, "uuid": "4d4ab51d-92d5-4b1d-9a16-b37b85723096", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635911580, "uuid": "d390cccc-990d-4125-8241-4c8555cf1a96", "value": "6144:qBZwYS7/vf2T5LXk0zi9o7eLyXCBe3U/GaniQ93A7QgizKcvkw:qBJs/vfk5o0TDXrU+iRqOKc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635911580, "uuid": "33aa8ccd-f824-42ad-8f13-2e7d5c8ba7ca", "value": 480768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635911580, "uuid": "0dbab724-bf8a-476f-bd11-f28e1c151fd9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635911580, "uuid": "bf0ca07e-85ab-4882-8fd4-39f24aa7d1e2", "value": "068b5c216553c58c1068819bb8bd0195", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "034cb774-3caf-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635948291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635948291, "uuid": "af568f22-cadb-49ef-97d8-67edda2f1c5b", "comment": "Malware payload (Formbook)", "value": "0275cca568de6814691615448f621d63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635948291, "uuid": "a163aab7-e507-4860-9e78-b85dbb61b070", "comment": "Malware payload (Formbook)", "value": "5ee3006ee17c64cf19760d3a1e5d8ac5d1e8d0d1d5f0a1b5f2b1a20d6d6b28d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635948291, "uuid": "6188888c-a38e-408a-bfc2-3b63dee80f95", "comment": "Malware payload (Formbook)", "value": "4701dddfb9f8691678da3de72eca8b358b1908a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635948291, "uuid": "e4c8cb2e-d04c-4357-b917-2038eb913224", "comment": "Malware payload (Formbook)", "value": "e758bc50ffa27a205d00438ea4cab59ab8d2b0e571078151a2386046038eaf1f02bd99d31ff2fc0896943540275eab86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635948291, "uuid": "1d5c8dd7-e367-4b66-9fb3-0b291e994a62", "value": "T13A541203B7F295FBE55B3F72A4BAF3F9F636801082112A0357505DAB3F64292924C697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635948291, "uuid": "32ae0d3b-9cdc-49f5-a5e2-c51beac471d4", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635948291, "uuid": "3ea2bb33-abd0-4581-a821-72d64de09b40", "value": "6144:F8LxBsndFpaVESAQO8+EfQu5e9TuEh/G5NXWFge56XbHCSMp:/nUbOAfXaf/G5GGHjO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635948291, "uuid": "7ac17c42-c549-41d9-a07d-be4cb172e965", "value": 296505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635948291, "uuid": "ab85db82-c6c2-4f2d-9cb3-a66c595ff68c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635948291, "uuid": "29f3206f-402e-4458-93ee-fd98d90943dc", "value": "fffff123.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dc25e2b-3c98-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635938618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635938618, "uuid": "2d9ab0b1-6717-4af2-a33f-9c31b7d76064", "comment": "Malware payload (AgentTesla)", "value": "26ac1aa2500b0eb78364d36d06aa3804", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635938618, "uuid": "37dba5ea-a5a4-431e-a1f6-69d091b07a20", "comment": "Malware payload (AgentTesla)", "value": "5ee88c64a19ad5c588a28483ee94775989bdd7abd50098f669de8d77a520a901", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635938618, "uuid": "15513f0d-08ee-4463-bbe6-6be9a2d42770", "comment": "Malware payload (AgentTesla)", "value": "c5ac1f0867b4ff9aab22a0682b53fbe76c56db32", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635938618, "uuid": "d5e2df4f-84f6-4cd3-b443-97f371632968", "comment": "Malware payload (AgentTesla)", "value": "4a7849f1430bdc29b16fad62e56530e7cfa4aadcf97d8a48c58743b03acb20f778b07daad9e454e685fa80e66f83b670", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635938618, "uuid": "310cfb09-6f7a-479c-9593-c3013c56073d", "value": "T15EA40116315C9BA0C7ACB7F160EA9360BBB87D3A2412EA1D2DC970CA097B7114F74D97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635938618, "uuid": "de69b9c3-1c43-4324-b0fc-fc189bb134bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635938618, "uuid": "6cc76a46-00ae-4144-9ba2-198a35ff801b", "value": "12288:/CIbw8eGBmkvrr92ICM/C3USu6stRfxcf1:/lbw8eGBdv92MiTPsfmf1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635938618, "uuid": "baefb5b4-9179-481f-a1e4-cd5ba27ccb21", "value": 491008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635938618, "uuid": "ac751776-e2bf-451c-bfc7-9a76334b38f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635938618, "uuid": "afdde7d4-aca8-4dd4-82bc-32d46ae29fce", "value": "iKE4egUWvpOfwqO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "397cccb4-3c5c-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1635912734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635912734, "uuid": "6f03f0c4-d900-49bf-a446-0becd184370a", "comment": "Malware payload (Dridex)", "value": "b77854a837b56e490762429e3712b52c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635912734, "uuid": "a8e33506-954e-43ba-8aa2-2f99bd1d4278", "comment": "Malware payload (Dridex)", "value": "5f1eafdf0e89dc4334a3ec2867afa8666706a7ab3158a0bf2e9c15728f0966c3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635912734, "uuid": "593f904d-c428-47d4-9318-142e5ed13f4a", "comment": "Malware payload (Dridex)", "value": "06566a5e8ae232429856e59387b87b30a8c4e36b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635912734, "uuid": "a33ea67d-1f87-42e9-9d77-ba88898dbdec", "comment": "Malware payload (Dridex)", "value": "f9cd2ea618321f45d48f32502a2dc06a01a9120fd050b027dca8f0048865eddfb2768e726c4dd52920b42dccc47bfc62", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635912734, "uuid": "ddfde802-483c-4c9c-b7a7-d2833628c5e9", "value": "T117A4AE94FAEE40B8E5187A74C4DB19A56E821E24C4AB1615F4587F0E4E338F3970FA73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635912734, "uuid": "2efb21d8-c286-4e0b-900c-2abb63baa305", "value": "c6e29838e1e1c81859cd162bf701404b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635912734, "uuid": "c950abfc-202c-4f18-af45-b51f688fcc8d", "value": "12288:2Gw8ObmVk9gbUngly9sp+ROx8ufNX/7vuZU/4BLl2iL:2rxC+mggkqIwG4X/7vuZ44Zl2iL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635912734, "uuid": "31e1876d-c7d3-4256-a842-bf104d8de193", "value": 462848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635912734, "uuid": "ef50d77f-051a-4971-9ffc-a58374fbd3a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635912734, "uuid": "1b6374c6-9ef4-4826-8861-0d546e0055fd", "value": "SecuriteInfo.com.Suspicious.Win32.Save.a.16586.14520", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03e70caf-3c4c-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635905772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905772, "uuid": "afabd492-33b1-417a-a538-2997c4dd5597", "comment": "Malware payload (RedLineStealer)", "value": "65b5067f03735b5091ca67dd040022ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905772, "uuid": "1eebddf1-c1b3-469f-89e7-9c6ff2d4eb91", "comment": "Malware payload (RedLineStealer)", "value": "5fc1c889180611225c8d2d2e7bee89f77e9946790b93552f750078269ff28f3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905772, "uuid": "b27a2350-d1af-49ce-a460-2028520de86d", "comment": "Malware payload (RedLineStealer)", "value": "99e32a5113e59a0b74f53f0af17e8e91e57b066a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905772, "uuid": "a18d7cdb-a61e-4283-8d84-5c4910ad18b4", "comment": "Malware payload (RedLineStealer)", "value": "ec35fd862d98796ddc534a9e02b1e571861d6280c834ed4c619a9eec010bcce88f029c012e8083bf4681df3d6c6744ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905772, "uuid": "47bee6ba-7e04-4cbe-81b9-27a145b8aef6", "value": "T133E3AE11F2E2C071E4A3653C0874CF711A7BB8721975499B2BA4263E4EF77C04A6AF67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905772, "uuid": "faa0b5f2-2e03-46cd-8f21-ef2cd7e1f549", "value": "adc309f4258aa7e488ca350060834acf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905772, "uuid": "af11ebdf-5b12-4922-b3b8-775bdcfb43a7", "value": "3072:8KY26iHwAmKzjuHCJ/tIzv4aX1lPulxwLer:8a6yf/zgSFgr1xu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635905772, "uuid": "568f680f-1494-4a5e-9105-a53d58232c51", "value": 147968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635905772, "uuid": "80c73420-676b-46a7-815d-8a30d7a76ad3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905772, "uuid": "5f9acc3a-9ab9-424f-8632-15d42ccd8af4", "value": "65b5067f03735b5091ca67dd040022ad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abd293fc-3cd9-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635966612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966612, "uuid": "46c4972d-5832-4166-96d8-695c1b06c2d7", "comment": "Malware payload (Formbook)", "value": "411bc60dedab2323705c49b657990d59", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966612, "uuid": "4f3ec333-0cb0-4cb4-beaa-c69f4799d659", "comment": "Malware payload (Formbook)", "value": "600bf146efa51b38dceb6271a44fc4cc9bc115d280ef01700305a34b39581b17", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966612, "uuid": "f06ae68c-4c7b-4c1c-914e-63a64c517673", "comment": "Malware payload (Formbook)", "value": "c23e28d2fb158e8fc2f3c6179702e2a980b29b54", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966612, "uuid": "0f4d2901-cfad-4f76-968c-1c680cea6706", "comment": "Malware payload (Formbook)", "value": "9d4afb637161df7a41996f35e141d45ab3bee2562ae0b61a4457321b93cd7daddc5dedd8d1422eb1aa66e0b0fa46e8b3", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966612, "uuid": "4d362cae-f373-4b3d-8d10-3a7532d64188", "value": "T16C8557F0AD01D4C1F57E5B6AF2FD3A48A1343217EBC94A4A00E7E6551EF6A11B90ECC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966612, "uuid": "e42bc83f-acdf-41af-9936-3a3ccfe160b4", "value": "12288:74eR+jZutln6bXENGNnMqs366dr+4yq4mzDbym2ypULhKoqy7R66X5:a+l6DENGZMqs366dq4ylO3LpyhKoq88S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635966612, "uuid": "de1a90da-05b7-4932-96c1-ace5f9238b16", "value": 1812267, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635966612, "uuid": "b33a2eff-92a6-4e10-b499-d9755ec31256", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966612, "uuid": "0ca6bbf6-b61d-4f21-95bc-b721a85141b6", "value": "INV IFL NP 22080.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7db10e5-3c7e-11ec-843c-42010a9c0014", "comment": "Malware payload (Pony)", "timestamp": 1635927656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635927656, "uuid": "32973e25-66ff-497f-87fc-19a379a036c6", "comment": "Malware payload (Pony)", "value": "6a23fc9d918519ac5744e8bb2b3008c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635927656, "uuid": "408b9f01-06b1-4667-a147-3fc77724c4ef", "comment": "Malware payload (Pony)", "value": "6029ffc126d344e9bc907a42557a29346eb60bb5a36e22b8d6e83b78d710dfe1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635927656, "uuid": "7373ea19-1eb8-4e2a-9d2c-7b23a820d120", "comment": "Malware payload (Pony)", "value": "0fe176b0a9a2d9ac355bfa4ac1eceb6711790737", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635927656, "uuid": "6d6b2397-3dbb-41cc-a7d9-0dbb0078b0d1", "comment": "Malware payload (Pony)", "value": "65ba6a5b82026a15df3767251441ef12ed51e827f7864d7bb460cb66ba3e69f4184524594ea2f80e98207ae5621b660e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635927656, "uuid": "00ecf329-a49b-43bd-a6ab-c7f8b177096b", "value": "T187A4D096BCD34AD1F8416D3D1AAE977411F73CADEDC28E4ED87A25F888324116B41BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635927656, "uuid": "598d8f97-de88-4244-9c5c-fd075941a78e", "value": "8c79db4ac11049f05c42894bda299d86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635927656, "uuid": "c96dd096-9cac-4774-bc7c-4e6a919ff490", "value": "3072:GtLleOw8MDa+gjtgQwh4vg+ZBqt6Bk8UWyWLAQPftuS0QR:8lwZDajwh4YNgBkXubXN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635927656, "uuid": "81f3d1d3-b38a-4540-8071-0ecbc95f1a00", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635927656, "uuid": "e90f296f-5b58-4aa7-b856-59399b2c630e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635927656, "uuid": "c197fb56-edad-4b45-92e0-df90987637f6", "value": "6029FFC126D344E9BC907A42557A29346EB60BB5A36E2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f91cadd4-3cda-11ec-843c-42010a9c0014", "comment": "Malware payload (Neshta)", "timestamp": 1635967172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967172, "uuid": "df5d9f71-105c-48a3-bf89-789f946e4f7e", "comment": "Malware payload (Neshta)", "value": "36ca5751b0b2d9321215f223a18aefbf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967172, "uuid": "5e46c591-6b51-408c-ba47-b06f08dddcf5", "comment": "Malware payload (Neshta)", "value": "602c4326ca0aa0a007b10241d7dae3fdbef7705e14231ba85e8635578cfdb0d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967172, "uuid": "4990f687-aeaf-4085-8b40-cdf6f245e0ee", "comment": "Malware payload (Neshta)", "value": "c9661ff48f2eaa2718a46b23a70a02a8461715be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967172, "uuid": "d10403b9-6de8-4911-a925-581033b861ed", "comment": "Malware payload (Neshta)", "value": "7c40526f0b2640a0c47660c0b1220fbacd15463e484235ef592c743112ed5b16998d57a6af9d70d84dfc759baf501ea3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967172, "uuid": "e2ae2c7e-862d-41b0-9dae-afdd9e793e8a", "value": "T140640211B6E1C973C0251BB9DC2FAB74D2B9AD166831156333F02E6DEC797D3A90A04B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967172, "uuid": "a0a36502-3555-41d7-ae83-a3484d82a387", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967172, "uuid": "45ac5241-b8f0-4da7-92de-fb8f0fff579f", "value": "6144:k9p1/VSGV0YGiZTkGpO1ttI0nv4DmW04tJgmYGGOqX8BlL/c0RU:kNSLY9TkAGI0MqezYOqGeh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635967172, "uuid": "4f6bb18a-d4b9-40e0-9b84-7d3f048220b7", "value": 332340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635967172, "uuid": "f769c9f9-1a01-4ee3-adcb-599ae18d925b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967172, "uuid": "9ddc6830-01c2-48ae-a1f8-eba3d82886f2", "value": "36ca5751b0b2d9321215f223a18aefbf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b51c9eb-3cbd-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1635954371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635954371, "uuid": "e6a4a395-abbf-4091-acc2-107f16cfe9c9", "comment": "Malware payload (Dridex)", "value": "a18c0daf9d855871727b02876079459f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635954371, "uuid": "bc1d66f8-9b6f-4e43-ac37-5ea543dabf93", "comment": "Malware payload (Dridex)", "value": "60a26ca4b6bf5bc84df00eeee7548214efb3d434b36d6a65dffaf8a98d7fd452", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635954371, "uuid": "2d85a49c-6293-4854-821b-95384a8f05ea", "comment": "Malware payload (Dridex)", "value": "ae22eb98d244e6a1fc104cdc149afa0cffdd66ac", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635954371, "uuid": "9b1e4d77-5633-4701-9aff-d655fa07886e", "comment": "Malware payload (Dridex)", "value": "97a62a8fcb8bd8926acf45ca24eb59a178844ef7c88da350cd37fbd5ea51d476fbb7cfcebf5714630d055d78bc4829f2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635954371, "uuid": "0bd371b7-e2a7-43c4-a447-b6ef7af7a608", "value": "T1EB8302ECD16C7408C63DBA36782F7EB590594142A1B5C3CE3C9DDA8842B125E5F6D23B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635954371, "uuid": "0bbd518b-06c3-4de2-823d-67694b2ee788", "value": "1536:8CWkPFwJpvc1e+BwT8YIbDMz+1d6xXe40dsgdh5KJb0OSCRHMxrw:83bMrbDu+1d6xXe40dx3ObdSCsNw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635954371, "uuid": "1f884ce2-b168-49f0-8329-20a61a08bdb0", "value": 86482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635954371, "uuid": "0e22981e-27f2-4ae6-b5de-b5420a62a039", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635954371, "uuid": "99bfc3d9-0b8d-4d7d-9569-492af6b6916e", "value": "INV 028038.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f791fac4-3cc8-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1635959438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635959438, "uuid": "618d29dd-34ee-4437-b5f7-f9658b4f5f4a", "comment": "Malware payload (Dridex)", "value": "4249e5b55da36b0b2e931087f5457d98", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635959438, "uuid": "fa1feb17-a17f-4854-a7b7-34ff70cca4bc", "comment": "Malware payload (Dridex)", "value": "610d722f6a9aff51523bbafc7769a8394e92d68fb424ff9f5a96e4853a1f2b9c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635959438, "uuid": "ab5934f3-6c57-4b1a-9e77-f52b2eee9cb6", "comment": "Malware payload (Dridex)", "value": "edb29eef67b301724527ee997d4c608ff33b3b83", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635959438, "uuid": "707f9081-eb2b-4d5e-9cf3-59deaae6fa77", "comment": "Malware payload (Dridex)", "value": "2616eb7655bd4be8af3dcacf3cda2793c411fb04b9e68878dca31532517ea388700ba8add12f54c7ecb83eed7f1c526a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635959438, "uuid": "e36ca924-031d-4861-9858-8af34ddb0cbb", "value": "T1BFA4BF04C1EA0676D52B62FE75FF0CCA47104DF9B506AC84D3435A6A5B32FEC3A7A849", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635959438, "uuid": "e28676f3-ea65-4b5a-bef3-81d00bca95ee", "value": "ccdf79216449388cf5a36d38a385d866", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635959438, "uuid": "d5833638-f0ed-42f6-8951-db0f38d585e2", "value": "12288:lZKEZNxJPdthZz/MqmOce24Wqa+cKdDSFczjJgiUCeoCqoE:lZKEr/1jhz17Px", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635959438, "uuid": "254a152a-261b-438c-97a6-3e98a22f88de", "value": 471040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635959438, "uuid": "f09c0253-4239-4b1c-b644-8b879c589f46", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635959438, "uuid": "ca460553-4bb3-456a-a1d5-bd4da9611447", "value": "4249e5b55da36b0b2e931087f5457d98", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb7dd64f-3c9c-11ec-843c-42010a9c0014", "comment": "Malware payload (LimeRAT)", "timestamp": 1635940547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635940547, "uuid": "5c01cf49-beaa-4e04-9909-e7ea50700e17", "comment": "Malware payload (LimeRAT)", "value": "cafa6440c7f55b21aa21e3dc0df318d3", "object_relation": "md5", "Tag": [ { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635940547, "uuid": "8520ddf9-2940-4115-9d9b-6fe9897ecad3", "comment": "Malware payload (LimeRAT)", "value": "612bd160a3405bb0c2602543764d8ed2da8cf88d2c42a5f241e19e60530919f2", "object_relation": "sha256", "Tag": [ { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635940547, "uuid": "35138efd-dfef-4567-a9b0-7ff90473dd04", "comment": "Malware payload (LimeRAT)", "value": "7acc93758e1c4a63db5910a89167087aab0fb9c2", "object_relation": "sha1", "Tag": [ { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635940547, "uuid": "26b64dea-b03b-4791-a8e7-cc8d51fa4e7c", "comment": "Malware payload (LimeRAT)", "value": "b8a855235592f02be686eaee6063e0fbd4178cf8fe600a480e8146cdec894404361a083416945f7ae474f6b02755d213", "object_relation": "sha3-384", "Tag": [ { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635940547, "uuid": "53bd0ddb-b720-479b-9346-c867743532c7", "value": "T177151035F7BE55006C2524BEFAAA4DB71C91A18CD58FEFAA012C1A7CA4C7C572E48CD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635940547, "uuid": "1cbdc52b-b1fd-4157-825f-05bd0897ef1b", "value": "1536:OEjIPKcFRo16lsvRlbAQpKTjjv1sofy8e:OEjIPKcFLlwJETjjvQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635940547, "uuid": "92d505be-3fcb-4151-8733-58ad6859f3b6", "value": 947462, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635940547, "uuid": "0ff957f7-04c0-462d-be99-ab63dbcf2f1d", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635940547, "uuid": "f0c61518-bb38-4af6-81c6-c87863a41fb5", "value": "Server.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e318cbd-3c48-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635904205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635904205, "uuid": "b82913ce-6e64-463e-a88e-e5f691e940cb", "comment": "Malware payload (Mirai)", "value": "3cd3aee91b2e3b65a3b16dc9d066ec65", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635904205, "uuid": "8ea52c89-8826-4b88-9616-61d37ec7e518", "comment": "Malware payload (Mirai)", "value": "613cf8c898fa3858e1487a48486e8c009901b6cd2acc538ca63a9d738730c318", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635904205, "uuid": "8856ccdd-c1ea-4690-9d19-002b27132b6e", "comment": "Malware payload (Mirai)", "value": "a70e11e6c7691958371545ee5de67a7573ea8ea8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635904205, "uuid": "dc15b374-2482-462b-ba27-360fd328671a", "comment": "Malware payload (Mirai)", "value": "bc339670d9afb6782dd6451d7f2b6079458b27accdf8d93c9201dfee950162aacac80e7dde4724cc6e9e0cb4afbec6c7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635904205, "uuid": "7aafcf97-77f5-4812-8b9e-b8635c6fac99", "value": "T1292302432093BA03E03058FA8562CCDDB65EA6BDB1BF76B721484E154C35993ECB18AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635904205, "uuid": "090a3681-cc26-40f7-b8b8-392e28492ffd", "value": "768:aK7y1XGO1LCNgukEkvwtqPnH7u83nc0iFcgf9q3UELWt/iw+kvBGg6+fYtrBHZ:E12O1LCNguovDPH7Tcr+gOLWhiw+kvBA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635904205, "uuid": "c14dcc48-cb1c-45f2-b44c-425d414b45d9", "value": 48696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635904205, "uuid": "d8695665-3823-42fe-b968-6c47266d2284", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635904205, "uuid": "a531c27f-af41-4360-8179-47822eaf65dc", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83f2b82b-3cbf-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635955379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635955379, "uuid": "4e803991-aaa6-42e3-80ec-78bc275b65b6", "comment": "Malware payload (AgentTesla)", "value": "4cd9bce8c50e1a24154fd00c67e1f35f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635955379, "uuid": "85079bb6-195a-49a5-a34f-9c863289dd36", "comment": "Malware payload (AgentTesla)", "value": "61f18743c835d664c0f8430672fdf8b900dcdc539f41202b197105cd0ed832df", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635955379, "uuid": "b948a4c0-fd56-4204-ac52-56f34853df9d", "comment": "Malware payload (AgentTesla)", "value": "ee96d9890af0854bc5de4fbc62295ce70754f20b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635955379, "uuid": "2f531fdd-9046-4031-af39-7ce45f61d05e", "comment": "Malware payload (AgentTesla)", "value": "ce2f340f2f3d19566cd231399256dd202db24c0e06910a4192c59da8e91d95d7d09df9002cbe10a7113a6f7033899ad5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635955379, "uuid": "2293b6c8-d656-4abb-85b6-7cee4116275a", "value": "T1D6B4F1A231AD8F25C72C7BB1609643917BB47C3AAA82D55E5DDE70DA08377000F78E5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635955379, "uuid": "e071f186-a7d3-40ab-9cb3-461ef9eaf04e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635955379, "uuid": "5a58727f-bb28-405e-bdab-b0383a4deb54", "value": "12288:EIbw8eGEweMPaHFZ6UwLOZ+rXtXy7vq0xPe11:Hbw8eGEOal4UwuK9yzTK1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635955379, "uuid": "f8de674b-4cf4-4cae-a196-fc39334b6463", "value": 504320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635955379, "uuid": "f82afb87-c661-40b2-ba28-fdb1fbbfa5ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635955379, "uuid": "8e53a37e-54f2-402f-b1d1-0550a742cf45", "value": "BL-NO ASIAN SHIPPINGS DOCUMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a0909d7-3c9e-11ec-843c-42010a9c0014", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1635941242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941242, "uuid": "156d9cce-61b8-4cf8-a840-695da8e3c4b0", "comment": "Malware payload (AveMariaRAT)", "value": "5141e6e6ae338c4b40470c4f463e8ee8", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941242, "uuid": "033e8028-4362-4ae8-b7f4-246df6fef4eb", "comment": "Malware payload (AveMariaRAT)", "value": "622689747d4afed27c26669a907d387fd2b590e31546e30bdae84cd0902764ea", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941242, "uuid": "57f516f1-8b5d-4a91-b645-4682390befa0", "comment": "Malware payload (AveMariaRAT)", "value": "35c6eba4d10a76b441b0241635ab5f09b720b339", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941242, "uuid": "5a604c8d-d122-4114-930c-c7ab6ba5e6fc", "comment": "Malware payload (AveMariaRAT)", "value": "dee9fbe04fe7bc8e3885c5f9464a88775d6c7cbcf2894a5bd484ad3889297ae8b7411af1a7a2ae836402e90b43af09ac", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941242, "uuid": "8788ef56-6c2b-480a-b67c-9d05dbc8be95", "value": "T18BF44920B259C545CBF83730CF66D1F017616C6EEE10CA1B24E43EDFB9BDA1746216AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941242, "uuid": "17e5fc3a-ac1d-4b70-a91b-ab9c1ef3f34a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941242, "uuid": "6951f941-e3dd-4281-8245-61913852869a", "value": "6144:G24n32Etk+HPQtlZc0O7lA0pg5XE/NFN47LNMyfp45b4IDolTqRjjQ+siT0Dxr0:G2SVPYvcV7lU5UFIiya80o1qRfLTQV0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635941242, "uuid": "37139908-21e5-4a8c-8415-0465fac5127b", "value": 727552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635941242, "uuid": "6961132a-088f-4e6d-b406-a218f7f69d7d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941242, "uuid": "b8b37f09-64fb-4f02-a501-5df06e1b117f", "value": "SHIPPING DOCUMENTS 1 & 2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed4e172e-3cd0-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635962857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635962857, "uuid": "25039df2-68b7-422d-bad3-d1af74225f78", "comment": "Malware payload (Formbook)", "value": "6bf3bd003b84e7c4098642df174ef0a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635962857, "uuid": "f8b8f430-cc03-48ef-8ec5-4d340782362b", "comment": "Malware payload (Formbook)", "value": "624df197f011c71ac8afdaebfef7c1a6a598c5ad47c1bcbd70695ca858978de3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635962857, "uuid": "332dbe60-3c63-42dc-a4a3-756901076fa3", "comment": "Malware payload (Formbook)", "value": "304e94448a7c9097c53d1a87dfc3a783323dd049", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635962857, "uuid": "d9fff898-46c3-4ffc-81fd-680eb7e8c90e", "comment": "Malware payload (Formbook)", "value": "19920b26c1e1e8c7a5f6ca615b4522b19a5390c363beb86cf74cedbc89d3589773eff24ca4720774e2dffd2b7b9735f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635962857, "uuid": "4acd80ff-23f6-45fe-a548-88756373d285", "value": "T1D57402202BF83733DD3F67F92925162447B5F14A2116E3897E8A3ACF916AB514D80F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635962857, "uuid": "32dd098e-d29f-48dd-b2d4-3c3650438528", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635962857, "uuid": "d6d1d5f1-2e05-4130-b4ed-4b1b4365ff07", "value": "6144:35s1C+Fk8mhcQ2eGyV2FI9IvrEk4yHULLtkkNEhlTqG3N:3735PwC2F8IvADsOLt7k17", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635962857, "uuid": "7cb9fb66-951b-4a30-89bc-6dc39995c0be", "value": 368128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635962857, "uuid": "9c8d1077-c8f2-4099-a641-0f9960684830", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635962857, "uuid": "83b15717-b001-4aa3-91f8-b84fb5457968", "value": "PCB 102021.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0132c814-3cda-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635966756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966756, "uuid": "350deba4-e293-4342-99c5-bcfaf3341406", "comment": "Malware payload (Formbook)", "value": "00c5207a497c67c6c109220f23bc100d", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966756, "uuid": "58a7a5ce-84ba-4730-9dc7-41aa4c7b9a06", "comment": "Malware payload (Formbook)", "value": "624e518e5ec6d16265ab6934734a78457bfcfddb02e9ebda6abb33cd075f9095", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966756, "uuid": "e22299a6-686f-43af-8544-d507e222281f", "comment": "Malware payload (Formbook)", "value": "849e7ba013ab080d18a1c6e7d44180b252c5a608", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966756, "uuid": "2b9df695-e4b4-486d-b7bf-f98b7caa40d7", "comment": "Malware payload (Formbook)", "value": "541aee6d7fc03e0e0b2bee3aa0c4ecf530f66f06addc3681fcd7fed7ae3965fd66280353e6300b110ffba28602c8ac6f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966756, "uuid": "cbb2b44e-f1ab-4ef6-a6ad-672773412f87", "value": "T197141253BF1F983AFF9456BE9DDAA0D48C6C4E298A4245157CD0F70F8C7BA502970417", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966756, "uuid": "d0154766-b05b-4c48-ab23-bd50703bc9de", "value": "3072:PSQQ61Mxc0+TDToA6AjJ9I66ZjKxqBuqf6TmIK5b86898jomAPF:PSQQ6GxLMIVySBKq8mx8bPF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635966756, "uuid": "5b3619c2-3963-466c-ae74-d4e20bccea65", "value": 206184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635966756, "uuid": "70f71c8c-ce5e-4f1b-9c28-4ce321851ba2", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966756, "uuid": "8b8f488e-3b2d-495c-a724-670d72bbc1b4", "value": "NEW ORDER.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7dde926-3ce1-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635970149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970149, "uuid": "e7a6cdf1-58ff-4b7d-9862-b3e94bb6c253", "comment": "Malware payload (RaccoonStealer)", "value": "ddab526043e348eaf19ceb039bd7a0c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970149, "uuid": "e31e0411-76b4-437b-b690-c20f766b98aa", "comment": "Malware payload (RaccoonStealer)", "value": "62620fec283076b6d5ddc4c17802ae073538614321e5cd782d63d28c7de48f47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970149, "uuid": "b0173d67-31d2-4901-878d-b34eb59d8839", "comment": "Malware payload (RaccoonStealer)", "value": "445b9b43148b7f8e96c5e9a1babb8f25e3cb6db9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970149, "uuid": "38f8d1d1-dd4d-4fba-88d3-cdd7d76dddcc", "comment": "Malware payload (RaccoonStealer)", "value": "2738c1d70246871d35fd9dd7ed18386981fcb1e2909a07c6bf5826b7cb85d99ba4ff6132e26fd4898990589241de588f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970149, "uuid": "5471f547-3680-4dfd-b518-3bc7bde734eb", "value": "T14DC4E000A7A1C034F5F666F849BA62A9B53F79A1673884CF17D526EE4734AE0EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970149, "uuid": "0db131e9-7d85-4eb3-a594-a7f51c85ff0e", "value": "7e51d9833813c1a3fb57baba54855909", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970149, "uuid": "e70fce0b-7be6-42bf-a467-fa6ed70dfcea", "value": "12288:jTf4h/L+HpYZPErvwBi7F+vc3/QpLwYiUeZt:nO/LYaZPyR+vcvPU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635970149, "uuid": "4a630061-9499-4f32-941d-5bf28ed34306", "value": 551424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635970149, "uuid": "c54b7c8e-5f38-4f8c-b33f-c4954ba5f794", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970149, "uuid": "2bd192a0-4e82-4e97-a7e4-9cb995a8270c", "value": "ddab526043e348eaf19ceb039bd7a0c3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f1b3c8e-3ce0-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1635969544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635969544, "uuid": "3e4691e8-9b94-4573-ad20-d0f52d702e13", "comment": "Malware payload (Dridex)", "value": "4d9deeffe038b6193b97a3938faee9db", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635969544, "uuid": "7bfa9e89-2f4b-44ea-bbc0-d7feb3e79402", "comment": "Malware payload (Dridex)", "value": "627b7cbe3e00c572b27efb0acbae397deca3904ff78e9e4cffd2ad18f76e4e53", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635969544, "uuid": "e4ead443-e4e4-4d0a-8c5c-b1b947370033", "comment": "Malware payload (Dridex)", "value": "56169777d9697a1a66b85c5329684aed638a5968", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635969544, "uuid": "aac61efa-7284-40d0-ab4b-b0ead6aecd8c", "comment": "Malware payload (Dridex)", "value": "a439851e74cefb743d20f7db4d28f066f9241f0ac91eb9c68902a8232962283b6a374185b84a842754eda321084d9624", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635969544, "uuid": "710221e8-2dd0-40f0-bee5-88d6e5a5c7df", "value": "T146A3021C471A3DB1C6A1EF3E2F0E68B6655D76578E10974B288E6F14C7311A6EB0BB03", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635969544, "uuid": "a6dce61e-22dd-40bc-bc4c-075bbca135c1", "value": "1536:8CWhPrX6Q3cWViBN3yKqxyeHw3vRMgF3oKy5haDHmRZXKTF8gG3kTjE24pPRxNQH:83tqmc3/q0dfaguKyaDHmRVi+5ajEzpI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635969544, "uuid": "695ec2bb-2e29-4f02-84ea-0510c7787489", "value": 97718, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635969544, "uuid": "f03e2425-6eed-44c5-9d15-b49cf1ddfa52", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635969544, "uuid": "19fadc50-f33f-47d3-986e-4bf6328812db", "value": "Order_510493.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf2ab3d1-3cca-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635960229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635960229, "uuid": "89cb1e70-0506-4f49-8077-fac143991d7d", "comment": "Malware payload", "value": "909896ca9cc9a93bae8a4424756853a0", "object_relation": "md5", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635960229, "uuid": "3843b5d3-54e1-4db6-9e0f-f69a6074e8ca", "comment": "Malware payload", "value": "635b4ab69ed85f1f6d52f3f28af550f090490e22ad13ea9aca3a018545521c43", "object_relation": "sha256", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635960229, "uuid": "7c5163b7-b3c2-4c7c-b34b-c94cf2cad3c8", "comment": "Malware payload", "value": "9f7f6a9450c3139e2254fe451a17b6e0589c1dd9", "object_relation": "sha1", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635960229, "uuid": "a39b85a3-ffd2-406a-a45d-7c8d1bf2bc64", "comment": "Malware payload", "value": "a3bc9b1d6e250aaa61812502cdacce87a9b530c595f3672cf73589039252ec08ab4e8a727f340191d57d929242548dfa", "object_relation": "sha3-384", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635960229, "uuid": "b2d0d8c7-6a6e-49dc-96b2-87a820f61d7f", "value": "T1C4C2647DF55B0988DE86C66C061A7BA9064DF51D73C440E23BBCDB383A5895B8B22D3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635960229, "uuid": "b69e8f28-6b22-4e44-9cd1-2274e11083a1", "value": "384:7zl93KyX3uRfT7YD6FKSJ61E5rS2sgfJRGMReBIcy8U+7F/0JIhoI:7Cw3uRfQ8sEHrfJRGs0BF/0Jw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635960229, "uuid": "e4dbdd38-ad27-4b16-a224-9eba7218e888", "value": 26636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635960229, "uuid": "b61822f0-683f-4bf7-9f3a-8542b3c2734b", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635960229, "uuid": "69db414c-880c-4a0c-8fbd-ebf8c81a517d", "value": "909896ca9cc9a93bae8a4424756853a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3a2a64a-3c84-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635930092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635930092, "uuid": "23c4238b-8648-49d4-b291-c7ab7ebd5c06", "comment": "Malware payload", "value": "08117e823f1918eb2ec0c6e133d2e2e0", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635930092, "uuid": "a74c1a97-7ef0-452e-a172-c693a403d87a", "comment": "Malware payload", "value": "636f44862adbc73e788ff1ee898e23c32ab78c8e999bdd37dbc274683a4ef844", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635930092, "uuid": "377bbe4b-6143-41a5-90e4-b525c95c6649", "comment": "Malware payload", "value": "3f971f5b9ea8bad97ef72a4360662d85b9a47f40", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635930092, "uuid": "b3726796-817a-41d2-9c66-a074bdf9743f", "comment": "Malware payload", "value": "6f6d386b7bda69ccc6c71360a74dd9b2dcae7167fbf3762cf523f8678035233fc54425d062e1c4399392a4e85f3f7afe", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635930092, "uuid": "bd7adacd-ad13-4350-be9b-47fae2546e2f", "value": "T17141AE2107F9031CD7B24A3DECB7A311D6B27C52EA92CF6D415091946CA9221F9B1F2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635930092, "uuid": "614ec8c6-9de8-46cc-a0c7-3e5158faf800", "value": "24:8We8OJXqTuC+pKnWXkAtWC+/CWae7Dl0Wprefk4o0aYrabVIJ0wm:8WkJaT6XzQ7GwrgoOraR20w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635930092, "uuid": "70241058-f016-4c42-88c8-123bc59483b2", "value": 2323, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635930092, "uuid": "1ce7ec68-ad29-4088-b502-3ecb8f387454", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635930092, "uuid": "dd33f511-0cd5-4381-b60d-e37e773b8fe8", "value": "003.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d052186c-3cb0-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635949064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635949064, "uuid": "cb04fd31-e42d-409d-89b0-b9ff45f16542", "comment": "Malware payload (Formbook)", "value": "b1fa0393a1c11daf68a04021f7f2cbe6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635949064, "uuid": "0226d99b-58f3-4f3b-973b-2f496fefcad9", "comment": "Malware payload (Formbook)", "value": "6383ab0b6dc093192621e16c2c9c2eac96f0372e6b1f5294fb9360ec7d63e216", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635949064, "uuid": "da543f58-96bc-4b69-9e3b-411a37558aa0", "comment": "Malware payload (Formbook)", "value": "7195e0e606c579776825305a45cd2ca693aa14df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635949064, "uuid": "ed2fc992-d8dc-4eae-9f68-cbbe7991528b", "comment": "Malware payload (Formbook)", "value": "0a5ba06ed7cc43e3c2616a128ceb90b2878e6ec5b06f9c8f48c3e979a25ce3b33461200c84f9daa0b81f4c9cdd33364e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635949064, "uuid": "8d41fbd7-70f3-4f0e-919b-63d6618d79f1", "value": "T1CBC4E03824E05726DBE943719D15C62913B19CAEA013E71C5EF1FDE33AFE7634A0681A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635949064, "uuid": "0de86556-5e5c-47a8-815a-b97d61658ea2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635949064, "uuid": "f833b6f3-4500-4bcd-ad3f-4f51ade6f637", "value": "12288:d9tNnVsE062ZvgTUc//QvigxSUmTlt0613e5x/:d9tNYZC//oiggUmTer", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635949064, "uuid": "c2c08096-7945-45f1-ba21-3d7abf36c433", "value": 574976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635949064, "uuid": "8f7073b1-1016-4016-b1ca-620945e3dcab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635949064, "uuid": "4d9d7c4c-654b-48eb-babd-d70c83b7c783", "value": "DocScanner 01-Nov-2021 12.30.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aff6b3a-3ca1-11ec-843c-42010a9c0014", "comment": "Malware payload (Kimsuky)", "timestamp": 1635942345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942345, "uuid": "a84fdfc3-bbca-49ac-9f6f-dacd747d85de", "comment": "Malware payload (Kimsuky)", "value": "a9ea4b32345f418f50f446a11c50e606", "object_relation": "md5", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942345, "uuid": "2dfbd1f3-4c01-4d98-991a-673118876e07", "comment": "Malware payload (Kimsuky)", "value": "63d88b905b21862f8ef2aab18401adf5460cca1e4904b35f7324ae42d0190ecc", "object_relation": "sha256", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942345, "uuid": "d9760a54-e29c-4adb-92fa-5825f4ba359e", "comment": "Malware payload (Kimsuky)", "value": "2b6cba7a1fbeda2c3ba87d7dd002bddab567f50a", "object_relation": "sha1", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942345, "uuid": "f9aa8c4c-6c75-4082-8e3a-616bf68d1610", "comment": "Malware payload (Kimsuky)", "value": "5485a86250844e6dbdf86618fd942a979b9a38ec229fd550d7f103cfbf2f458cb630ad8ed30cb7baae190dd6dfc23216", "object_relation": "sha3-384", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942345, "uuid": "3b5fcc65-cb86-4a8a-b756-3df55ac752e1", "value": "T1BBA3E14B2D00C888C68A987458835B99735E55AE69F1F62FA70230211F7F36FDD9BCD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942345, "uuid": "43f9bf43-bca2-4db6-8588-f42cd4aaa0a5", "value": "1536:s65wvy6Yi03A65rcqXV0NHQ6V5QGNWUi5RBAJIwxbhnVllVgaleg5:8rYiwAGF0JsjUi5RBwbPlHkm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635942345, "uuid": "da785449-a604-4a52-841a-14f60944aba7", "value": 101446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635942345, "uuid": "aa0d0e71-01b4-4dbf-9b5b-855400130e2a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942345, "uuid": "04caac14-e834-4070-826d-0bf939157adc", "value": "63d88b905b21862f8ef2aab18401adf5460cca1e4904b35f7324ae42d0190ecc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f2b1bf6-3cd2-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635963585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635963585, "uuid": "5c8c8c97-9806-4f02-832e-4b3661e1160a", "comment": "Malware payload (Loki)", "value": "bf5ad5ce60c095fd0e15435c7c7ab862", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635963585, "uuid": "4c2a1373-84c5-4ccb-a1f8-8152abb7ff56", "comment": "Malware payload (Loki)", "value": "64ffb73a1276e203228435365263f1f53ce13722454ac08f092533b02c05104e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635963585, "uuid": "81cbec82-88a3-41e7-bfbf-a8d61e118abc", "comment": "Malware payload (Loki)", "value": "ebd797f9659a3a20a137b55e102f627e9a097eaa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635963585, "uuid": "13a1cf27-078e-429c-8d07-a9a5b56438ec", "comment": "Malware payload (Loki)", "value": "5447ca7ef8001cb823df448d1a09b45a5bf37705ed9ca2d4d9dc3fb6cb63a5be23469e47d73ede06191366d49331d2df", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635963585, "uuid": "d4c8dbef-df43-4fc4-9fdd-6de482cb4e63", "value": "T12104AE21F2D3E432D5965170D878DAB01EFBBC725A70518F3BA43B2E1EB06C05A66376", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635963585, "uuid": "97772f76-5e71-4f80-a996-3167e6dcfd68", "value": "ed38ab5cc3f4fd753cddd79c6cfea0fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635963585, "uuid": "9124b000-dee8-4db6-9349-ed26e936f8fd", "value": "3072:g8UwhW8UFLiE+LnCm5ORYIqLC8HpUufaXZxsfB/Vs:gb8UN+LnDORYfHpJisfBa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635963585, "uuid": "b1bda951-bc8b-4f8c-bf73-10494b8ebc7c", "value": 182784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635963585, "uuid": "45e59909-c554-463c-9424-8844018accdc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635963585, "uuid": "f34df4bb-b81a-4ca9-84fc-9fac7b6281fd", "value": "bf5ad5ce60c095fd0e15435c7c7ab862", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce1a3ce2-3c8b-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1635933169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635933169, "uuid": "492d28f2-a996-43e8-871d-073d20e8a2bd", "comment": "Malware payload (Dridex)", "value": "96fd21007b7436aee23924c5358bad66", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635933169, "uuid": "65c2fb40-e08f-4658-8ed4-5dd8338864c5", "comment": "Malware payload (Dridex)", "value": "65142a23b332447ec8685a8b30f89b62c578067f54318e379958d0564ab7612f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635933169, "uuid": "abece453-0343-407b-abd4-e0557e8c3d73", "comment": "Malware payload (Dridex)", "value": "41c85a749e460fe710df83202b2d55e7a19b2193", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635933169, "uuid": "0f0dd8c9-45b1-478f-adb2-3e824f6d6678", "comment": "Malware payload (Dridex)", "value": "6ecb7e9a491ae1869c6a0eb1b50838b1b5e27f1bbd564ca38cea8c246023f432296c1e8472ccd02ce71cf0b41e156a5c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635933169, "uuid": "466c3ed3-2628-46c2-a001-ce04f0b322d0", "value": "T10093011EC59E28B1D641EE3D87049CF35C552A129C516A4B35CDEE9CCB3E1A3AF2B813", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635933169, "uuid": "03333c01-b22d-4746-b922-e8ae6086b91f", "value": "1536:8CWOPrX6Q3cWViBN3yKqxyeHw3vRMgF3oKy5hSW2l/25L4T3eRW7aN9h9txACK7E:83mqmc3/q0dfaguKySW2d25LiumuAP2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635933169, "uuid": "f1fd20e0-a89b-410e-8f5a-ffd3986275c2", "value": 96664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635933169, "uuid": "5df14af4-1c18-4cdc-9df7-9e1c0d071a88", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635933169, "uuid": "ce07dc85-8881-4872-a767-b6847ca6e423", "value": "Bill.61566.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4233bab0-3c9e-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635941095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941095, "uuid": "02573431-5348-4132-945f-60bfc8317e9b", "comment": "Malware payload", "value": "0e3f2d997de006c7b78d0a2fe62325c8", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941095, "uuid": "f73196a0-db50-4c58-965a-d3d776cc8f22", "comment": "Malware payload", "value": "6519f64447f043bcaa97be57293c10c45de85d68af5c7450725812e1deb31b7b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941095, "uuid": "9249c9f2-2456-49a6-82b0-68bf9a334fab", "comment": "Malware payload", "value": "8cf3314eb93b8024b85fc9aa91580427903054a8", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941095, "uuid": "0c4a88cd-6fe4-4811-b547-e301fac04822", "comment": "Malware payload", "value": "8c35129bb2ca04583bb2ac9a80c5f01572a6a5cc0d409c7e17212244eb1e008eb0030300d61d21d10f7eef836a91419b", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941095, "uuid": "20bf8337-6e76-4f21-b185-325ae7691397", "value": "T13BE4225DB644249AC29034F59C9CCAF42CF04DB1048832F4E98595FAAFB6EF9D801BF2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941095, "uuid": "f8233527-f6e4-46d5-86ed-bf2afe5e47b4", "value": "12288:UjEWfVuTTp7yKZaRf0jEWfVuTTp7yKZaRff:UjEAVuhOK0f0jEAVuhOK0ff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635941095, "uuid": "a8156f1d-5661-4177-99a5-a900b6a88b3f", "value": 668528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635941095, "uuid": "79d138f5-9b93-456e-a249-f8bd2b4c9902", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941095, "uuid": "73290c72-9467-43e5-9da6-1aca4fc2d2d1", "value": "CV.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e818879c-3cd0-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635962848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635962848, "uuid": "e72ffddf-fd35-4e46-9ed6-250d34c1af34", "comment": "Malware payload (Formbook)", "value": "d1560ecb532b2da2ade41371909896fb", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635962848, "uuid": "e875981e-2fbd-44f0-b939-2bd5bb535b34", "comment": "Malware payload (Formbook)", "value": "653c0f962f564b65191195197b7c23a6af4ab422a20af5040b6ae0fb56c43f02", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635962848, "uuid": "21f60fde-366a-47ac-8568-4f224eb336d1", "comment": "Malware payload (Formbook)", "value": "fd2673967ae6c3388f0ee4196461b56728dd3024", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635962848, "uuid": "9d569c61-82f3-4048-a76e-a21cddf788ad", "comment": "Malware payload (Formbook)", "value": "e72cee5f0fb1a9b5bbf25073333e26929080d749bc0c9137ee6764a1a201b34f333f0a4bec765df11af2e3612cf23f0b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635962848, "uuid": "261670b4-5f40-41cb-aeee-e7ec9879d0e9", "value": "T1CA9401202BA82722DD3E67F91925162447B7F14A1176E3897E8E3ACF876BB510D40F63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635962848, "uuid": "b8a9f457-214e-4e7e-8e9c-23d1f57245e0", "value": "6144:x5s1C+Fk8mhcQ2eGyV2FI9IvrEk4yHULLtkkNEhlTqG3N:x735PwC2F8IvADsOLt7k17", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635962848, "uuid": "63699366-3428-4c19-8799-1a69ae41465a", "value": 430080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635962848, "uuid": "354aed53-ac10-47d3-9b36-1466b6f9e9a6", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635962848, "uuid": "0d60c9db-5603-40a2-b411-650427d84f40", "value": "PCB 102021.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb33ec85-3cdf-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1635969242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635969242, "uuid": "fbb5c490-94f5-4068-8ca4-88ef2f47c9bf", "comment": "Malware payload (Dridex)", "value": "da72a9a0d4107ad76e3e962ab81810e9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635969242, "uuid": "948ee593-cb16-463d-9c2f-47337b38e126", "comment": "Malware payload (Dridex)", "value": "65d6dbb79f8a0c36a89494abb2fd04e0a1650e177bacf1563642c7a0009a2fd1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635969242, "uuid": "45412f01-12ca-4dd1-9802-a728e4ad6c01", "comment": "Malware payload (Dridex)", "value": "bad29823dd3432bc73ed15ce589e09dd4c8a3124", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635969242, "uuid": "d4272474-c5a4-4973-bc9d-722b7f08f0ee", "comment": "Malware payload (Dridex)", "value": "b3529766ffc3ae10cb57679bdc32f9d0fee9b70e63c92e9fbc38b88d2e0bf8f821c81a7b570f3533a0d1766bdc60a8d5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635969242, "uuid": "31accefb-3a5c-42b3-8e20-b512409c3f37", "value": "T18243E00E7255B817C42B5CBE9A589CF0281970EB8C06F2196415BF1B02DE1D39FEF72A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635969242, "uuid": "df0bb086-4e3d-487f-aef4-72cae71933b9", "value": "1536:8CWVPIbZ853SAJbpKt0fWKfaJHFHf5lS7A:83qbC9K6fWKfYPlS8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635969242, "uuid": "50c008d0-ea7c-4598-937b-3a701e2100e1", "value": 60398, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635969242, "uuid": "3cc57c93-6702-4c90-9d1f-ad012d949360", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635969242, "uuid": "deb29895-e22d-434a-aa7c-f23aa9a447f9", "value": "Payment-79153.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d6c32bd-3cd3-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1635963931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635963931, "uuid": "57e33746-81d1-4eaa-8afb-9c6015993424", "comment": "Malware payload (Dridex)", "value": "c9ff4d79afdd0061ec608dc295897ffa", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635963931, "uuid": "ea504135-cec5-4be1-8eff-78abf4acede5", "comment": "Malware payload (Dridex)", "value": "667fb8baf81d3e1ed8fd26accd3741cfe338a072774766cd88de03411733637e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635963931, "uuid": "5535dbe3-c5ad-4b92-a9d4-0259515b6e9a", "comment": "Malware payload (Dridex)", "value": "342e2106225f95fbea57d245fd378c4cccc97d1f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635963931, "uuid": "4afa634d-9b88-4fb3-9788-48d81a37bd2f", "comment": "Malware payload (Dridex)", "value": "d0af06124a0664b134760d3a8dbb0fc379fecc789f0465c170090de1ac74087db668de7fc668e8e909595596c5899ea3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635963931, "uuid": "f6994d0e-f43d-47f5-add6-10f4ebfa1972", "value": "T109A4BF04D1EA0676D52B62FE71FF0CCA47104DF9B506AC84D3435A6A5B32FEC3A7A849", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635963931, "uuid": "ae7bb95b-ebf4-4860-b955-62f1a01b2487", "value": "ccdf79216449388cf5a36d38a385d866", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635963931, "uuid": "6ee1c847-bbfb-475b-9e69-8fed4d7b9b7b", "value": "12288:FZKEZNxJPdthZz/MqmOce24Wqa+cKdDSFczjJgiUCeoCqoE:FZKEr/1jhz17Px", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635963931, "uuid": "c7f7665a-44e6-42ec-a60b-6dc50a2fd8d4", "value": 471040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635963931, "uuid": "18b09cd8-4d3b-49be-8c27-f672efc417ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635963931, "uuid": "27b342bf-3fa0-4af0-b327-c0ea991dcdd9", "value": "SecuriteInfo.com.Drixed-FJXC9FF4D79AFDD.22577.1106", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83c1bcc1-3cc1-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1635956237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635956237, "uuid": "5304b57a-06fd-46b5-8606-8f33635ad84f", "comment": "Malware payload (Dridex)", "value": "9d2e090fdf02bee268f056721b0a616c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635956237, "uuid": "6e2b7f54-7a43-481b-ad1a-5c0663c2c7dd", "comment": "Malware payload (Dridex)", "value": "668788f81308da3c19985a98279036ee0ca497bf0d9f81a8f4cd4eb47b9a0e45", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635956237, "uuid": "feefb219-8c8b-4c26-af1f-3921225c8fd2", "comment": "Malware payload (Dridex)", "value": "d14cb8a627fb54e3bb8001e2ad3ede2ce9b75ca6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635956237, "uuid": "d87cd29a-cd27-4278-ab9a-6f474f264db3", "comment": "Malware payload (Dridex)", "value": "59e7abe15e1de63facfe269cdea22388bad2177d7bc2050ca08585dfb159b05f430e83ed53fff119112d4624610ba995", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635956237, "uuid": "fac03941-03dd-455f-b8b4-38a6c70d29a1", "value": "T1BFA4BF04D1EA0676D52B62FE71FF0CCA47104DF9B506AC84D3435A6A5B32FEC3A7A849", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635956237, "uuid": "ff988140-200c-43e5-b66b-5ae656475892", "value": "ccdf79216449388cf5a36d38a385d866", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635956237, "uuid": "add7ab4e-384e-4af2-bed8-702da35d494c", "value": "12288:jZKEZNxJPdthZz/MqmOce24Wqa+cKdDSFczjJgiUCeoCqoE:jZKEr/1jhz17Px", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635956237, "uuid": "1f52acf3-2d2e-4a77-a40f-72a271dad85a", "value": 471040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635956237, "uuid": "84247895-a139-44d4-947c-1012ffba876a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635956237, "uuid": "2958eb00-da85-435a-abbd-e7a7b75eac69", "value": "9d2e090fdf02bee268f056721b0a616c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47f00781-3ca1-11ec-843c-42010a9c0014", "comment": "Malware payload (Kimsuky)", "timestamp": 1635942393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942393, "uuid": "93e7cd1a-abbe-493e-b3b0-acb890f3f0bc", "comment": "Malware payload (Kimsuky)", "value": "8d1f4e73ecf6747e54164a56e32f1f29", "object_relation": "md5", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942393, "uuid": "923300ec-8ab1-42b2-b9da-8c847c5079f0", "comment": "Malware payload (Kimsuky)", "value": "66a1c3feed0ae37a61db0ff744dcde95a0eede7412a530faf8f715fa1903d1d2", "object_relation": "sha256", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942393, "uuid": "1f5a6610-7b89-4e47-ad92-b3910e6fb27c", "comment": "Malware payload (Kimsuky)", "value": "90472bedac7fd9e6b69360d2fe6d2b8b16f43152", "object_relation": "sha1", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942393, "uuid": "437ae2f2-c57a-4665-82c0-71dbc9458ccc", "comment": "Malware payload (Kimsuky)", "value": "595ec08d704c009773106bcaab1fd3080924d900d123732c65421e1c0b0bde85f4bb30eb12e002925eb1236c2204c104", "object_relation": "sha3-384", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942393, "uuid": "477b4ce5-735b-498c-9838-e82f8c493028", "value": "T133A1E8177903D28CD399B5AB997965C45C6C921AB2BC28E9F78EC48DF024C2C41FC3E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942393, "uuid": "bf6fa980-fbeb-453d-b19d-55f06cdee5f4", "value": "96:87F0kuXmU+u1ViXyzQX1f0gUe3X87J3QLQ4UtX4QLoBf/ETQjOfjjepUG/:k03Xmxuj0yzCWIn8uZUx7DMAjCpUG/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635942393, "uuid": "bccd811f-9396-4370-bd64-912e8d0e9b19", "value": 4906, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635942393, "uuid": "39e4e57c-f45b-4b7b-9a6b-c7318f130d2d", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942393, "uuid": "3185e84f-f5f8-4aef-bd81-7ef8916b1ac7", "value": "66a1c3feed0ae37a61db0ff744dcde95a0eede7412a530faf8f715fa1903d1d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fde2f57-3cbb-11ec-843c-42010a9c0014", "comment": "Malware payload (CoinMiner)", "timestamp": 1635953466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635953466, "uuid": "3a3d2365-8f18-40d2-8ff4-69ba969ed80b", "comment": "Malware payload (CoinMiner)", "value": "96c888da9f7d22d6c099ac1553ac85f8", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635953466, "uuid": "dbd99518-b8b9-4ea6-beac-4bcfa7e8821d", "comment": "Malware payload (CoinMiner)", "value": "6710d456ff5a6038cad4f387a9d9029d29eeed49b5b156716bc4428bc104a0ce", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635953466, "uuid": "922975e7-6a5c-4668-8a23-4077035abaad", "comment": "Malware payload (CoinMiner)", "value": "0373e0846f2a830b98c2b7fa4ae46f1e9a86f75e", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635953466, "uuid": "8b4dced4-dfba-4324-9039-3d1df59a2011", "comment": "Malware payload (CoinMiner)", "value": "d3944e6a3b00610052e97f092e5460728d62eca7e44690a24a8e3750396470ba00ee9dc5bc38f647a5369c7804f27575", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635953466, "uuid": "c26cc2b9-5423-4ff5-81a9-1f27fa5bf1f4", "value": "T1BD95338A663D054CD6EEB33755C39E250CE3D4F3A5DE9A169DE4826B0F47F10BB88A04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635953466, "uuid": "31d06a25-643d-4c7d-ad60-4fa23b32ffe6", "value": "02549ff92b49cce693542fc9afb10102", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635953466, "uuid": "f743c612-93af-400a-88a8-ffb604a61024", "value": "24576:E6VhE3aw8EUqJgAxfzeNQ+Bn5hB7uxGe8LCUJfk6z96iw7DHNEDPL+ioxEIyvR7J:XPTAl+bTkaJfT96iwnHkaihvM7mMhoh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635953466, "uuid": "d68fdb53-81a5-4456-9024-cf83c1f4c5b0", "value": 2042880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635953466, "uuid": "474cd6e9-b10c-4475-924b-8fba62407c61", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635953466, "uuid": "d5d806c5-3651-4f32-acab-b7942b045815", "value": "96c888da9f7d22d6c099ac1553ac85f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c8e8c07-3c95-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1635937301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635937301, "uuid": "6ad8c76a-a27c-4ccf-b92b-c6b715b5dcab", "comment": "Malware payload (RemcosRAT)", "value": "e79d2ed3440fde774d6f0bfad47aaa30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635937301, "uuid": "6de08113-f884-48b8-b48b-d644f8fea7be", "comment": "Malware payload (RemcosRAT)", "value": "680c9cb7cec2aa66bb7b74385f8e31d2eb6f1894c0d1d1d9a44056da6c0234e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635937301, "uuid": "7fe7b8f3-5f64-4d77-8fc0-e25c910f6b31", "comment": "Malware payload (RemcosRAT)", "value": "d20f60d9e9ea49be64c626a71fef47f5d81962c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635937301, "uuid": "225fcbce-07ef-45bd-bd11-9a6c1020c0e5", "comment": "Malware payload (RemcosRAT)", "value": "e97689f0b45da6b19e3e509dff7bba58e9ad9dd39143ae48199e52838432411a4a67dce8de0e5c4ca6158fd206277ca8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635937301, "uuid": "b230c53c-1d5f-47f3-9a9a-87dbfab21c23", "value": "T16E158DA1E0C0C5B6D42A3BF8CD4BAADE54DABF016D70A4075BD93F4ACE31AE43426457", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635937301, "uuid": "077a88df-c87c-41c7-9ba5-5c1b929d4486", "value": "3513b15d2020b37cf2b66a761c75ed57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635937301, "uuid": "7b3ecd5a-3e79-4f2e-8cc4-17da4859bcf4", "value": "12288:WxBZN9xp6/Yo9sSbJ+RLbKvOS9cr9BE6ZyxDcC6CoueU:WF/C/N+1KWS49xy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635937301, "uuid": "675a681f-29b2-4fc1-acc1-c96ebd1867ad", "value": 887296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635937301, "uuid": "eb25d4ed-b0ba-4afd-b07e-8335abfb992f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635937301, "uuid": "78192908-a53e-4a97-9bea-2da9f36460e5", "value": "e79d2ed3440fde774d6f0bfad47aaa30.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3c78e00-3c9a-11ec-843c-42010a9c0014", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1635939568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635939568, "uuid": "1e01588f-8e31-40ed-b04d-507cfd841f13", "comment": "Malware payload (AveMariaRAT)", "value": "b88620ace6f2d62dae43662a7c599263", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635939568, "uuid": "971c815d-7ff6-48d4-960b-38c0a054e2f9", "comment": "Malware payload (AveMariaRAT)", "value": "6840b00b8443799498a5658be9f73d0918daa251ff1a8c43693c5d203b7476ff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635939568, "uuid": "e7be2ea8-ed4a-4d06-a7e8-321bba5142e9", "comment": "Malware payload (AveMariaRAT)", "value": "60a0a01730b91db5b8d65b6626605ed2a4ea3a69", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635939568, "uuid": "5a97b203-c261-4b11-961e-40a75e756b56", "comment": "Malware payload (AveMariaRAT)", "value": "f07e20bd7afbc2e0aece8055c7da065dd9d5cf35865bde030712557886144f95f47741edb478c936a9ca89305edcd4e2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635939568, "uuid": "be5cfb3b-eab2-455c-b50a-2b324532dba1", "value": "T1DAA4BF7E3212BDDFDD678EB589502C50AE643877572FC203D91701A96AEE896CF204F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635939568, "uuid": "c85bbc69-74e7-4df9-ab42-b38ef8ab9eb0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635939568, "uuid": "260b80dc-787a-49cf-915d-a45b8628b566", "value": "12288:I7qJFTPMWnrvsHPMDnUHFSrvlTJm4xxlrDSaXMNf:I7qYCsHwUUrvlt/xx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635939568, "uuid": "063a7cb7-9129-4ac0-ac62-0e37359126b1", "value": 487424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635939568, "uuid": "a93ef92c-7c2a-4c12-bbf2-2db0bdc0e46f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635939568, "uuid": "23898600-73b6-4a8b-8229-7d21161c6c2a", "value": "b88620ace6f2d62dae43662a7c599263", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a40a53ee-3cc2-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1635956721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635956721, "uuid": "f42a83b9-1927-45a9-8895-65c9bfb2b4f7", "comment": "Malware payload (Dridex)", "value": "0d9604c9a2d1df9e343fa1f0860e8451", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635956721, "uuid": "597eb26e-3543-4ce4-8e0a-8feed6d027ca", "comment": "Malware payload (Dridex)", "value": "688ba8d6e2124249816291d6110f7f0d1ac12e654c99440fa48f9ef6f1ed8742", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635956721, "uuid": "f3812daf-4bfe-40cf-8675-b5bf7310c022", "comment": "Malware payload (Dridex)", "value": "1611dfe3614e2e6c55c3a94c67228aa45fc04070", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635956721, "uuid": "31e3707a-0e3b-4e61-b31d-75aadf375e57", "comment": "Malware payload (Dridex)", "value": "0375797778fae5d30a101691f1129c226a6229bdf8579f1ceb907a6d55564123584f34e89f89ec66975fbc8e26bebff6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635956721, "uuid": "3f8a7f80-77f9-4633-9076-bdfe88b0920f", "value": "T17873F2DDD544E066D3A2CD7FDB3A8CE5E2534C93B555D60B289EB30CAAAB3060B5908C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635956721, "uuid": "1f6cd1ff-dea0-4d6b-89c2-b0aa7c8696f5", "value": "1536:8CW8PuALLImemeKHqeK7YncrhpyA3A4EmdPpESRDnFKDb8RX:83z80XKUYmpH935nQDYN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635956721, "uuid": "4efbc9c4-62f5-4b1d-b495-213ba767a293", "value": 77233, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635956721, "uuid": "3ccf23db-90bd-4038-bff3-2f37b3f54ea1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635956721, "uuid": "48a4423e-be9e-441f-963f-278702ca708e", "value": "Order-7573.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80d3245f-3c89-11ec-843c-42010a9c0014", "comment": "Malware payload (IcedID)", "timestamp": 1635932181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635932181, "uuid": "d74706fc-bda2-4a68-bd48-292ab8d6a361", "comment": "Malware payload (IcedID)", "value": "ef7be8fdbd7c07ba529528a8e4198cbf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635932181, "uuid": "b46c9ed9-a200-4d8b-a972-aae1334646d6", "comment": "Malware payload (IcedID)", "value": "689945d77e0ddc9bff9e50ddcc7695a1434d4e082eb61ce73647d081ff3107b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635932181, "uuid": "09d081b4-ce0c-4ea3-9b6f-21473c633f7d", "comment": "Malware payload (IcedID)", "value": "236187fb24d052acbb6adaef445da6423612172e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635932181, "uuid": "4f7bb775-eaa7-4d1a-87cd-7bb0d333c493", "comment": "Malware payload (IcedID)", "value": "16bf7a001465276042168690f9dcc4b076f99e06959c09561097a1f2c665e80f29df1b683b39fbe61967ce34623735af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635932181, "uuid": "efa92017-9a35-455c-862a-519ecd069038", "value": "T1EC549D10A7A1C035F4B252FC89BA93A9B93F7EA1677490CF12D516EE4674AE1EC31307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635932181, "uuid": "bd7b3047-fcad-4be9-aded-496f16046410", "value": "e024db68009cf7f32dd817cae1867bf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635932181, "uuid": "5b3a3f8c-f619-470c-8e0e-f6de5aec9945", "value": "3072:hm9BNq0sXobLycKlqgw+7fZQx/fJ0rJezEafnips3GyxqeL3YxI+f4qeYYIxmH4Z:gDkK+7RQxCFbaPHxtjYxzfcYtxmS4bJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635932181, "uuid": "cb1043ea-5210-43dd-9048-b709efd7edb2", "value": 295936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635932181, "uuid": "fbcae9b0-2c02-4f82-9d54-8a17010dc61a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635932181, "uuid": "d86c775c-859a-4ce7-a1f7-22ad48736b08", "value": "ef7be8fdbd7c07ba529528a8e4198cbf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37917f7a-3ca1-11ec-843c-42010a9c0014", "comment": "Malware payload (Kimsuky)", "timestamp": 1635942366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942366, "uuid": "691a7108-0910-4be7-8fec-17a741f1e2d0", "comment": "Malware payload (Kimsuky)", "value": "1798a62cdab74c414792abad58ffc951", "object_relation": "md5", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942366, "uuid": "dbba30e6-bcba-426c-9245-aa9a2098d41c", "comment": "Malware payload (Kimsuky)", "value": "68bf1d7e13fdbd6be21e9fbf8cac19bf4882671b0ce6ab587fa579233e665e78", "object_relation": "sha256", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942366, "uuid": "2b7df91d-4ca9-4dd8-bd2a-7929137fa509", "comment": "Malware payload (Kimsuky)", "value": "50a2323788f4f76913eeafd16d17373edd43f2e0", "object_relation": "sha1", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942366, "uuid": "559c249c-cf4d-4d8f-8a08-779afd1c6e60", "comment": "Malware payload (Kimsuky)", "value": "e8a823354fc6286b9d3c13902d7ab69280518a95bca630c0f4a2ef3e1ab41cfee853a4409b494eb8d6de6f0ee28391f7", "object_relation": "sha3-384", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942366, "uuid": "7b37d685-a29d-4d43-b2fa-b2845124194f", "value": "T17763121E4EADCE1E114E4AF85B6277808D6C148AFD867338C02E1AA14A8D7A154CD6EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942366, "uuid": "dec7160a-9ee5-4f87-956f-0f79d9217c05", "value": "1536:hfGvSpVPDMjQRWEkxyDNuTma4xzlmy0uXIBC9Ca6bGYLXG4AsxRe+GfYCm8:pGEmjaiglgy0xC4LxLXJRejE8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635942366, "uuid": "cec86171-e28e-4658-bfb8-1b1d55a3ea69", "value": 72076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635942366, "uuid": "bacdeb74-8557-4782-bf1d-1632e2cd3768", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942366, "uuid": "13aeceb6-dffe-44a3-9c53-f04846af688c", "value": "68bf1d7e13fdbd6be21e9fbf8cac19bf4882671b0ce6ab587fa579233e665e78", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2b61931-3c7d-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635927164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635927164, "uuid": "0ee3f05d-8170-4663-b44d-6ffe1f0ad8ac", "comment": "Malware payload", "value": "c33754d068954ec9a61cc9165334a57e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "FreeBSD", "colour": "#75A699", "exportable": true, "hide_tag": false }, { "name": "Speculoos", "colour": "#0CD716", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635927164, "uuid": "93ed0036-5adb-40a6-85f2-a24f670efeeb", "comment": "Malware payload", "value": "6943fbb194317d344ca9911b7abb11b684d3dca4c29adcbcff39291822902167", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "FreeBSD", "colour": "#75A699", "exportable": true, "hide_tag": false }, { "name": "Speculoos", "colour": "#0CD716", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635927164, "uuid": "a5f9bdf0-dcb9-47a6-b411-b822efae415d", "comment": "Malware payload", "value": "55dc9edadefd42b3649ace3c744e5da58e5149b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "FreeBSD", "colour": "#75A699", "exportable": true, "hide_tag": false }, { "name": "Speculoos", "colour": "#0CD716", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635927164, "uuid": "db592729-6f05-495b-bf77-c0a9375575f4", "comment": "Malware payload", "value": "8cd8eb08a940e625da60b9c7daa0206471f3211c2b40a6a0c97f05255b11e596769607f25ac06d68d467eb25af70d352", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "FreeBSD", "colour": "#75A699", "exportable": true, "hide_tag": false }, { "name": "Speculoos", "colour": "#0CD716", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635927164, "uuid": "d16a9599-6aac-4af4-b20d-a2046fc75339", "value": "T1E2F2D837CBA1CF3ED08A8AB92DDB04715677D0B5D33AF20FA544B6387D562A44C1E226", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635927164, "uuid": "48d0f753-f54c-4a52-b609-5aa472617d4e", "value": "384:NXm0JfGGZ5gvCWD7eJ2T0ogu385kQ9j7cpI8mEzGYBW+YP:NXPJft5ICwCMfs5Jcp0JYcDP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635927164, "uuid": "5326bf54-7e34-406c-8709-ea16e6763759", "value": 34976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635927164, "uuid": "83a67fb4-ba0f-44a3-956a-39b30c08a9d5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635927164, "uuid": "a55abd57-764f-4d52-8537-7fde833ed545", "value": "6943fbb194317d344ca9911b7abb11b684d3dca4c29adcbcff39291822902167", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31db7465-3c7d-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635926894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635926894, "uuid": "c426599e-21cd-466f-bba7-3490b35d2460", "comment": "Malware payload", "value": "8a95eda409be36c3f0d5dab96eb9792c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "FreeBSD", "colour": "#75A699", "exportable": true, "hide_tag": false }, { "name": "Scalper", "colour": "#E2331E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635926894, "uuid": "d34dc356-621d-4d28-8897-585960ef31dc", "comment": "Malware payload", "value": "6a3a2568fead42a9ab4d04b243676b81a2a29257f26f079643512f36e75e98e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "FreeBSD", "colour": "#75A699", "exportable": true, "hide_tag": false }, { "name": "Scalper", "colour": "#E2331E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635926894, "uuid": "1195a120-9628-46a2-8dde-2d0a38a3d0cf", "comment": "Malware payload", "value": "70467220f0c3d7794e2804368d03f9848e6df718", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "FreeBSD", "colour": "#75A699", "exportable": true, "hide_tag": false }, { "name": "Scalper", "colour": "#E2331E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635926894, "uuid": "87f4dfe0-8fc2-484a-ba4e-0cd319a5c479", "comment": "Malware payload", "value": "8148f8cb764d5be7120072e2f6fbd8da0a86dfa628715ac1ad3bb01b86cf3f311b3af2c8fac0f93b572c45278488ae31", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "FreeBSD", "colour": "#75A699", "exportable": true, "hide_tag": false }, { "name": "Scalper", "colour": "#E2331E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635926894, "uuid": "0aa6303a-fb56-4159-86e7-435c008c7dce", "value": "T1177296811872C036E09B177806468A7936B09370BA6FEFBFC9951BA477951C63A36336", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635926894, "uuid": "395d0833-abfa-4c78-ad1e-161f815c17e7", "value": "384:fA55Fgvr6cMjMzYJFAGAAMLKfT6haK7HmI7NM2L0g/H:45vFcLKR2haEM2z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635926894, "uuid": "dfa4a180-305d-4084-89f3-2ab4ce530941", "value": 16384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635926894, "uuid": "2cdd34e8-5de0-4edf-80aa-aae870697bc4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635926894, "uuid": "4eefccff-8281-48c9-8071-d2f6453dbf7f", "value": "6a3a2568fead42a9ab4d04b243676b81a2a29257f26f079643512f36e75e98e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a844194-3cba-11ec-843c-42010a9c0014", "comment": "Malware payload (Spambot.Kelihos)", "timestamp": 1635953242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635953242, "uuid": "0b2567f6-f4d9-4501-ab50-ef615fbef227", "comment": "Malware payload (Spambot.Kelihos)", "value": "a819b862683227b8e6b99165fb322dd1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635953242, "uuid": "1f4a668c-d1b3-4de0-b8a0-90f4f1f4d5e6", "comment": "Malware payload (Spambot.Kelihos)", "value": "6abf6ebd28c67bf08a985f3e85c67f4be766890812fa38d1bddf43d23bf4792b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635953242, "uuid": "bbaed419-06eb-4cd2-93fd-f82d1940479a", "comment": "Malware payload (Spambot.Kelihos)", "value": "0ac9590e99ae0f66f2f15c4350f995506f74ddfa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635953242, "uuid": "ac0cc3a5-e0d8-4125-9a86-900e9778c83d", "comment": "Malware payload (Spambot.Kelihos)", "value": "c9aecf23f21019f2357e3913087f68fafb7df1e7926860c8abdebde04f4c6bdae83781b00643d6b3338e200664f48272", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635953242, "uuid": "ed84f027-cbad-48e1-8d2e-c374fa5b71db", "value": "T1E806335D3D229813F4940E37F4A942E7C4723B3A16310D262BBAE956CCD4E18DF92D9E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635953242, "uuid": "26f8e1a0-21f6-44a5-98c2-10a19b9c13fb", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635953242, "uuid": "6a1ce4e1-fdf0-44d0-a4e2-a75a526708bb", "value": "98304:81fXiRlttJizXytPSMlFmVxJjdX6AnWt+bmYR3WD:81vivJ4ulkJ5X6An4+CaWD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635953242, "uuid": "dd56bf13-74a5-486d-926e-e9a1f425b473", "value": 3836679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635953242, "uuid": "0abac8bf-e29c-4e36-9d70-08b80d3740d8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635953242, "uuid": "b3466d32-1d00-41b5-8575-d0675d3c8719", "value": "activex.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a1e20b5-3ce3-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635970878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970878, "uuid": "85aac254-c838-4b10-af50-29db04e918d8", "comment": "Malware payload (Formbook)", "value": "8656d2e33f56f68ac0f1a179c54f7c13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970878, "uuid": "dc956702-490e-4f9f-904b-730543970ef5", "comment": "Malware payload (Formbook)", "value": "6b889ef8b43f316066faf4f225e192e2390f3dd007bd87ef371ddf0aae8745dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970878, "uuid": "a02a9a42-20da-49bc-8d2c-d431f313f5f4", "comment": "Malware payload (Formbook)", "value": "41133fd74c940e3ea644fdcc06e3dc1bcad8c7c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970878, "uuid": "e660cc99-ff89-4e1a-b877-62591faa3c9f", "comment": "Malware payload (Formbook)", "value": "aa87530de911bd8cafa09a85679f11fb46550200562c05dc20225652df2bfd5f5785f7e60606dcd0519ee246f9e7fe39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970878, "uuid": "3d9ca06e-fdf4-49df-b06a-c2f3afc53d87", "value": "T1E9A405912046B779CA550B71BB9AC11E4F7749BAA9C2840F36D57EFAB7AC00DD30312B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970878, "uuid": "1d3df656-f6f8-40dd-8d0d-561221303db9", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970878, "uuid": "1961738c-1aaf-4de1-ad58-7f47cd9eceb4", "value": "12288:H8VGy+my1vPbaV/vaD4dc4LnbQhOsD0nS:WGL117Sn64dxn80sDz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635970878, "uuid": "37d00ccb-ea14-4e04-8b7a-ee37f35d9a24", "value": 471374, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635970878, "uuid": "ac53337a-7852-4931-bd5f-d00c9d573484", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970878, "uuid": "371823d0-b008-45ea-9000-f6f82ccc1b3c", "value": "8656d2e33f56f68ac0f1a179c54f7c13.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0245e449-3cc6-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1635958168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635958168, "uuid": "a68d0d9a-1b63-4c29-b82c-8fb3213be03d", "comment": "Malware payload (ArkeiStealer)", "value": "7c0224f4b973b348c6da4920dd1a5626", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635958168, "uuid": "a2c89406-f78e-4d1b-8237-2f46b46f365a", "comment": "Malware payload (ArkeiStealer)", "value": "6c931cd5ccc3159347fdf46087cff34b96bee47eb27f1aceb8aeea95db285885", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635958168, "uuid": "94331058-5b1a-4e86-a9eb-dc9fa48db518", "comment": "Malware payload (ArkeiStealer)", "value": "674ed2f810305e05f50717e63f3e944896400229", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635958168, "uuid": "79a21353-ec1d-4e3c-9ee2-203688e0f8ca", "comment": "Malware payload (ArkeiStealer)", "value": "74073400beec952ee99951693e24e03eef3e27a50170739d513d0dbc1cb08c18a04fd117250c5ae6f60798ecd6df27f8", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635958168, "uuid": "6ab9099e-b4b2-48bf-bd86-34c1e01ed635", "value": "T12555F126E6C0C433C7A71E34AF02AD84E8257E402E39684F2BE85F6C5BA57B2771D553", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635958168, "uuid": "288e0190-c12d-42a4-b79f-528dc5b99ddb", "value": "b661356d70b76b2eeb89f40ce76d9c5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635958168, "uuid": "8980b25a-e8da-4dc1-97d1-05d6f62e892e", "value": "24576:7go4g6QRAODRUN1SjVFsKICyWXqVWgH0Wy9bvFGNY83Hg/TlmqhZ:8S7RbO+FSVWyoDV83HgZV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635958168, "uuid": "ca60b886-35d5-40c0-a847-667935896d34", "value": 1307136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635958168, "uuid": "f7679703-f721-4663-825c-e5c53d758af8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635958168, "uuid": "bd49d2df-640d-4ebc-858c-0d7d97ae4969", "value": "7c0224f4b973b348c6da4920dd1a5626.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20ede21f-3cba-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635953065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635953065, "uuid": "2e6f5fc9-e6a2-4e44-94ef-a340c8b5f0d3", "comment": "Malware payload (RedLineStealer)", "value": "988bc37d95c6eebe600a0488cb81cc88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635953065, "uuid": "bd88d59a-eb2e-4eb6-9d56-862abae61105", "comment": "Malware payload (RedLineStealer)", "value": "6cc9e90bfa1c397b819e8f11839a4724ce820830b0723e39a3ebdc9988eccd45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635953065, "uuid": "0116c208-5590-4485-808f-50a6852e6cf3", "comment": "Malware payload (RedLineStealer)", "value": "ecc00024443f1cebbcb7f73191e988af9df6fa7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635953065, "uuid": "ea5257c9-298f-446e-ae7d-1d0558f5c442", "comment": "Malware payload (RedLineStealer)", "value": "eb07d8060f4b0f94a0deb42f020f43a4ef5d149baf690bc6cd34b8619b99b4f988df2158a5914f80879f9a8b22755293", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635953065, "uuid": "559118c6-a266-420f-8da2-a0b68b6948fe", "value": "T1F1A4613CA1C3C210DE5635BAC7A3AE04BB7612D4532F57CCDB4886ECA61D2252FC5E96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635953065, "uuid": "3371d41f-89cd-4b38-a2b7-c7cf9a6ad920", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635953065, "uuid": "8aff6247-84d0-4c1d-884d-63a42122b069", "value": "6144:ZF/2f1LcXgDG+BkdjeEmjAF0uXBmU3C4zsR5TaIFiuwok6rGWCP9OTr1oCpZyTFf:Z5ubBkReaFRmyCHR52syTF+ROD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635953065, "uuid": "7962dba2-fc6a-4120-928a-f778e5fb3acf", "value": 478616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635953065, "uuid": "49a8fb4c-f15f-4059-89fd-8254da5ad847", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635953065, "uuid": "a052dc51-0c7a-4147-96b0-9677b96136fa", "value": "modest-menu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b313304-3c4c-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635905972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905972, "uuid": "3ab30122-f3f5-45e3-8ab9-9dce108ffb42", "comment": "Malware payload (Mirai)", "value": "867a2d8164b37794053b064b4e667b45", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905972, "uuid": "30748020-831e-4aa7-ac6c-44767b19a8c1", "comment": "Malware payload (Mirai)", "value": "6cc9ef0821d28b4e98f8bb2faf3080466b0436b7556002dcb7e9c1cf0fe83dfc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905972, "uuid": "43de5e95-56b5-4e43-a8b1-d4693dc15cd2", "comment": "Malware payload (Mirai)", "value": "94fa01d9123399bed491685bfe36475dea9575c1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905972, "uuid": "9712bfd7-7462-4648-bf67-1bcfc7f10acd", "comment": "Malware payload (Mirai)", "value": "af8a568fec5d9ce92cac24beea0e279b5a4cd0d2d290d042df6814e469e60c30b9404a09ad2eab1370b82081d50ebc2e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905972, "uuid": "e8468ce6-720e-4fb5-be7f-2968e39b2a47", "value": "T190338CB5C579EDE8D1144A78BE248E749723E100C6932EFADA44C6A99083EFCF5583F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905972, "uuid": "b66bd154-5b14-422d-997d-828b40cd90fd", "value": "768:jaixFwtLSYAagMo0ebH4/ZvQX3hyWfs3INgCJUU/qMCqKomQRCvh:jaQFwtOGBvQXxfs3kgCJt/qMF/RCvh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635905972, "uuid": "23a33f81-87ae-410c-aeda-60cdbc1649f5", "value": 51584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635905972, "uuid": "dde71f5e-a228-442c-9fdd-1e425e86b662", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905972, "uuid": "29915eb7-20e5-4c79-920a-55b810670cb7", "value": "867a2d8164b37794053b064b4e667b45", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ace5eba7-3c7b-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635926242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635926242, "uuid": "44de4d59-f778-4b41-b888-8b75f30436e5", "comment": "Malware payload (AgentTesla)", "value": "09ebaf83d2a4cfd5ff30c1bbaf7eb379", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635926242, "uuid": "945a8a4c-9493-4ba6-8f14-47e0eacca059", "comment": "Malware payload (AgentTesla)", "value": "6d47b2efec484c2af47e66e457a2322aae421ceac6bbe64243c5609433f910fc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635926242, "uuid": "e2f53d01-7220-4d25-acdc-ef64d422e5fc", "comment": "Malware payload (AgentTesla)", "value": "5e18a82b62fd3fdc845e44e24f1f5d6932a325eb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635926242, "uuid": "1c36da14-9b7f-40d1-b13c-487acbe57670", "comment": "Malware payload (AgentTesla)", "value": "2b44eb49d005c7e74b2969542f27e5f749308129bade7ed7b8536cc660be339b6e33f6b3d7a36bde5bc2df637c4dd30e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635926242, "uuid": "bf13a772-fc06-444d-a976-1cc2d6a4d178", "value": "T189B4F092719D8B25CF1D77F820BA8711BBB67C3A5472EA0E1C8971CA19773014E35E43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635926242, "uuid": "3fcf1502-6d39-4505-9f41-e8270db1b285", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635926242, "uuid": "c3919029-072b-4248-9a61-22f16297e1b2", "value": "12288:NJIbw8eGSpJy0zsfHoly7XI0eX8iy+HwVM2Gjx1:NSbw8eGk7zaIc7XI0eX8PYq+1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635926242, "uuid": "8ba50ed6-8ecf-4860-b6c9-807a3d216ab9", "value": 518656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635926242, "uuid": "919a7aa0-7a0d-4395-982b-a2a4066f7787", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635926242, "uuid": "e426474d-14d9-4106-b2dd-4bab36e2a8e0", "value": "URGENT INQUIRY!.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acf13df9-3c84-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635930107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635930107, "uuid": "03139a6e-3164-4fc1-9e4b-d3dccb209ecc", "comment": "Malware payload", "value": "7d3d65991ebefd5143d87e430c32c95e", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635930107, "uuid": "2b44886e-cb95-4ff5-b128-3a7bc48a357d", "comment": "Malware payload", "value": "6dbf95ea4b87268c7d1113a3aabcdd9e8880f4a3ce7aa7f48516eab1df8bc1c0", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635930107, "uuid": "ee163acd-53b8-4114-a381-3b297724cb19", "comment": "Malware payload", "value": "99e6f68fe2041a790c938ee6d263a75f1ae2664d", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635930107, "uuid": "49f1d0e5-d960-40e9-a3fb-ffe926cfa704", "comment": "Malware payload", "value": "1463583661f05544dbbea6a465003e226c53956c0c84338063c0bb83e1db00c00542a31e89b1de2afd11ded0f1e4101d", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635930107, "uuid": "891a3b44-e719-48c6-b6c7-b463d9410d9e", "value": "T12541AE2107E9031CD7B34A3DECB7A31196B27C51E992CF6D425091946CAE325F9B1F2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635930107, "uuid": "0d178a67-17ed-4930-8c3e-0f84310d1d23", "value": "24:8WeoOJXqTuC+pKnWXkAtWC+/CWva76MJBMlwjJrefk4o0aYrabVIJ0wm:8WkJaT6XzCg6KBbtrgoOraR20w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635930107, "uuid": "5c6cf559-501b-48bd-8e05-0045fda5c602", "value": 2323, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635930107, "uuid": "dee96ee4-85dd-4c64-9148-a1d2cdf342ef", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635930107, "uuid": "61be4c80-e83c-4d73-81c6-78badc265088", "value": "Notes.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1ca1741-3ca0-11ec-843c-42010a9c0014", "comment": "Malware payload (Kimsuky)", "timestamp": 1635942222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942222, "uuid": "4e806797-8a02-45c7-a91a-2aa5cbd77716", "comment": "Malware payload (Kimsuky)", "value": "c361c777fd3c4334cdbc2c1fef228e79", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942222, "uuid": "e3360709-0701-480f-aa35-8bc2e0566c7e", "comment": "Malware payload (Kimsuky)", "value": "6e88cdb0a92db616643e518acd0267b0de77c1da0b65201d9f6e0bb65ef7f72c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942222, "uuid": "9bbf9ef7-e4c1-4ac7-a0fc-fc4cf3d3fb44", "comment": "Malware payload (Kimsuky)", "value": "9760ea240ceff33f01095cd8d54cdce0ef4b85e7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942222, "uuid": "62a2bb64-1199-44a8-8318-ad66f563abb9", "comment": "Malware payload (Kimsuky)", "value": "cd979861907a4bf3bc7be95bbf956af5b1a09125f836f26d6f4a5c3b01481fd4c1da23618203d756a281f47fc826f61b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942222, "uuid": "c5867060-885a-475d-bb9f-bc36a1466c61", "value": "T142B36C107180C075C4ED6E3C45309A225B7E7F71DE386E9B53A842B99EB42C19F36E7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942222, "uuid": "6038d94b-c90e-4b85-bf29-579bf3d9dddb", "value": "712fdd0a975324eb988d3fe2289f686b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942222, "uuid": "e2089997-c628-4bd1-b620-2ba3ee41d571", "value": "1536:1/0l6PfiD0DVZn7axI7+kt0DgFeVX8xzay482eFFp1A2NYLsWXvcdWeJ+Tm:BiQpZn73+kSDceVX8x6grp1woWeJ+T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635942222, "uuid": "07d02d34-d4b3-440d-9220-b7be9c6193ea", "value": 117248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635942222, "uuid": "e05471e3-97bb-4121-8379-bb8d01504739", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942222, "uuid": "3ecf7615-4626-4e92-8758-6ebe5dd8ee2f", "value": "6e88cdb0a92db616643e518acd0267b0de77c1da0b65201d9f6e0bb65ef7f72c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "366c7411-3ca0-11ec-843c-42010a9c0014", "comment": "Malware payload (Kimsuky)", "timestamp": 1635941934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941934, "uuid": "ac23c8a1-7db0-4db2-a6a8-b40ab06846c0", "comment": "Malware payload (Kimsuky)", "value": "ae709f23b7c3e66c3c6ec69170dee9f2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941934, "uuid": "9ace4ea3-248f-4ef0-b9a5-cfe2199affc7", "comment": "Malware payload (Kimsuky)", "value": "6fc4ec5f694eb143e6ce874d62cf04ea0d7a48feb25aa4922d07bfd9c305910f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941934, "uuid": "86be75d4-d6d2-49cc-9b50-ab5f9934473b", "comment": "Malware payload (Kimsuky)", "value": "71ea713377fa66ae638f60732f937ada080a567e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941934, "uuid": "62f379b1-96f5-468b-a58f-447e6457a64f", "comment": "Malware payload (Kimsuky)", "value": "bb688609bd6ee85d507a57c2894860ded595bf55106505e5eb95dd99aab570e2b59e49181f521d6e3be91b4b9c462e3c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941934, "uuid": "dd8bdfad-d30a-4abe-b36b-12a4d6deea28", "value": "T1F0C4C011A660C038F4FB01B59AB99769A83D79705778C0CFA3D43DEA19286E2FE31747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941934, "uuid": "392ff39f-de83-4134-97d3-ea6d88c5d81f", "value": "74c18d2564058cf2aaf7e61eda41c07b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941934, "uuid": "10ee9738-03f3-4fcd-8be5-58896bee0c8b", "value": "12288:fKAs4R4Z3juhWfL2IpzrBMkqHRSHsT8JbVeDIoocjL4:fKW4Z36WjBpzrB9qHIsT8JaIoLjM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635941934, "uuid": "ded17674-e75b-435b-9916-556b1b01eedd", "value": 579072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635941934, "uuid": "41be88b4-bf0b-45ca-8e3c-90789d75f85e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941934, "uuid": "e5bdc6a8-8fb5-4ff1-86bf-653f526a99c8", "value": "6fc4ec5f694eb143e6ce874d62cf04ea0d7a48feb25aa4922d07bfd9c305910f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f991f3e-3c8e-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635934192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635934192, "uuid": "6e2e1047-34f7-4de2-b57b-c85b77066760", "comment": "Malware payload (RedLineStealer)", "value": "d821fd5dc7640069c84fb66fd9fdee07", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635934192, "uuid": "a76fdafc-ceed-4592-8b9c-6e3dbe4624fc", "comment": "Malware payload (RedLineStealer)", "value": "70290e7e5fa4459f8800468b3d10d87ff0fb120be77e37fda9423d4c64b74f73", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635934192, "uuid": "7bdb62c9-99bc-43fd-8098-0fcf85d74f7c", "comment": "Malware payload (RedLineStealer)", "value": "24bc8be98e015beb92c3bebec2aac63adcb64301", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635934192, "uuid": "a2788765-70dd-45a5-ae37-4991c2176a78", "comment": "Malware payload (RedLineStealer)", "value": "3bc4c56ebafc83f1887eba6b71d28c075875b711656cd6bd216ca0548045bac6dd80e87c91435a30954acc97386fc2c7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635934192, "uuid": "28d66373-15cd-4c99-829a-8152605c4605", "value": "T1BE74BF10A7A1C035F0B216F849B592B8B53F7AA1673490CF23D52AEE5B74AE0ED31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635934192, "uuid": "e10034f9-6ee8-4ac4-963e-67b940087bc1", "value": "59ee824971f432b778ca9bd24dd5ed5f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635934192, "uuid": "95b3f52f-5e47-4d68-bb7c-9b9fdfba41d0", "value": "6144:uOk2wBueRM2ABZJYJGPUKzqFnX0ZXXGMjUm0cckZsN6WvMM:uFLBuekUGPrzEXAXXGMjUkckZS6SMM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635934192, "uuid": "e59a9ca1-992d-4256-9a23-867f2721a85f", "value": 368640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635934192, "uuid": "7d2fb8bf-b972-4a37-b621-bbff5f75dfb5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635934192, "uuid": "94cb43c3-f281-48c5-87c3-6f0706c79e77", "value": "d821fd5dc7640069c84fb66fd9fdee07", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b02f9f61-3c48-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635904343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635904343, "uuid": "c9330847-8f52-47f2-892d-09fccb514186", "comment": "Malware payload (Mirai)", "value": "1094cee4c3c676bbafeb2221542da84a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635904343, "uuid": "fc3301ae-6dea-4e45-a5aa-dc280d256dc2", "comment": "Malware payload (Mirai)", "value": "706be1381b40faf4e528079466d1d5a5740a39db1f61b215a5bb6963b8050538", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635904343, "uuid": "1766b2a3-e553-4555-adcf-21ec5e16b9aa", "comment": "Malware payload (Mirai)", "value": "0b9bdb402a6de981c8cbaac81b236a8f4ec194ce", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635904343, "uuid": "ee78d5aa-48b5-4252-aa8d-bb63c728cc8b", "comment": "Malware payload (Mirai)", "value": "a627aaa319a7d913c746409b5c752099d9ad859d715165026bf2b0d4fdd2e128387ab5173805aef7776dda661337e261", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635904343, "uuid": "69ec4f74-450d-4141-96aa-ba02ef756002", "value": "T1EFA32A4AFC818A11C4C9237AB92D118E331267E8E2DFB263CD141F6477CA92F0E77956", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635904343, "uuid": "3db04bee-14cd-4436-9c7b-54ad4882346b", "value": "1536:wtnvysW8jqrHdr6du5i4JC+25LxET9AoZxQzqsVx6Y+Qw5tn9M4iiiHqhQBF1EH:CysWLrHhJCd29yqsVxXqiHqhQB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635904343, "uuid": "c49a307e-b516-4a92-bf93-b8c392cdbec9", "value": 103728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635904343, "uuid": "6052ce85-4eae-475f-9636-c4967bddda40", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635904343, "uuid": "04bb6fe4-d72d-4e4b-9a10-71767e9ba5a9", "value": "arm6-20211103-0152", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c08dee64-3cdf-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635969224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635969224, "uuid": "44f67671-ed3d-422f-83d9-e3209582df14", "comment": "Malware payload", "value": "9860743c4ff83784de05aa8444594aed", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635969224, "uuid": "20aafbd8-4534-4e42-847d-d4934df00575", "comment": "Malware payload", "value": "70da41b661dc8de4e8cd1bde0f17f434433115bffad2fb762205b734acd4ed35", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635969224, "uuid": "8fb4c8af-5fe0-4197-b358-3c6076139d11", "comment": "Malware payload", "value": "517ab424f9f6ee8de223e396691f1cb3b2d01a09", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635969224, "uuid": "d6791f80-fd7f-4ecc-9189-fef33853b650", "comment": "Malware payload", "value": "1bd73442e5ae7a15d6fbf80d5cbddf336e58fc510432cb6f44c597f3e46b7d347c694cbcf8ddd9c0b737fd52176c80ea", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635969224, "uuid": "5fdbc030-ce80-40f4-854b-99956f339c63", "value": "T12B52D707D587AD72F927D8F040FAEF7A5D77E9518D284CB6CFA0FD811E228E1A416209", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635969224, "uuid": "773db225-8fd1-4358-8c5b-1474c3f6791a", "value": "11ccb672a9c5d04b258e5856f76f523f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635969224, "uuid": "ba49218b-8bc1-4b19-9a6d-a786f5b4e242", "value": "192:xVHpKRBMX6koqN5Ns0zjpFR+jFUkdFo2qKNK9yLJZxeBxeNRxfT7Y9WfE:DpKk7s0tmUkdogZxcxsRNSWfE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635969224, "uuid": "387bc0a4-8fc0-4afb-b236-3751e1080d65", "value": 14336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635969224, "uuid": "5bd2e366-a1c5-46c5-ae75-b35ededff454", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635969224, "uuid": "97672c70-902e-4a77-9348-0c06a2871fb8", "value": "9860743c4ff83784de05aa8444594aed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "871d7a69-3c8b-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1635933050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635933050, "uuid": "7015da86-16ec-472f-b6df-71c1485dbe88", "comment": "Malware payload (SnakeKeylogger)", "value": "131c3a9be2dc5127255257d41280b115", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635933050, "uuid": "e6f3d9b0-7107-4b15-8264-c9cc8d3a20ae", "comment": "Malware payload (SnakeKeylogger)", "value": "715d6de007b88c5c2d2595e41e368cb6f05625b91d45e82c5d80aaa30a1aa66a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635933050, "uuid": "b27253dd-f42f-40d0-a7dd-241f794f80a0", "comment": "Malware payload (SnakeKeylogger)", "value": "2290e7b3f5d47c579d6015d536b0e32a86b1859b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635933050, "uuid": "d7aea409-7cc0-434c-9a69-c650aa4741c0", "comment": "Malware payload (SnakeKeylogger)", "value": "1e72981a3b51fa2326ea8fcb94bce0ecbd02c69da0ae1f187aeb8601ed588cfeb4294455a5cf0bd164175a9d79b95a53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635933050, "uuid": "a8a638cd-50fd-4ae0-b805-9cfd0b24ab62", "value": "T1F8C209607758053BCB2A5E33B0A28111F23C6745F81FEB5D38AF951A8DD33421A967AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635933050, "uuid": "a988e75f-4d59-4fa6-baed-62449aa2f03e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635933050, "uuid": "e3c21a08-c2b8-43c2-85fd-efa3167bbd8d", "value": "384:e9xx1xrHSDBHSpSQSaS3SrOrOxs+BLR9rSVTopwU2IghFg6TUMd4qjlvJfDhst:M0DdWSQSaS3SyAXWGlH+lRvJfDhC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635933050, "uuid": "c8cadd06-8a13-46bc-a6eb-fa2ca8647f57", "value": 27576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635933050, "uuid": "65cf5943-4781-459c-bfc4-07a6b89016cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635933050, "uuid": "84c52d42-f5de-4b70-9779-fedfd1fa503a", "value": "ziraat bankas\u0131 swift mesaji.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a560ae0f-3cd8-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1635966172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966172, "uuid": "86fe71eb-c604-49f5-b48a-053769983f62", "comment": "Malware payload (SnakeKeylogger)", "value": "366728b5c4095aba3e6870a55a436ba2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966172, "uuid": "181ae9a6-67a9-487c-a461-777e6393d78e", "comment": "Malware payload (SnakeKeylogger)", "value": "7176142df135352abe8dd429f568d4e5dc0c78099e725e298dbfae7abfd9db90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966172, "uuid": "4eec7f56-532b-4c33-98bd-6e6a4d8fd440", "comment": "Malware payload (SnakeKeylogger)", "value": "bba5b3237fca12e3bf7388c0e5bef26485bdf258", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966172, "uuid": "51deed05-65b4-4073-9046-b5821bc7d977", "comment": "Malware payload (SnakeKeylogger)", "value": "4c4b6e7451a14d5100181ae7ab7f5584e4c34053f72bb74c11044a5788a338633355c877505df9647aab33c0299dff6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966172, "uuid": "2617eee8-b999-4492-84ac-083b31971d8f", "value": "T1D5D42371B752C85EEBE5A63121B6F15BF7A8C90D52E7CD0743E87C317BA29CB0A54202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966172, "uuid": "3230cd63-5203-441f-815e-5e79e5237cee", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966172, "uuid": "88e60c91-ede9-4f13-b599-9e5fe0525f5b", "value": "12288:/jYw5x5WDWu+KTigf+sseqqSdZdfoN59HoUKBMnyFWd/LeQffw:/jYDKKe2+ss3xdkLybB+Sa/yQf4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635966172, "uuid": "8320801d-3428-48d1-9422-ceabee3478af", "value": 620286, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635966172, "uuid": "3d84be40-3fac-4d54-8737-d4f39e8788ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966172, "uuid": "16949de5-054c-4249-af51-cc9b00805ea0", "value": "chase-PDF ................exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "169b4640-3ca1-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635942310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942310, "uuid": "05e0a07e-e9fa-4208-974c-48757220867b", "comment": "Malware payload (Formbook)", "value": "be04765016d1091f62cd319a589ac729", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942310, "uuid": "6c1f5dd1-c89e-4b08-a7a9-81b58a679fa3", "comment": "Malware payload (Formbook)", "value": "717dd41001466e483623da907389e0481d7cf640128f4aac31d05c1b34110aba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942310, "uuid": "7a9268ed-41de-449b-aee9-00776e0ea39d", "comment": "Malware payload (Formbook)", "value": "be22c3d717d8d42b6c3b59453f38affa98f30604", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942310, "uuid": "12abaf51-a3e2-46f7-a2d4-eae09da03e45", "comment": "Malware payload (Formbook)", "value": "bef4534289248b6edaac6033be9bb162db0d604ccd82283a3af405cb52be5226f686cf0927b8b2b678b4752625a82e8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942310, "uuid": "e2e81b3e-e479-4e69-9dd5-36cce3a4d0d9", "value": "T14E847DE1A740C4B5D8A79679943BEAA7B433A25DDC68490D2D92FF0F3D32347402789B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942310, "uuid": "6b948015-72af-4129-86bb-9a6a05b7d42c", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942310, "uuid": "f3b64080-a4e5-457d-872d-9301bf328b6a", "value": "6144:a8LxBwuDA1+j1S9OWzMVfRh3rb0Tk8EDRLGGXB/DMN/ri1k98zKQyCR:ygA0jQ9OWzMh0CRLFFDQji1fR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635942310, "uuid": "e90511ca-5f5e-4291-8dea-89c87c079799", "value": 397209, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635942310, "uuid": "ff1f4797-659c-4e15-a711-cd452a684d71", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942310, "uuid": "77feef2e-6032-4e11-b5b2-01f65bd7f1ef", "value": "Order-List-Nov-3-2021-58395843.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0064bb9d-3ca1-11ec-843c-42010a9c0014", "comment": "Malware payload (Kimsuky)", "timestamp": 1635942273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942273, "uuid": "ebe09308-006a-42aa-9b1b-117aae048599", "comment": "Malware payload (Kimsuky)", "value": "396a9366544bfb8f9c398bb5305d14e6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942273, "uuid": "d509d158-9c25-44f9-b66a-2c70e3c1dd8e", "comment": "Malware payload (Kimsuky)", "value": "71ff8fa31ac353606cf1ee2ad379f859ee292edd736fa35e0e0956575a461538", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942273, "uuid": "c2a9eff7-6f9c-47ad-91fc-7e96b290d129", "comment": "Malware payload (Kimsuky)", "value": "bf7770709b89f2ac1e837422f285fd62812a9c0a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942273, "uuid": "002348aa-d331-4e0b-836c-c013b001b5aa", "comment": "Malware payload (Kimsuky)", "value": "18d2cdc1fd8336e45ad66afd118327aa1df119d8a4f491b38be4210c1be070e72ac243c6d9795069bd32af05ab5ea4e5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942273, "uuid": "31394168-1651-4697-b3d8-c374fa6111e9", "value": "T1E8B35C00B1C0C071D0FE6A3D4530DA625B2EBA71DE69AE57239842699F703D1AF35E7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942273, "uuid": "62814a29-ea98-4c5b-821d-4ad021a3b565", "value": "62666f2878e8ff196208c5362ae49110", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942273, "uuid": "b490c066-b145-4425-aa0b-0a4edcb579d9", "value": "3072:qpcuWIkH8WqQIpkZw4ts/k4HxKUJ4Q49:qp9rDKmkq4rK74", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635942273, "uuid": "a302d38f-0934-4434-8c0f-d4e271dd84ae", "value": 112640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635942273, "uuid": "1091c620-63a1-42e8-b252-131811275b4c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942273, "uuid": "fe6944e4-7e9b-4f8c-9131-46a98303105c", "value": "71ff8fa31ac353606cf1ee2ad379f859ee292edd736fa35e0e0956575a461538", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df438da3-3c88-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635931910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635931910, "uuid": "a0f80afc-a06f-41c2-a8fb-f23ef847d582", "comment": "Malware payload", "value": "7a1cbada366e12e69f619ee6f071efd7", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635931910, "uuid": "38268a72-7550-4b3a-8add-45a4facafe61", "comment": "Malware payload", "value": "72725e75c445aa8f38e71a31de3c7af13f48cef4f328d3a40fa7a76948304b21", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635931910, "uuid": "6175e4bd-41e8-4726-bc39-e8aa719f7ee1", "comment": "Malware payload", "value": "eb487fe20cc50df7e898f61f5282c484deb44d9d", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635931910, "uuid": "beafb6c8-063b-4c72-80dc-29eba17f5b7d", "comment": "Malware payload", "value": "1685d92d4145e27d23533a7824c1ed966f913a2b0124c65df2c20afc2b56485a492ed310eb43f0c251cbfed7750c50c6", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635931910, "uuid": "fce96073-5fa3-413c-8c27-6932dd7166cf", "value": "T180F023248B286BCAD5451A37C023BF30807078884C40BFE479EC1F48A25C4807F8916A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635931910, "uuid": "0753de72-83a8-4046-a9ab-151297e570e6", "value": "12:8DpOB+PlyWfyGEV75FJI3TFvTPNQGkLAGrgSJfENYaST:8HPlDpEPQFTKGkLnffDaST", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635931910, "uuid": "86d24cc4-9edd-404c-bbdc-e19465fe5db3", "value": 540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635931910, "uuid": "337d2e17-4858-437c-a73f-308169492488", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635931910, "uuid": "72838cfd-43ba-4f03-a976-cca9dd0d0a51", "value": "Documento-PDF65422515373_LNK", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ee4978a-3ca0-11ec-843c-42010a9c0014", "comment": "Malware payload (Kimsuky)", "timestamp": 1635941922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941922, "uuid": "2dd8389f-c825-4b4d-b824-da4079fbed1e", "comment": "Malware payload (Kimsuky)", "value": "70766bfafcc3ae248264265240a0b148", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941922, "uuid": "86e25bb2-55e1-439b-8e56-07c6859108af", "comment": "Malware payload (Kimsuky)", "value": "72a4d5322d784f5296986de1b049d2286e6b879624942853cb3bdccd4c05339a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941922, "uuid": "bbe67483-9136-4809-af32-fa4da5ee8985", "comment": "Malware payload (Kimsuky)", "value": "d328df850c1b69f949b0fbee136e0dc691564ffd", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941922, "uuid": "f35a8bdb-f73a-4886-b6fc-6963f35389d4", "comment": "Malware payload (Kimsuky)", "value": "54e961776bed49764fa94bd1b89369a2461a8da75a9c963b788711eb270f91dd56d29ec887d27402c4ac28b05c2481eb", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941922, "uuid": "aeb5be7e-d161-431d-9269-90221203fea5", "value": "T16BD4AF01B7908034F5FB0AF894BE65A9583DB9E06734C4CB97C06AEE6A35BD4AD30717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941922, "uuid": "2f6a41a7-b1ef-4919-8914-782f27f2f14a", "value": "869c528228af8b0b0bb001808e96ee3b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941922, "uuid": "d82c029e-53d1-48dc-bec6-73605860e10d", "value": "12288:oO6Kp5dTOtny72+rHRSHsT8JbVeDIoocjL4ql6o:tp5dxlrHIsT8JaIoLjMk6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635941922, "uuid": "4ba67693-5497-43e8-8396-a0dce3cc3271", "value": 649728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635941922, "uuid": "8f92e9ae-582d-482c-ad73-d2e05a534c37", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941922, "uuid": "be1e4f41-716a-44a0-a8b0-e32eacf353dd", "value": "72a4d5322d784f5296986de1b049d2286e6b879624942853cb3bdccd4c05339a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b476da4b-3ca0-11ec-843c-42010a9c0014", "comment": "Malware payload (Kimsuky)", "timestamp": 1635942146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942146, "uuid": "959a51f5-739d-4d2c-83ba-c4b479324bb8", "comment": "Malware payload (Kimsuky)", "value": "874bc4f43a51d1f4d9e359dcf4a7f4a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942146, "uuid": "d75edcf6-a3c2-44d0-a2fb-b792b5b975d2", "comment": "Malware payload (Kimsuky)", "value": "72a5fc496484b91f0cabaab9109235aaed3436f436ddcdfaf9bcecd6aa2da950", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942146, "uuid": "b392015e-d9a4-4494-a99f-c66d292b54f5", "comment": "Malware payload (Kimsuky)", "value": "58747ebb57808db6612569c7fb6369372b7ea606", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942146, "uuid": "e2cfd35e-8561-4d14-a349-7f41f3bb57b4", "comment": "Malware payload (Kimsuky)", "value": "165b82d88aec37107887914f5dea8aecd222edf0846bb945596db85eb74add5ead4d2bd796d2c2e2b6fd812aead11e88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942146, "uuid": "749f7e56-f51c-4243-a2bd-6f5548898ccb", "value": "T15AD313EEC50E06B5DE206A35BD2EDC94B7DE3D38E45484B039E1E56723A56F0E23424D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942146, "uuid": "3338ccac-16c1-49db-af49-7d2291012f22", "value": "6859c1fbd5011b39e2b3c5ccd6eda491", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942146, "uuid": "4c85c139-60b6-4e02-8199-31e0fd189598", "value": "3072:1za5EcLA5i0MzB/NIZF/yf0JPKpj5DIqVAict/eSoB1x5:1zaxA5im1+0oCiJLf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635942146, "uuid": "1187c79f-cc18-473e-a12e-a31a6aec626a", "value": 141312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635942146, "uuid": "013a9415-2131-4e56-8c95-55a3d6da4890", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942146, "uuid": "f00a1eda-c9f4-42a7-a7c7-fc6df6be38de", "value": "72a5fc496484b91f0cabaab9109235aaed3436f436ddcdfaf9bcecd6aa2da950", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f3b79c3-3c84-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1635930084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635930084, "uuid": "b2cf88f2-736a-4b58-acd6-f9d9a324467e", "comment": "Malware payload (SnakeKeylogger)", "value": "80ce2805711544b51a41973eee4f3fc2", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635930084, "uuid": "50c69963-c5a4-4005-92e0-02be0fa30585", "comment": "Malware payload (SnakeKeylogger)", "value": "72bb6a51326a17cce75f27641b411f32a1eef168b3680c1ff5e827a60a1018ce", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635930084, "uuid": "6908d3fb-c22d-41c9-bfde-c76adeba3162", "comment": "Malware payload (SnakeKeylogger)", "value": "31244dbb39312237debc3a9bc30b939ae969c31c", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635930084, "uuid": "338ebbdf-f0e1-4942-bef4-540a61aa29dc", "comment": "Malware payload (SnakeKeylogger)", "value": "8342166d48ddfa8b93b650541853a150aa9ccb3536f3f83f8353bb9257e005bcaa3d8ac4791846c1b26a6ff76eee1524", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635930084, "uuid": "0bdcc468-7082-420b-ba74-7e94053bd07c", "value": "T18441BC2107E9031CD6B24A3EEC77E311D6B37C51E9A2CF6D0210519468A9221FAB1F2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635930084, "uuid": "640a8990-1dbd-47b6-a00c-279282e9298e", "value": "24:8WelOJXqTuC+pKnWXkAtWC+/CWiT5+Jrefk4o0aYrabVIJ0wm:8WVJaT6XzlmrgoOraR20w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635930084, "uuid": "f713fcc5-1d7d-4dc4-ad8b-5d1a61b10560", "value": 2323, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635930084, "uuid": "d64b7d88-3fd9-4cdf-b8d6-01282bc7b405", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635930084, "uuid": "0c5b19a0-1dd0-4401-92b0-f9b75df22c3f", "value": "002.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28831755-3c97-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635938045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635938045, "uuid": "8f86b1cb-b455-4379-b40f-c3c548e25f61", "comment": "Malware payload (AgentTesla)", "value": "93f0c7edede9d48fc7c8289710144d71", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635938045, "uuid": "cfba0d12-bdc3-4724-b815-774cf29b8031", "comment": "Malware payload (AgentTesla)", "value": "72c9fa1976f19bc0c627e21972a7c2fbb3305b18aa217ca65c318674b09220ff", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635938045, "uuid": "6bece25a-3e36-4b87-8202-ace14497773f", "comment": "Malware payload (AgentTesla)", "value": "80efca4b8e7976b5c6636c5a284fd0320831abfc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635938045, "uuid": "b9f21d9f-195e-4f85-aa76-cbed200691d2", "comment": "Malware payload (AgentTesla)", "value": "fcb655c5a5edabe09f42f52ccb636a5e33d4803bbeec9487298c531e57200f62142cd6b303f83da685cb3c848b23b303", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635938045, "uuid": "efe0f007-cf37-47bf-9cdc-9a1bb2e63984", "value": "T1D1B4E052361D5B91C76DB3F160EA5394BBB47E3A5452E60E2ECAB0CA09737428F31E43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635938045, "uuid": "6b9b0b6d-4041-4ec8-a6db-4247eb573094", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635938045, "uuid": "29d47140-f7ae-46f3-adc1-8187067d274c", "value": "12288:NJIbw8eGG0uONxfwyj1On/QQPqvBJvC4Fse41:NSbw8eGvjAYfKmse41", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635938045, "uuid": "7cab53c2-dc9b-4ad6-ba3d-802ed5ac9dbd", "value": 496640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635938045, "uuid": "3e731516-c047-4fc1-90c1-f176d75970c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635938045, "uuid": "03ae7b40-a5e0-49bc-9dd4-58dee3eb72a4", "value": "DHL9142591441.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d706654-3cbe-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635954777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635954777, "uuid": "8b36ffcf-237b-499f-9f8f-d69343ef54dc", "comment": "Malware payload (Formbook)", "value": "7b8b50e95f446f82a53ffec2afa8bb24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635954777, "uuid": "fa8d14a2-44b4-48ae-8f31-50627552f451", "comment": "Malware payload (Formbook)", "value": "73a254fe8cce08216fdd98cfa4c0072ee082d3aae0942b74e6fc0eec2df9df83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635954777, "uuid": "34d8fe0a-16d0-4a54-8102-fe2fbcbd0690", "comment": "Malware payload (Formbook)", "value": "6d709ede87202dd695e94aab7f138b286ae6a3d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635954777, "uuid": "37af8c4a-2c54-4f0a-acdf-f5933d590744", "comment": "Malware payload (Formbook)", "value": "dcee1fd233977ec2e7b87aeb2d57c4893cdbd378cbfa1f677a23a39b502f7e76c25ca330ee5ef78f3997e570b50b29a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635954777, "uuid": "bf2202f3-570f-41d9-9213-a2dbf9c7d266", "value": "T1087412A17BB81763C93D03FA207915201FF5E2675013E32DAECA79EA53A9F415610EE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635954777, "uuid": "1d77a312-9432-4c53-8ffd-28dc7b0d0873", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635954777, "uuid": "21372f4d-48fd-4d69-bfe5-8ebdd76c9dd6", "value": "6144:/UVRMZsG+T6AV+TF99+yD7h0aIbIFDhBjEoLPHE2ySeJNlTIPON:/8RRG/AVgb9+0IUl42ySe19", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635954777, "uuid": "a87bf525-fad4-4b8c-ad55-10db51031ad9", "value": 361472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635954777, "uuid": "f5f9aace-0c49-4b0a-b564-99a13b1d416f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635954777, "uuid": "e407c943-ab9c-403f-aa9c-bc7b762f3d5f", "value": "PO #20004235.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa387243-3ca3-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635943551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635943551, "uuid": "4d781141-9906-437e-918b-52058e262cfe", "comment": "Malware payload (Mirai)", "value": "1b5dfd49454f3d7fe8e518f904c88bc7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635943551, "uuid": "1731a21a-abb4-4c1e-b52f-e4a4233188c1", "comment": "Malware payload (Mirai)", "value": "743ebdcaf8b0255212578ac797f920df17daba5f8036fb2f6c942316a2524d22", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635943551, "uuid": "78d4f248-754e-4514-9d59-b1ecb42a4ad9", "comment": "Malware payload (Mirai)", "value": "560ba6f16c235b269669d8bb8c6367045e521617", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635943551, "uuid": "6e0e020f-015c-4a8a-beb2-048a2c56c9e8", "comment": "Malware payload (Mirai)", "value": "a301d7ab93221a3a9685f9ebf8589217f25e83ae06d398224260e803bd5a4463ea28465e7ac4f9abf2b253278d1ea5af", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635943551, "uuid": "8915189e-d111-4694-9482-57bc6693ff00", "value": "T16E338E76C42EADD8C6458734B82A4A740FA3E10491E76EFA5B8586A54043FFCF61C3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635943551, "uuid": "6ac14b9e-4ade-4807-9c7b-0f436cfe4c65", "value": "768:Er9Q6eGyC75erUUeOiwwtNp40ZdiWFyGoMuJLk3XCmlolN9aXCxw:EcdC753UlwtNFFyGoMD3X3qlGXCxw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635943551, "uuid": "04205415-a055-49de-a16f-138314635e22", "value": 51924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635943551, "uuid": "5cc832b9-15d8-406c-8179-a5c2412e4779", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635943551, "uuid": "a42ee8f0-7bdb-4a99-8db5-a2df5b18468e", "value": "1b5dfd49454f3d7fe8e518f904c88bc7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "228aa895-3caf-11ec-843c-42010a9c0014", "comment": "Malware payload (SilentBuilder)", "timestamp": 1635948343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635948343, "uuid": "1c635064-e39d-4044-85cb-78bc0c624db6", "comment": "Malware payload (SilentBuilder)", "value": "95f76f00cf86cde85e869e5517fffad3", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635948343, "uuid": "d49a393b-8000-45b0-9bdd-3ac957aadf65", "comment": "Malware payload (SilentBuilder)", "value": "74ffa43df8525d36f40021a7a10ee9120e8d1f27f050073b8ccbbd328806e1a2", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635948343, "uuid": "d84fea5d-aa7c-48d6-9401-ec93749c41f9", "comment": "Malware payload (SilentBuilder)", "value": "80816eb5f351682312f1a8e3034164528611db75", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635948343, "uuid": "5e448c64-53c9-4511-b7df-c457784130eb", "comment": "Malware payload (SilentBuilder)", "value": "47daa666257ecc0bca127b169f7b73c8db666a45c90c0436ba7f8a564bdc07a8d4b5812a00004a22a264a304e787ccb6", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635948343, "uuid": "60f0279e-fa41-43a5-9ac0-215c50af5e0b", "value": "T198934A42BA58D86EF525C77148EB53A5B322EC305F6B0B872665B3203FF99E06E03547", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635948343, "uuid": "3cc8b51d-fd6f-431d-936c-c43b49c19c53", "value": "1536:i5Kpb8rGYrMPe3q7Q0XV5xtezEsi8/dgr91vrVmxJiME2GhdD52lZPFu1AOge+1A:0Kpb8rGYrMPe3q7Q0XV5xtezEsi8/dgf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635948343, "uuid": "171d8bd0-d1b7-4b1a-b0bc-b1b76767e06c", "value": 90112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635948343, "uuid": "71f9c772-8765-462c-ba74-8cda05458c71", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635948343, "uuid": "c119f94e-2761-4809-8fcf-658595cb79ce", "value": "rows-152882036.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd0a6f66-3c4b-11ec-843c-42010a9c0014", "comment": "Malware payload (DCRat)", "timestamp": 1635905707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905707, "uuid": "5db0c7d0-dfaa-4aea-a60f-58ee96eff43b", "comment": "Malware payload (DCRat)", "value": "875185f72af5c4b58e85bab864dc43fc", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905707, "uuid": "423738d2-11c5-46c2-9763-9a0d17f96dc8", "comment": "Malware payload (DCRat)", "value": "750fef4564e6d14531734cf0b0b4e3641b4f55b30ad23bf64538cabbb1979eac", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905707, "uuid": "febaaffa-1377-40c6-85c8-4a1b3b725d08", "comment": "Malware payload (DCRat)", "value": "4e573a9ce1fc4de3b95e6ebacb4baa4761a37e07", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905707, "uuid": "2e23ee29-0029-4d42-8505-a0d8123577c8", "comment": "Malware payload (DCRat)", "value": "96bfc2bfd8a2b697cbecea166b4257973ca6f446ee6323606bff567efc4f7a8ca2caeb8bdcb957bc6de36851849b6fd8", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905707, "uuid": "003e784c-e552-4cde-b281-6375b38a663f", "value": "T15316F68D9C9C51CCE11DABD02B71C6D563AFD3FF28452536B0ADE2712D6B6299FB2800", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905707, "uuid": "26294bf1-0473-4ff5-9b61-efc214e01d35", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905707, "uuid": "9159c93d-b748-4bc9-b3f7-c591f244c742", "value": "24576:YIRhiXMOyA8fnU9PVrLhSYX6rolecESx+GVyWZAf:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635905707, "uuid": "fd147b16-7ee7-49a3-aeef-7182031dac37", "value": 4120064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635905707, "uuid": "f5f657f1-022e-42d3-aec5-6b22236d653a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905707, "uuid": "4c7b54b8-2f38-4f9c-9bc5-17cf550a2ac4", "value": "750FEF4564E6D14531734CF0B0B4E3641B4F55B30AD23.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dfa1604-3c9e-11ec-843c-42010a9c0014", "comment": "Malware payload (Kimsuky)", "timestamp": 1635941088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941088, "uuid": "81099fc4-a5a7-4d55-951d-c38d50cb7ded", "comment": "Malware payload (Kimsuky)", "value": "18d94704439c9eda33ea49eab40d99a5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941088, "uuid": "ac0aed9b-be20-433d-b90e-57f572d9efd5", "comment": "Malware payload (Kimsuky)", "value": "756b56ed3d4acbc0b766f71cf24ac80c0ca2f372586c43cd27e2b0ea489cd0f8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941088, "uuid": "f94f712b-135e-411f-be90-9901037139f9", "comment": "Malware payload (Kimsuky)", "value": "bb7330a88b1bd0afbda03090571222eb718e25a1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941088, "uuid": "9e07e81e-6f12-4297-b165-59776d0ab5cf", "comment": "Malware payload (Kimsuky)", "value": "503d40dfaa13de7fb8eace857cff278b75f8c1c36aa831ad21926bb60d9c73132a4ec2b79701a618e01b3a72b5afe045", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941088, "uuid": "06418b8b-b097-4f5b-94ff-5834c426adc7", "value": "T1393533711846EB3FD68C9BBDC24A662710AAFE79018E3616B1EDF10C01FF5F46A4494B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941088, "uuid": "d126d60d-f897-4d3c-a69b-06416413772b", "value": "97bcf239ab8151042f0252d7f184cf29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941088, "uuid": "05ef8fc4-af7a-4cb8-ac21-c51482e32002", "value": "24576:9/awU/kqFE0K+Zd5JZ2ao8yc7Oqdc2pdu/5pCYu2ol:9/bU5S/+/4Yc2P0CYu2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635941088, "uuid": "cd0b0c29-e54e-43c5-a4ac-49d944749582", "value": 1081856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635941088, "uuid": "9cb97c65-5ee5-472a-9f16-3f01e4cafc7f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941088, "uuid": "554182da-37b9-4735-8930-2178afc04310", "value": "756b56ed3d4acbc0b766f71cf24ac80c0ca2f372586c43cd27e2b0ea489cd0f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14c590d9-3ca0-11ec-843c-42010a9c0014", "comment": "Malware payload (Kimsuky)", "timestamp": 1635941878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941878, "uuid": "5704707e-b856-4b9c-a8ef-75542fe48430", "comment": "Malware payload (Kimsuky)", "value": "47c95f19ebd745d588bb208ff89c90ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941878, "uuid": "217f6791-48af-4b41-9000-05f0a2299f6f", "comment": "Malware payload (Kimsuky)", "value": "757dfeacabf4c2f771147159d26117818354af14050e6ba42cc00f4a3d58e51f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941878, "uuid": "09ceeaa4-cc7a-4c75-a445-17f26fdd5aed", "comment": "Malware payload (Kimsuky)", "value": "01172c3dac99cae246005752a6a66479d8861225", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941878, "uuid": "fff44245-15ca-48ba-ad9e-3d1c7c9e9eff", "comment": "Malware payload (Kimsuky)", "value": "b849dbea501907959279e84e78143ec606f05504c1151525bb6ecade426701d37a91be44a9d5c50cbd113d6508934462", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941878, "uuid": "0ac19249-6fa6-4e32-bf9e-f9d695248531", "value": "T1D2357BB5E2625963E5AF93341727810EA9A06CCB2F588B5E5F41738C19FD0F048BC5BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941878, "uuid": "7817b4e6-c788-4ecf-ac2c-dc0ac0534b26", "value": "74895082953d732f6242e8f3fd17d79f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941878, "uuid": "26828620-90a0-46aa-a9bd-871fd9fa1ff5", "value": "12288:APWcT1z2aKqkP/mANd2JiEWKZ52zfeCkIAYfLeXcj6uuLl:uhT1z4q030JigZUaULeXc3uLl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635941878, "uuid": "e9261f9a-e838-473d-8efc-3c56f23e969f", "value": 1156608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635941878, "uuid": "9c2b21a1-abbe-41b6-95c4-1173e2f0c60b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941878, "uuid": "a86de3e8-ee87-4204-839c-b722c6e20d6b", "value": "757dfeacabf4c2f771147159d26117818354af14050e6ba42cc00f4a3d58e51f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8b831dc-3c91-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635935818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635935818, "uuid": "52d33dbc-f9fe-408f-ab51-da6e737be44d", "comment": "Malware payload (RedLineStealer)", "value": "8d8d7d4aba4420af2e126800a3139dd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635935818, "uuid": "792becb4-3469-4884-b084-d9eaf2abd012", "comment": "Malware payload (RedLineStealer)", "value": "75da761b015ffe64c01e191a864fd234393e6687462df33649ea42b97cbe47a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635935818, "uuid": "e53bfb29-1784-4a6e-8d28-888bd1a8154d", "comment": "Malware payload (RedLineStealer)", "value": "4c3cbb2df4e8b7c7fde6ab7d5f7029ce2b4d5437", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635935818, "uuid": "190e81c3-9534-41e2-b692-4c3a65da3452", "comment": "Malware payload (RedLineStealer)", "value": "779458d247f07e95581fd911043377d0758131d7d25e55d2eefbe4337b91ff60af759ce5b23ac0d9a477678b3470cef6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635935818, "uuid": "ee6b80b9-93a6-488a-842e-39f2ab54b0a0", "value": "T179A33A3913BCAB35F6BE6B752460051583F4E08BA812EF5F9EC054DA3F22F41A6546F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635935818, "uuid": "ba25374d-455d-4c25-a5d9-ac035987ef55", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635935818, "uuid": "13d0d3f0-95bf-46a4-a67a-9f94456aa99c", "value": "3072:UXqrF3iohjoAOjyAofbmhED0ymd/AZp1W:HOmbmhEgyM+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635935818, "uuid": "b9e0ba7f-b8f6-415c-9091-77ca9dca59f7", "value": 107008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635935818, "uuid": "bc52a4f2-1ac5-4214-9685-32820324f58e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635935818, "uuid": "a08ba896-5c49-40d9-bcd1-b64c616134cb", "value": "75da761b015ffe64c01e191a864fd234393e6687462df33649ea42b97cbe47a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71a6139d-3cd3-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1635963938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635963938, "uuid": "de78002c-529e-4449-abd9-33f57cfc550a", "comment": "Malware payload (Dridex)", "value": "5b653ef9db2b1c9d597cebb2fc29c39d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635963938, "uuid": "f999ac60-fb57-4173-ba5b-5c1b66f07b28", "comment": "Malware payload (Dridex)", "value": "76015f8d4cff61afcaa6599583c7dab893f85ae300ceefb53051b1eae52eaa5c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635963938, "uuid": "a6ae2980-8b59-4857-a7da-79d53f8d7386", "comment": "Malware payload (Dridex)", "value": "e9da77e8b308c7c70c0c111e350b0be424a12a5e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635963938, "uuid": "f367ad27-9ffd-4e67-92c2-74598dd54d14", "comment": "Malware payload (Dridex)", "value": "ba4cac64543fc814eab72b0571d79043a980db7080a55b407d449355a643779a9d23f9ef4ba2f60e9f154233de662be6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635963938, "uuid": "a583e2e8-f34e-44a0-8ae7-a9547289d0f7", "value": "T13DA4BF04D1EA0676D52B62FE71FF0CCA47104DF9B506AC84D3435A6A5B32FEC3A7A849", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635963938, "uuid": "ba3acd53-877f-4f4e-b953-e68a10aeba83", "value": "ccdf79216449388cf5a36d38a385d866", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635963938, "uuid": "62ff7ffc-748b-437a-982d-f3bf462b308a", "value": "12288:UZKEZNxJPdthZz/MqmOce24Wqa+cKdDSFczjJgiUCeoCqoE:UZKEr/1jhz17Px", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635963938, "uuid": "0b82e94a-1925-4308-b322-0220d2b5c832", "value": 471040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635963938, "uuid": "7c25bf25-5943-4402-85c3-5317f97927d4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635963938, "uuid": "034ac071-4330-4726-96b4-fad2d943490d", "value": "SecuriteInfo.com.Drixed-FJX5B653EF9DB2B.6430.6316", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a8f487f-3c8f-11ec-843c-42010a9c0014", "comment": "Malware payload (NetWire)", "timestamp": 1635934586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635934586, "uuid": "33bcb059-8331-4871-979c-1f8cd7f4fc14", "comment": "Malware payload (NetWire)", "value": "e3cdf4e912503638d5b738447cf025ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635934586, "uuid": "cc076f80-922e-4c74-8df0-487c38a95e2b", "comment": "Malware payload (NetWire)", "value": "77256dbd8c0a417df262ad441056cc29c4ee5a70a9005b2fa4f32efbec768083", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635934586, "uuid": "273a39e7-a0e1-4586-a270-bac4cfece9fd", "comment": "Malware payload (NetWire)", "value": "b4eeda6860e62ff4cb48184d1312df126a40aee8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635934586, "uuid": "68a8fe65-06cf-438f-baa8-c35989bb9a8c", "comment": "Malware payload (NetWire)", "value": "300c56242879f0661c6568622f63b517244e7d82064379f2fe233ab75dde43f28d5bfa1804e3e8c278b002b5b7663e2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635934586, "uuid": "a464ed0d-b63c-4ccc-a764-8a61ed4564f4", "value": "T126D49D27AAC16116CE3589BC94544A307360DC7FB9E0B316ADE4FD8B3E7AB518C431A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635934586, "uuid": "57486c7d-2cc4-4c2d-a78e-beb16b9d5915", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635934586, "uuid": "c4b92a43-19be-44e1-93ce-a9509ef19155", "value": "12288:X9ELuVoE06YLibFEnIJdoUnB6FmpaebjrTlPF:X9ELfW0IJuukIpaknTD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635934586, "uuid": "bc5a1413-7041-4ef1-8957-daab83b8680c", "value": 613376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635934586, "uuid": "9d2cec88-db52-46bb-91d9-991f81a87e81", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635934586, "uuid": "e00c138d-4e3b-42fa-b7ed-b930b1d97371", "value": "3wLErjZm74CL9UB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "721a859b-3cb5-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1635951054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635951054, "uuid": "6355d8ee-593b-4dd6-9afa-8d64fe1d4617", "comment": "Malware payload (Dridex)", "value": "d09a5abe523dce433ad0553cea737472", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635951054, "uuid": "a436f587-3efe-4f00-8aa3-92e2e0e5529c", "comment": "Malware payload (Dridex)", "value": "77d993afc94b7c57c27d5da9a2f25e051f0fed6bcf38745c49a60dc6748accae", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635951054, "uuid": "6a04045d-adcc-4923-94be-c65e0fced809", "comment": "Malware payload (Dridex)", "value": "1017879fdd4afd7bc798ec92905d1743de77331a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635951054, "uuid": "e049ade9-6395-4923-acca-91ac7b9814f3", "comment": "Malware payload (Dridex)", "value": "251fc3d921d83d57098002782a846932c5b15bf99c232ee529cf21bf561b8124a79e98f705bd874386e013fb9b85a451", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635951054, "uuid": "2d45845a-d14c-418b-80b9-04eaf9e10893", "value": "T16973F19CC799E444C2629EBDCE2688D5D2471D933489575B285AB70C7EEB7030FDB0D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635951054, "uuid": "b293dd3d-37e8-4240-8de2-ba6c6ed398f2", "value": "1536:8CWqAPuALLImemeKHqeK7YncvSlTZ4l69oUDy1ItPPY2GqCXsxgXQ7sy:83a80XKUYUCOUmCPwJtXqsy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635951054, "uuid": "16c6515d-3cc2-4441-bfb4-3e7ae2ee47cb", "value": 77382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635951054, "uuid": "79dceeb9-d693-41b3-8506-fadd07d7db6b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635951054, "uuid": "ea928018-69af-4f08-947f-34dbc515e80e", "value": "Invoice-000124.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6379b038-3cdb-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635967350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967350, "uuid": "3b5322be-7a5e-4bd4-9cea-6aa91c99d3e5", "comment": "Malware payload (Loki)", "value": "52342ae7d49b660fb711cd9736049963", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967350, "uuid": "4181b8a1-a013-4c76-8d6c-33a2e71e2fa4", "comment": "Malware payload (Loki)", "value": "78275c4299a8959d17cf695e4e4cebf40a993a487b9ceba5fb51fd1108b5c55c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967350, "uuid": "5272bacf-d44d-40f8-b3bd-51da1b56a994", "comment": "Malware payload (Loki)", "value": "8120b100725cf49660895f09a8b7973931a6a45a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967350, "uuid": "ebb4fd93-4cc1-48ab-8a94-0e5906b8ff89", "comment": "Malware payload (Loki)", "value": "09a626233701a0e68ecb5322cc84cdcbb20652fd5744e0fd290c80be5d191f33401a330214d34ba080656f4d1ce5c587", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967350, "uuid": "10fbc9c8-8d2d-4e61-9f08-54fa5b7178b9", "value": "T112F42720B35D49C9CAFC3734CF25D1B017A16C6E2A10CA5924F43DFBBABC61766316A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967350, "uuid": "14c6a4f3-528f-4bb5-a556-4648d5a628bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967350, "uuid": "eabb0ec7-ab9a-4d1f-a03f-f1e5b73a709a", "value": "12288:kixp4CTXYny5b7vdTpWyUBSA1SyuF7EzqZyJjLTGg0:nWXOl/A1SyuNNZyl6g0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635967350, "uuid": "858decbe-81b8-4e44-89ed-01c27b0159d5", "value": 736768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635967350, "uuid": "8d6229f7-a7dd-4061-b5d9-6e881367fa84", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967350, "uuid": "e22b6398-2868-4289-94ee-e818bb60bf6e", "value": "52342ae7d49b660fb711cd9736049963.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e32ad78-3c9d-11ec-843c-42010a9c0014", "comment": "Malware payload (NetWire)", "timestamp": 1635940605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635940605, "uuid": "0af6b24c-8135-4ef9-a2e8-b37b233f8fa8", "comment": "Malware payload (NetWire)", "value": "1d05fd9ec9fc3a307e3a2f2a1219bd11", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635940605, "uuid": "e778fcef-560c-4d71-8034-3c7d08bfd29e", "comment": "Malware payload (NetWire)", "value": "7841a664c5fa7620bed79851ea47c6f9a2d3e76cbe14343efd220e067be91e3e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635940605, "uuid": "79d29035-2470-4b54-9ce8-5f3823c06773", "comment": "Malware payload (NetWire)", "value": "78b4595cd2152e402d2830359c653df810f41ffa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635940605, "uuid": "389d64bc-f10b-4ca8-bbcd-8bb27e46f366", "comment": "Malware payload (NetWire)", "value": "2e20a7e276411fb97f0b68d5f1a9df36f4cea4941f737aa09e9d2618267eac5a17c4e7c8cd925c8d72dc56df2e74e482", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635940605, "uuid": "d59307fc-4bf4-48e0-bf39-de8a2afc918d", "value": "T14F45813134E8748DE9D6883044DC2C621D5AF9733D9AF15A90D3AC4CD47A087AEAEE77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635940605, "uuid": "d684b512-d6dc-4d77-9e29-826f312fbe3f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635940605, "uuid": "fd5debd2-7513-4d73-917e-57a395032631", "value": "12288:yfQIiNeoLRvqUt9bRZ9bRoqJFTPhOVYKVylolEsF6oLknlhdSWmafbR:jIiNeo1vqutDtoqg5oTt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635940605, "uuid": "6b7acc08-4969-4e9a-b8ec-8c32a6d67013", "value": 1171968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635940605, "uuid": "4293a8ef-1b7a-4adf-b88f-4ae66401f84b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635940605, "uuid": "a8799708-8fe6-4f3e-ac1d-6914408ddb1c", "value": "1d05fd9ec9fc3a307e3a2f2a1219bd11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce2fb0ff-3ce1-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1635970106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970106, "uuid": "83407eb5-fa15-44fb-94e2-786aff4a628d", "comment": "Malware payload (Dridex)", "value": "2943602f424191b0700622c105c529f3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970106, "uuid": "c2dc6606-13d5-4936-8e5f-b0d5f30c064a", "comment": "Malware payload (Dridex)", "value": "7882a7c0f187ad6bd0a44429abf596b505884f07f23b8a438e2f7f0d5aa12240", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970106, "uuid": "fd8da60c-1210-40de-a7fc-f2f770e54574", "comment": "Malware payload (Dridex)", "value": "872e63efec6800a3f49cfb2337aef2c82faee348", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970106, "uuid": "9c246755-4718-4fc8-9df1-569d2e70a083", "comment": "Malware payload (Dridex)", "value": "584f78618215e39f70c559826d72f1a9da1f260d13458188709969d50b7e8fb916530052df0f6b7f9bcb4fc504b575de", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970106, "uuid": "105edd5d-5b78-4475-ac34-2771c4903a53", "value": "T18583021D85EB38A1D271EF3C870DACF6649B37249D02664B20996EDC87A94936F8F143", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970106, "uuid": "a24d80cc-8b4a-4e31-b796-8f06bb663a8a", "value": "1536:8CWMPrX6Q3cWViBN3yKqxyeHw3vRMgF3oKy5hwWGl5CzZbHr9JSHTt5g5ue:838qmc3/q0dfaguKywLbYbHr9J2jFe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635970106, "uuid": "f38f3492-a488-49c9-b006-4e4ab99da223", "value": 85441, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635970106, "uuid": "0739c749-ea69-48da-879f-685cdf4fe2c3", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970106, "uuid": "49bb1c51-052e-4e7b-8bc5-9ae510e58a55", "value": "Invoice.0701.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5412d9d8-3cd8-11ec-843c-42010a9c0014", "comment": "Malware payload (GCleaner)", "timestamp": 1635966036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966036, "uuid": "78c3a494-ea38-40e8-9474-b5971c713659", "comment": "Malware payload (GCleaner)", "value": "8ac9ae1dd3a33406003c4456359a9db4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966036, "uuid": "5253e00a-bc9d-4a96-b230-a910ff3e7151", "comment": "Malware payload (GCleaner)", "value": "7890f85114dba72bfafa6dd4cca59d2ac030458e32136c3a5ce992469cc353bc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966036, "uuid": "aa229b4f-2139-44bc-8f32-a41cdf187271", "comment": "Malware payload (GCleaner)", "value": "d3f8091bb8ed8946cb5f7143875174a70f147c94", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966036, "uuid": "151bf4a1-80ee-4831-a5fb-a5e23d55b7d3", "comment": "Malware payload (GCleaner)", "value": "0db45f5a50c706b484511f57083bf4f6c921552056c191e8b35d6df0acf5b2b4df66a6818a40598e79f657ceecc24786", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966036, "uuid": "cd03ca8e-3906-4bff-b770-c32cf65d33d1", "value": "T188043B386352B436E4F30439A5ED97F494687A3057948CEBB7854F2E0B7A6C2D630B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966036, "uuid": "d1edc692-f2d2-4104-9647-9216a429a2a0", "value": "2c02c1999142edb52caad79376c81ce6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966036, "uuid": "416dad7a-b8f1-4dac-820e-e275eb4c83ca", "value": "3072:DRt67jtKBIKViaBNa1wK9BOomGbV3gWph+l5/yyvcOGkXthDBzBAXL+laxX19551:+kBKia6QBOaV3PgNyyvcOGkXTDBzySlP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635966036, "uuid": "6e92a9b4-9210-4b3e-95a7-cd06c69b0c39", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635966036, "uuid": "bf9c7105-209c-4fba-8a6a-878f8e5e0ff0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966036, "uuid": "ec2e4ce4-dfff-4c80-ba83-790f1da50fda", "value": "8ac9ae1dd3a33406003c4456359a9db4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50a3e71b-3cd2-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1635963453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635963453, "uuid": "e2a7e808-0649-4ab2-a1fc-30531985f2ad", "comment": "Malware payload (Dridex)", "value": "58cf4e0a9e9bb52fe87c150763c7d87b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635963453, "uuid": "1cea7228-d80f-4b00-bf15-2423d24ed225", "comment": "Malware payload (Dridex)", "value": "78c35ee9f8d5a846187ea9c7c3207601843cd11bbd266f0325d79cf167925f06", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635963453, "uuid": "7d889447-3fb5-44a5-aa80-ee93a0b17a39", "comment": "Malware payload (Dridex)", "value": "f66d0f8b9f9cee01fe155fa76ed0e6593a23c23d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635963453, "uuid": "2e0cde70-814d-45ec-a40c-8f878a877974", "comment": "Malware payload (Dridex)", "value": "82ad8a64619118eaf162423fd080a395dc4381fefb1164084866f84a3c986bf4a3ba0994f34bc869bf6b67e6597e6a4d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635963453, "uuid": "d151aacc-171e-4af0-9403-b4caff8c9ab6", "value": "T1E693024D96613994D6A3EF394F082CF3A91631558D2457CB148DFE5CCA3A097AFCF20A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635963453, "uuid": "a64c0781-badb-49f2-968d-797387535632", "value": "1536:8CWaPrX6Q3cWViBN3yKqxyeHw3vRMgF3oKy5hDj+oUHVd2Rif7Etqa/+J4fypCrc:83iqmc3/q0dfaguKyD/U1X2qdJ4fgCKP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635963453, "uuid": "b5e4b4c0-754f-494c-9af7-fca0fdb15019", "value": 96933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635963453, "uuid": "1ca4eb2b-3540-4abf-8d11-010ed9d95d04", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635963453, "uuid": "27f6209c-32a5-4052-8de2-1fd820c587bb", "value": "inv-5598.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2592e7d6-3c78-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635924726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635924726, "uuid": "66b21bb7-bf15-4678-83db-30693f581880", "comment": "Malware payload (AgentTesla)", "value": "715db23f0d3aac9235d15a1d752ac1c0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635924726, "uuid": "4f171801-b5c1-4f6b-a0cb-d9e2de8221ae", "comment": "Malware payload (AgentTesla)", "value": "78fb78e6a87abfde698db1c31b602de956d26f2d3c500eba1d0b523a87efd8ad", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635924726, "uuid": "8f2b34d6-b246-4d2a-adfa-4886382514dc", "comment": "Malware payload (AgentTesla)", "value": "d9844700741632dbeb6683da235b22787ba17f8f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635924726, "uuid": "6ee9bd8d-db14-4dd5-8b89-af32c213d64c", "comment": "Malware payload (AgentTesla)", "value": "6bd9c2ed6bb6888a3e34bdaaa7ec7a0d5249880e3173d355729265edc6bb24ec6097496c2317357ba4c286a24218db09", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635924726, "uuid": "838a7174-5c9f-4877-bdf3-6d99661e3e7a", "value": "T14D45803534E8748CE9D6483044DC2C621D5AF9733D8AF15A94D3AC4CD47A087AEAEE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635924726, "uuid": "276908ca-9053-41a1-bda4-e95c29d433d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635924726, "uuid": "d30d946e-7144-469a-97d5-90bc45f401c6", "value": "12288:gVCm8W4zhhgQ9bRb9bRaqJFTPeDqvmbLEPKSBZVD3rfCwQFbnL3U0YqdgYfjzT92:qCm8W4l+YtRtaqiUPKSVCn7mXt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635924726, "uuid": "e7bb75e1-fa1b-4e6e-8a1e-9c8c99a9681d", "value": 1199616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635924726, "uuid": "8d9ac6c0-b633-470b-8243-5887da9373dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635924726, "uuid": "c9402a65-97a8-455f-b1e2-1ba036da4f73", "value": "QUOTATION FOR SHENZHEN SED INDUSTRY CO., LTD..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1e8b989-3ce1-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635970139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970139, "uuid": "616f8575-00cc-4ecf-8eeb-8a2021433d14", "comment": "Malware payload", "value": "b407a16a0194f3c7a193d9c6cca68e94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970139, "uuid": "c29e86e9-52c0-44ec-8806-1fc2aed44b68", "comment": "Malware payload", "value": "792f8085698639794fbcbb4dfdb6c5eb6e9fe022443bd2b2f5a8dd542059e866", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970139, "uuid": "a901ec63-30f3-458b-9215-a9884ac6aa9f", "comment": "Malware payload", "value": "e3d4a512c143238c501e574198d82fcc508d1b18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970139, "uuid": "fb4aa49c-befb-4f90-8560-d1a3db3154ae", "comment": "Malware payload", "value": "fcb84b4c432b556a0d868101655243c31e4a023a3c89c3c098776fcdb5058b04d25aa99a8af8ec2c712bc1c7d43b59af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970139, "uuid": "7d0b4980-018b-4af2-b523-3f7fd50cf59a", "value": "T136424C7A6361DC92D47175B0A06E8AF39A3EB436009D4F13D3905FB60D60381BD6E65E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970139, "uuid": "ee24a69e-332f-420f-a408-efa3e6898480", "value": "192:OWyRxqJaZrFc7gPRSq+LNBEoZolkOJxPHYqVMQKXabDixgPhsob5jbl0o2F53vf8:ExYaZrFGgPwZLNBEoZo/4wKX8DiqWkVL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635970139, "uuid": "0bf506f6-b3e6-423d-8fee-ca4ff118169f", "value": 12063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635970139, "uuid": "004dc8e3-bd0e-4e70-8b54-a38621b5ed8c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970139, "uuid": "b0eb4324-b02d-4ab9-98da-48451ba21ee2", "value": "b407a16a0194f3c7a193d9c6cca68e94.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbd882f7-3cbf-11ec-843c-42010a9c0014", "comment": "Malware payload (Hancitor)", "timestamp": 1635955580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635955580, "uuid": "8387640d-66a8-4d1a-ac0c-21830d5e8b12", "comment": "Malware payload (Hancitor)", "value": "3247dab6d560e5cf05bbe610c3f92da6", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635955580, "uuid": "8acd9cfd-ebec-4f6b-91ef-6690b251b484", "comment": "Malware payload (Hancitor)", "value": "795469e3d20d8b1e85816f14cd122796ca9dfe2947a4c9fe1464d62900f10d52", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635955580, "uuid": "f143efc0-0438-4dce-950a-07e50740faa3", "comment": "Malware payload (Hancitor)", "value": "824cd25d1cc8b8092f90dc6dfc80f867caae49eb", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635955580, "uuid": "41f6dba5-56c9-47dd-84ff-2b81dc6aff4d", "comment": "Malware payload (Hancitor)", "value": "06761ad3b5904f526855767e5635ba49dba9972c2ab6a0e64a3eff59e15b69b65e0a895e636598e1179da9723b49121c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635955580, "uuid": "75ed7ba8-d845-4d7d-8b17-6e161dfde2f3", "value": "T15AC40103F9959F57E51BC3B87E628C696B6DED494B08B3CB10317F0EA7B43609C4264A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635955580, "uuid": "3a22e1c8-151e-4592-8ca8-9eba55e27387", "value": "12288:9V9iQsDr8N+0tEILt/5J0RiCFNpQU0cze:9VXkr8NfnLl08CDkcS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635955580, "uuid": "21efaf7f-d5d9-4d79-9e0d-4e58e6932e2b", "value": 589312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635955580, "uuid": "c8acefb1-0fcf-409d-8767-dbee9d544b29", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635955580, "uuid": "f887dee8-0988-4355-97df-62a5ae4f9e3d", "value": "1103_2096072643613.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eb94834-3c48-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635904206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635904206, "uuid": "fbbc80f4-4f3f-45b2-9c61-94920ab376a6", "comment": "Malware payload (Mirai)", "value": "3bb158e213fb8f08f3bf5a22eddb7d2b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635904206, "uuid": "e19ac563-63ad-4d55-ad19-396d727c4519", "comment": "Malware payload (Mirai)", "value": "79c14d3ef51e30abeac4bb0ac5d913689afeb52e189cf571688236b5420b0733", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635904206, "uuid": "b486bc20-d067-4827-beba-4e25bee511f4", "comment": "Malware payload (Mirai)", "value": "adfd3a478d1bd2b337f0325f21d3789de6dbcdf5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635904206, "uuid": "08ea686f-179f-4fe2-9a53-98b5565576a9", "comment": "Malware payload (Mirai)", "value": "5fb06bd0f0af8a3a8c1caff83924cd32b3dab9cf775927eb64231751159c6d53ce44e81b78a4fc9681b840c73413475c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635904206, "uuid": "88711168-1a38-46de-aecd-dca19030ae80", "value": "T18AB2D0B27015B8B3C7E100B79AEDCA83FB801EF8D0E873255465199DEAD5943BAF1147", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635904206, "uuid": "5b7a8ebd-08ad-4bd1-9ceb-61eaf46f2ad4", "value": "384:cZ0X9nxn8o9ir/nSdoijsN2e4JQkCD2EjKb3pbWhymdGUop5hl:5X9nxn8o9wnBoWzEQf2EjKb3pKs3Uozr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635904206, "uuid": "b1c6cccf-cc19-44d3-b7c4-4b3545e9d991", "value": 25004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635904206, "uuid": "894fa06e-07ef-4ff6-9357-e641cff04dd0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635904206, "uuid": "f623b436-dfd9-43c6-8d7e-d831c096bbbe", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fe397aa-3ce2-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1635970404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970404, "uuid": "be6210cf-016b-42e8-a7b2-67bfa0188548", "comment": "Malware payload (Dridex)", "value": "36a60a5aaf5fc521351ce68ad8491425", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970404, "uuid": "ba22365c-9f59-42d0-be81-0b924a4486e7", "comment": "Malware payload (Dridex)", "value": "7a12ee49d2fc7090bed511933372f4eede1b4df5b63c376b74cfde1b5e6f5c26", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970404, "uuid": "a58d0397-f551-48d9-9a2e-a37487c7f5c1", "comment": "Malware payload (Dridex)", "value": "eb8e8354812d5db2078311b907d61602ba44a9e9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970404, "uuid": "e1d1efd0-1e7a-49ac-8325-a61543822d40", "comment": "Malware payload (Dridex)", "value": "8d43cc8803b895e0a3afed7c6c0d4f793753b5c94583cfe192fe0c2d676c793f62efc387ad5f1f58423efe7ef640c2dc", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970404, "uuid": "a072a657-97d2-4f8f-b3ac-2af7487b0131", "value": "T1B183020B475A789AD5B7867C81295DD3341F831CFC60E6993978BA0CB4F02D7239A36D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970404, "uuid": "b44058ce-ccb8-42a1-b610-f985bf9cac08", "value": "1536:8CW3PqrE3gpMokPF58Ik4kosQFVvSuMHdRXslyDlK+V5x6NGBLc:83aEwFkd58IXkOFVvMHwyDlJ/x6NGBLc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635970404, "uuid": "ead4a1bb-dbd7-49a4-bb49-e7f9ae857ac6", "value": 85767, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635970404, "uuid": "aefe7c84-2d7c-46fa-a553-f8496adab8f0", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970404, "uuid": "22f82d34-75cd-43be-8f4b-b2596342ba9b", "value": "INV_534033.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee4ece41-3c9e-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635941384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941384, "uuid": "13ceb4db-9245-44b2-b620-5547567c85aa", "comment": "Malware payload", "value": "581d55c731a4f3fccde704467a9d4a42", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941384, "uuid": "afa44b58-d59d-4e3a-9a3a-8d6bb3dbb84b", "comment": "Malware payload", "value": "7af7c46d7bd5e9a82af147e8f018f93291bd45a33e76b5bb4c7d2065fbd50d41", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941384, "uuid": "51cdb884-fd53-4de4-a1db-e38d78705984", "comment": "Malware payload", "value": "100160a1f04448d5b120c45a99d0f970d914d10c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941384, "uuid": "df3fe6a3-2304-4ca8-8e38-7b6763698cb4", "comment": "Malware payload", "value": "88b6c80ec4f27f852ffba465ef900b5f306362ac0e50a5113f999c80e1f6fa0dbcbca99e3c674c34e51a28f67ebf890b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941384, "uuid": "ba520e84-0f98-4646-8674-e289c34d4a68", "value": "T10975D0C81312F769C2F1D5D7582735F473147E8AA0C09961FEACE680AB0612E49EFED6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941384, "uuid": "0b72c5e8-0aea-4ab3-bf98-8ea681354059", "value": "24576:48NwtUV8NwtUR8NwtUJ8NwtUV8NwtUR8NwtULU3:IQEMQEH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635941384, "uuid": "4121988e-9122-491a-8cd6-ece23640e08c", "value": 1622731, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635941384, "uuid": "3bb96710-ee41-40ec-86cc-465cc5b1ed54", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941384, "uuid": "ba79d0db-a8dd-4398-9273-4f64d67306fe", "value": "invoicepayment.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c91a373-3c6e-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635920470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635920470, "uuid": "0a0439ed-097b-4449-be7f-b486e2b89a39", "comment": "Malware payload (AgentTesla)", "value": "753d741db17c94d3558ca47d672a6be6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635920470, "uuid": "ead3f9c6-f939-47af-bd31-f22e2743cd02", "comment": "Malware payload (AgentTesla)", "value": "7ba13041634ab54936a1a14fba6bd01bb1b83f9a8d6bae62be3b2f197e1025af", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635920470, "uuid": "d1ee5010-94b6-46d8-ae96-2eb4fbac2792", "comment": "Malware payload (AgentTesla)", "value": "9a444279cde6c630691c1111ec61cdd2834f8e0e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635920470, "uuid": "12be890e-2e18-488f-8625-50f21498bd35", "comment": "Malware payload (AgentTesla)", "value": "15e186ad6418d7190d73dc49b4aa4b1dfbdf8b53b97821b23ff9d57a8163b24da9d07c06b52c40926adac7739227ca3e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635920470, "uuid": "866dede7-8ce7-42a4-b616-73332e66491a", "value": "T1F2055820B35D49C9CAFC3734CF25D1B017A16C6E2A10CA5924F43DFBBABD61366316A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635920470, "uuid": "469ea613-df0d-4b68-ba96-cf10de01381b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635920470, "uuid": "49c2a5b3-32fc-4a7c-80c4-b9620e908e7a", "value": "12288:Lt5YvmrZ5w1KVaTNZcnT94n0muVvRVAi5j01YyuF7EzqZkJtLTex0:28Z5w1KdnKnWRRP5j01YyuNNZkHSx0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635920470, "uuid": "1230925a-1361-49f6-9d89-e0f1dfdf4a41", "value": 857088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635920470, "uuid": "420711bb-7af1-4772-bba6-85de3f33d3b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635920470, "uuid": "7bb8511f-0538-491e-ae5b-477a988cab75", "value": "siwfft copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8e13bc4-3c9b-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635940113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635940113, "uuid": "c5094d75-dce2-469f-8044-6e3cd9337efc", "comment": "Malware payload (Mirai)", "value": "c8fa6c399affc70443579b6e9c992b1e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635940113, "uuid": "ddffbb12-5aa6-4df7-bc63-567e7482a841", "comment": "Malware payload (Mirai)", "value": "7e1fd8989b0f786efab4da8f3ceae76c816ab15635617bb17597d82dc6e5b144", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635940113, "uuid": "8f2bb1cd-fb10-443d-a266-d171ce1c92ce", "comment": "Malware payload (Mirai)", "value": "7d9648fad712e1d59cd81872f4e53f672ba7312e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635940113, "uuid": "2f0e9fad-8158-4d5c-a131-7e61a37d329d", "comment": "Malware payload (Mirai)", "value": "15f0573562f1e7c9bd9e1d4cfdf2255fdf396de6d6718de3ee55d08234278499070db542a2be57c7583cb556e62cc5a9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635940113, "uuid": "dbc3dff9-252e-4c4f-a6a2-ebc47e2cbdf4", "value": "T151334BC5AB93DCF8ED1506713177EB328B77F03A612ADAD7C3899523A842B01E50729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635940113, "uuid": "05a04324-0838-45dd-bdac-4e1a6d0b0f0b", "value": "1536:3hSgebzgP/AY+39afOsMJRdnhNJ6OQ6xpwhNbr/a:xZebkP/Ad39UMJRlhNkL6bIbDa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635940113, "uuid": "dccdd3bf-a372-4a0c-a3c5-2188468bdd5b", "value": 50608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635940113, "uuid": "8f6bf4f8-3e5c-4b19-803c-852fa86e509e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635940113, "uuid": "15ef8041-4012-43ec-a9d9-32fa6fbcff78", "value": "c8fa6c399affc70443579b6e9c992b1e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3b8c1c8-3c77-11ec-843c-42010a9c0014", "comment": "Malware payload (GCleaner)", "timestamp": 1635924642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635924642, "uuid": "4d39bab8-623f-4417-9365-ded61a90d4d7", "comment": "Malware payload (GCleaner)", "value": "4764f9b40705bb7d0d289ccee9f7a624", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635924642, "uuid": "cdf343eb-4c5f-49b3-8a6c-43b7f1c520e5", "comment": "Malware payload (GCleaner)", "value": "7eb5766aa9e75faf7278aa47a384ed06a6ef57f146c1368edea799ed50562202", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635924642, "uuid": "be096048-60d5-48aa-87d6-8ed0accac7be", "comment": "Malware payload (GCleaner)", "value": "b7d0191ae4a3086c0a53440678412903a01a14e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635924642, "uuid": "9452bed1-c020-4568-b116-5108b9fdcb71", "comment": "Malware payload (GCleaner)", "value": "db575e4f52567983484ab8cd4dee0ea116039e44481027896bda8f2b656fcc8a76e82c5735662968890b0ee0360d6533", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635924642, "uuid": "a0285c84-a66b-4cf0-9c7c-09e0684dd28c", "value": "T1A4F402D4B040C0E5D4616733A8E184DC662ABD57BE6F973620DD3A8EA63224C71773BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635924642, "uuid": "cd2e245f-a608-4adb-bcfd-7158eb4362c0", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635924642, "uuid": "70c2d15e-7b33-40fb-aa1e-6dc88b261662", "value": "6144:d/QiQXCgVD5m+ksmpk3U9j0IK3lsoxvjFEOTb9WmZX/8shzdsY4CpHPhniZVf:VQi3ADc6m6UR0I+p1hf39Wkv8xwJGf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635924642, "uuid": "7aef0cf8-e64a-43c8-b3a3-4dfa16bc9d14", "value": 762006, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635924642, "uuid": "6e4e8e36-5447-427d-9735-c29d72ded7f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635924642, "uuid": "5dcc3a3e-f5fe-42f1-90fe-b348930671a7", "value": "4764f9b40705bb7d0d289ccee9f7a624.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32be3abe-3c5c-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1635912722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635912722, "uuid": "490365a4-9f57-4796-8211-a713f7799c44", "comment": "Malware payload (Dridex)", "value": "8b9e911d4831bfd98a22c9ebcefe4248", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635912722, "uuid": "c500c8f4-56b2-4f14-8efc-04a928edd97e", "comment": "Malware payload (Dridex)", "value": "7fbd517af91c4f1f9d15a887ba82e1f45cbb29eb7e2e0ca767e143b7469d1fd2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635912722, "uuid": "20ad34a4-8d6d-48c5-a291-e99dfe518f8a", "comment": "Malware payload (Dridex)", "value": "f42ed615be2f91f5c28616500593e039596d18f4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635912722, "uuid": "3a082b5f-bbba-490d-820c-a34b9a251c41", "comment": "Malware payload (Dridex)", "value": "95e8f0a61617c5edb00269def8bff44df2e4897cc81cb7765670a514449f5b1d886803a2390835f24de4a7db4c1f96cc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635912722, "uuid": "d6f3e80d-9e08-450b-9138-cb5e53ba47d0", "value": "T157A4AE94FAEE40B8E5187A74C4DB19A56E821E24C4AB1615F4587F0E4E338F3970FA73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635912722, "uuid": "ac87c284-c3f7-4f61-a6de-85906181cc37", "value": "c6e29838e1e1c81859cd162bf701404b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635912722, "uuid": "2b06ba16-a7c9-4916-a247-05e958e977e9", "value": "12288:eGw8ObmVk9gbUngly9sp+ROx8ufNX/7vuZU/4BLl2io:erxC+mggkqIwG4X/7vuZ44Zl2io", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635912722, "uuid": "29b8c417-4708-4a8b-950d-7a975984c6dd", "value": 462848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635912722, "uuid": "0e732725-ffc9-4f60-9b6c-38efd9a41fb7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635912722, "uuid": "bb61547d-20f8-46b1-a5df-29cf7253fe02", "value": "SecuriteInfo.com.Suspicious.Win32.Save.a.15621.17006", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8507606-3cf2-11ec-843c-42010a9c0014", "comment": "Malware payload (Tofsee)", "timestamp": 1635977451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635977451, "uuid": "52fabae0-105e-4266-b9e6-54166d071f08", "comment": "Malware payload (Tofsee)", "value": "39e1159d12d2f3922c834fc67d0b4489", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635977451, "uuid": "b679421e-b671-4fec-a8ec-0a3a5ba577bd", "comment": "Malware payload (Tofsee)", "value": "80595d56327a6ffb7dca8f6e07f3ba6889733165ab17ed3ea092f9a5d64e66a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635977451, "uuid": "1bc57091-c848-48b3-8567-23855b2015a6", "comment": "Malware payload (Tofsee)", "value": "e56f34ae6939c962ba439e58eab9667511cacafc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635977451, "uuid": "f54ed729-979b-48db-8b9d-63e819656dcd", "comment": "Malware payload (Tofsee)", "value": "85c0b6cc05373a628d066b177c189bd5ba5713d0ce3ec8a6863ec05b4bb7e1cdc22dbaa918f5b72e56c4680ef8852a27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635977451, "uuid": "9ac1d479-776a-497d-a821-dea1646c3e24", "value": "T192548D00A7A1C035F4B212F849B6A369B93F7AA16B7894DF13D517EE4674AE0EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635977451, "uuid": "50aa2225-9d9f-4ba8-b059-df60315bcf9a", "value": "8a60cb5b452f4bdbf9698ee60f40d39c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635977451, "uuid": "e48f7c97-5035-4e6b-ba73-a87c0217f0c4", "value": "6144:zPDdw8EHpjSdofA0APmVWxy8IYcSWm8euOfqaa4:zrjEJgoffAUGy8IYcSWm86vN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635977451, "uuid": "a0706c62-7b65-42d1-a2de-7b6e70352693", "value": 298496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635977451, "uuid": "666cc851-8026-4aa5-bc41-9b7ef207c326", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635977451, "uuid": "724475b7-5e03-4957-aa1e-8127490f3465", "value": "39e1159d12d2f3922c834fc67d0b4489.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d34c8ef4-3c91-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1635935755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635935755, "uuid": "7700ce5d-d69c-4709-88e6-5998e28548f9", "comment": "Malware payload (RemcosRAT)", "value": "61f8f69ce910d811c6bee7d068561b97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635935755, "uuid": "e78eb208-0f34-4c3a-9dc9-58c28d1acbe7", "comment": "Malware payload (RemcosRAT)", "value": "8092efe07b8ea30e06c824d673824d1bdc867d6dc66ac83024256ca8620b2cc9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635935755, "uuid": "c5ba9656-cad1-4a43-922f-d1081014cf78", "comment": "Malware payload (RemcosRAT)", "value": "7363779b4c458b32a9ba1699346e6e50653f35b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635935755, "uuid": "567d87cd-8f48-45cf-a312-4c6a6c698a13", "comment": "Malware payload (RemcosRAT)", "value": "3087cdb453c52b5825caea59095e981bacd4b67f98b712a84d1d36c25ef8c7564b9ad65a2886e266d6367155fd0c4fae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635935755, "uuid": "909e5070-2451-46eb-8a28-2c41de11b328", "value": "T14A157DA6F1C0A376D1273FB98D079ADE28D9BF412814544BEBED3F0ACA306D63525853", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635935755, "uuid": "76bf6a88-cd21-4b10-8743-de80aa9f28fc", "value": "3513b15d2020b37cf2b66a761c75ed57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635935755, "uuid": "40c6841f-2ea0-49bb-80da-605469b8e261", "value": "12288:WxBZN9xp6/Yo9sSbJ+RLbKvOS9cr9BE6ZyxDcC6CoueU:WF/C/N+1KWS49xy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635935755, "uuid": "af407089-6bbb-4d16-9877-69b74e6d1b10", "value": 887296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635935755, "uuid": "d6f89daa-1948-48cc-a13e-1be1c5000b11", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635935755, "uuid": "3dd3c592-0298-45b5-a3c2-785bfaa3d29c", "value": "Ziraat Bankasi Swift Mesaji,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee8ef2f3-3c4b-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1635905736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905736, "uuid": "a5114cbc-946a-41d0-aa0f-e83db4a696d0", "comment": "Malware payload (RemcosRAT)", "value": "a8c3df8966b579fa7da0c27e3dbb0cde", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905736, "uuid": "c455ef92-a187-4216-b572-f2fb00945113", "comment": "Malware payload (RemcosRAT)", "value": "809848407af2f6ed9a66c96b184a49bcf88496a70d7c200e534739ceb23b97de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905736, "uuid": "e944b6b8-b9d8-44b0-9708-f574208b905b", "comment": "Malware payload (RemcosRAT)", "value": "705dc6827f02420d1ba9b1fea3c07fbc967cdf7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905736, "uuid": "73df87f5-54d1-45bf-9dd0-b6af03c5cdcd", "comment": "Malware payload (RemcosRAT)", "value": "358b48a3b79eba166cedb889ac95378b605b7725ed52d7988f19d1a261149c754dfb746acecc7f46bbad08482d8d7c77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905736, "uuid": "481dd553-8e28-4fd5-b7f3-863851fe52f6", "value": "T112154A56E410CA22D856363884AF9B1862757FA120314845DDAB3F5ACEF73823CF5DEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905736, "uuid": "78015f94-81a3-4a75-82b7-b3ebedf98bf5", "value": "8daf0b024930cce1318dd6208076cf0a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905736, "uuid": "d969d274-4eca-47f0-b793-9a7ff89cde23", "value": "6144:xZEcZy5taWXTZBSG5fB/i/goaOeD32RFbLCdF9ae8FvSxUjewQhM4kqlPyn+sP3:P857TZBpL5jeFWFQeYjdGdkAPy/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635905736, "uuid": "eb702e1a-10f5-478a-a883-b0b4a06361e7", "value": 940032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635905736, "uuid": "cb49f452-de16-4d9a-afd4-30fc88e86c7f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905736, "uuid": "56eb0477-ef4f-445d-9a4c-866a0ac298f7", "value": "Product Inquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6c7d247-3ca0-11ec-843c-42010a9c0014", "comment": "Malware payload (Kimsuky)", "timestamp": 1635942123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942123, "uuid": "2957a341-c85f-4f1a-b2b7-a880c807cd76", "comment": "Malware payload (Kimsuky)", "value": "5f38c57f83ee5d682ddf692442204fba", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942123, "uuid": "0e16cd49-452d-4923-bc39-660fcc9ef7b1", "comment": "Malware payload (Kimsuky)", "value": "80b1d58755587a0e3287aa11ce472bc657ddc4b5a11ab7347ad058644db9973f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942123, "uuid": "6c16b1c3-b0e2-492d-84ee-e26cbfc723be", "comment": "Malware payload (Kimsuky)", "value": "1b3d164f6793c11cc7283d78fa7fb08fc7a95d01", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942123, "uuid": "b604b8e7-f040-4991-af4e-bb80e8712f64", "comment": "Malware payload (Kimsuky)", "value": "7952cecbfba8ce647b1892b5591b21c2b16cb8c9d8a591a9c43eeca97558cad79581d41690b52b423397fbbf68de2de0", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942123, "uuid": "6deafa14-02da-4aa2-bdc7-81b585b7d6d3", "value": "T142042317C12F7C5BF3775FF8900601A0524A94C98017782D56E9E750B653A2BBBF1E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942123, "uuid": "bc8bb5f3-daa2-4428-b38a-9d09fdf81af6", "value": "3072:dzWeqi247p3GTp84kL7CBWZpivYHKmHICjC918rgabWcW+32svwhaN8cD7Rrhd+R:J7jf7k9FuO0QYquHjk6ecW+3JI+8u1rq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635942123, "uuid": "642e3bed-5156-4577-81fb-b559a88c37e5", "value": 186305, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635942123, "uuid": "1d8a9827-9579-4758-b05c-e89579e361b0", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942123, "uuid": "67f82462-9410-4e15-b562-d4c3aee8e204", "value": "80b1d58755587a0e3287aa11ce472bc657ddc4b5a11ab7347ad058644db9973f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a664fe88-3cae-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635948135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635948135, "uuid": "f47e0ff6-68c6-4d20-ba51-7b88bdbe33bb", "comment": "Malware payload (Formbook)", "value": "9223284380593e45f80f1f79e939583f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635948135, "uuid": "a3361bb4-b75b-4776-971c-3b8fa7fc448d", "comment": "Malware payload (Formbook)", "value": "811d4584b7946f3f5389154abe46c79a8882bdac394fc05b70444ba5e83f691d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635948135, "uuid": "b5603923-c3a0-49ac-950c-bf3123900bd0", "comment": "Malware payload (Formbook)", "value": "e7feff09279d2eab5c40b57cc71f76c06214915c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635948135, "uuid": "ea7f9aa3-d640-423f-ab7a-d7bff09307f5", "comment": "Malware payload (Formbook)", "value": "41b5a19ed5a104b8985bea9bf587b8694c2b77c79f8e65854e8aa4420029f55a2f57b278ba9849d42605c1c8504558a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635948135, "uuid": "7f38864b-e1ec-4d1e-857e-69b8aabd6e32", "value": "T1A8F4F8082201C147D6D43970CF69EFF013516E6DB512C76B68E43E1BFAFDB9B0A126A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635948135, "uuid": "21209ca0-07fc-4691-bccf-bd95cea21109", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635948135, "uuid": "7ccf968a-b080-4ff0-af16-8ee539ae6a55", "value": "6144:bl2Efihkn8Yc1C5u7AchH/qhoJ0Buh1wfzbBvICvcA+oTUlTnwwxItGrKsPE7G:xfc9YmDccJkubQyCvz+yU11OtGr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635948135, "uuid": "8023e12c-d290-4860-bffb-45fb2a0b3293", "value": 762880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635948135, "uuid": "a1eac162-a4c3-48c7-aff7-2db2e072fe33", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635948135, "uuid": "c370f6e7-3d17-47c5-b9c1-ed9543e8ebb0", "value": "INQ No.KP-30-00-PS-PI-INQ-0044.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a68a65fa-3cd8-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635966174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966174, "uuid": "ce747ca1-f5e1-4fdb-82d1-7e853cb25b4c", "comment": "Malware payload (AgentTesla)", "value": "1771927d22ebeb00a94ff16103cc3332", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966174, "uuid": "c0bd6b55-f8a0-4191-8e58-f89358904413", "comment": "Malware payload (AgentTesla)", "value": "8216d817036e23e0aa66db68ee3b9baa73ca924e9c2369ab3fdece50940d8f71", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966174, "uuid": "552ac10a-4c52-41f0-9155-e6fd0f967aae", "comment": "Malware payload (AgentTesla)", "value": "7a16af1c930bf4d0e520c82ec071fc0a9b11a5ee", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966174, "uuid": "c60b8705-afec-4f00-ac33-ced25f69ed23", "comment": "Malware payload (AgentTesla)", "value": "593d18aae669b7d04e62ba3f7f4355cddec28c46a1958c8488b2356c1a58f9c5b82a7b99a84b1634f7853787d9584f8c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966174, "uuid": "3a4da238-721c-47b8-bfbc-af57b0e8e367", "value": "T105640154BAB85B73DA7D43F8286502144770E2272616F3AC6ECC76DFAE2AF404552F83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966174, "uuid": "60a243b1-3647-48bc-ae85-300f76d8d284", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966174, "uuid": "c7f7585e-3b71-4d23-b32c-ce5969a78bd9", "value": "6144:1I2ZNm6r4rtypD5IL9zuuxTTzjDYq3kniYkgrlBRdAmDIFPHylTUcNvN:1Vfv45yjO9z/zY6f+BzAmeS1/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635966174, "uuid": "db2c8481-b1bf-4045-9baa-c665a7ff385e", "value": 312832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635966174, "uuid": "ae59307c-9a12-4296-9189-6d98ee4ae696", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966174, "uuid": "da87eda7-970d-4373-a056-9b83d23389e5", "value": "7IE30kVT7RfAGtr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cfdaa96-3cc7-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1635958803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635958803, "uuid": "220a7091-2d6b-4369-a937-211104f51cd2", "comment": "Malware payload (Dridex)", "value": "600fafbbf77b438cb016d8c2b86e05d2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635958803, "uuid": "fa92bde3-5b93-494e-a456-fb0a7521815f", "comment": "Malware payload (Dridex)", "value": "82de959ab31e38d1deefb3c20dca843bf2b092b5b78c887e60022d5035223974", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635958803, "uuid": "e56666f1-4f7a-4226-b610-f397b1fac15d", "comment": "Malware payload (Dridex)", "value": "1357433144031892b904c6b9e034625092c3582d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635958803, "uuid": "f3c50eb8-5332-42cf-8ddb-98a27e0ab444", "comment": "Malware payload (Dridex)", "value": "8f4cde8ba78ddbcf6d2335eb0d5364f901f0a8d77c363c8acf45fcb2d628a5bc71b6269bad897e856ac50aac8c8d8df3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635958803, "uuid": "48b0d808-4e99-4ba3-b7dd-8cf8be2c24b6", "value": "T15A63F1AE9140F505E311CFBECB3A5CE6D24B4997584DD08A1CDAB21CBEEA3431B7D189", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635958803, "uuid": "3309ce73-2b9d-44fc-813f-936b2fb93c13", "value": "1536:8CW+PuALLImemeKHqeK7YncExYsf1YfOOtedomzLIXCPD:83d80XKUYTxYMY7wd/IXCL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635958803, "uuid": "409813c2-19ff-44f1-94c7-454ad34782cc", "value": 73145, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635958803, "uuid": "c3896637-a052-417c-9ef2-3522db389243", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635958803, "uuid": "909a41ed-374e-4b2d-b111-ae55f7645d69", "value": "Bill 1315.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c937b934-3c72-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635922424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635922424, "uuid": "5dcfda95-39ad-4efe-8ccb-9d595fd389d7", "comment": "Malware payload (AgentTesla)", "value": "d66731659892fb3d5c4196de1c9c608a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635922424, "uuid": "d16e12ca-2ac6-4395-a00c-1dea53b5b957", "comment": "Malware payload (AgentTesla)", "value": "851283e8ec25a70fc79f9a7773180b124d6256face88ed02784942d33ef4c45a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635922424, "uuid": "a96d5311-e3c3-47e8-ac96-297919584e43", "comment": "Malware payload (AgentTesla)", "value": "38415538f9164372cd4b4660989b22f45427a4d8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635922424, "uuid": "9ab14b9f-8c73-403a-960c-ca881f9392b4", "comment": "Malware payload (AgentTesla)", "value": "520f40b42665a3938729310ced4511715c29a3aeb44b4246f5f0a685805aa1f900441ded22f65eb993fef5975b1ccdb7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635922424, "uuid": "83a8e5cf-f5e1-48a4-8caf-6e239d5cdde1", "value": "T14AB423E5478E46AFC981959F6851BB458337A65EF1E3FB360300A81CB838CE9BE55C70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635922424, "uuid": "58746b39-f1ea-460e-b0d2-e280ebcb9867", "value": "12288:RG/fgCSsJ0hHYwlSIzJpGA5HhMa458+o9/F:qhJ0ZYxIFp7BMVo9t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635922424, "uuid": "3b6b21ef-655f-4bc4-9e9e-24a9ddd19741", "value": 523577, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635922424, "uuid": "e92f96d3-b093-4c78-8957-79890ebc10ed", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635922424, "uuid": "cc1ad080-66fe-4032-9154-83943d738f69", "value": "PURCHASE ORDER-228322.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4bdd045-3cd9-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635966654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966654, "uuid": "fecc8384-e4f5-4fde-91ab-78aa3f3a9f5e", "comment": "Malware payload (AgentTesla)", "value": "d1333c8ed1aea34335ce4da2f6821a4f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966654, "uuid": "aacf2779-3012-4886-97cc-2bdd967c7f04", "comment": "Malware payload (AgentTesla)", "value": "85a909013a7a16f5201f7ee7977633f07dd39915e080706a9674b5276bbb1f9a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966654, "uuid": "9b9daef6-9775-4fa5-b105-e22eb9144e28", "comment": "Malware payload (AgentTesla)", "value": "bde47e20cd8738166ac2f60f1c457231072e0da0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966654, "uuid": "0fa8cd16-7640-4d9d-b613-7ba15fcbaf4b", "comment": "Malware payload (AgentTesla)", "value": "ecd723e9277aea5d12f1e8164e547b1009647350e378821e27f645441aa33f49b23dcfd124f7eb5a84c7b21e4e27c5e7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966654, "uuid": "46007493-d223-4dda-847d-5803d400e73b", "value": "T12314122B78DE3AA1D825457E37065628D45BFCC288D9AEC23113BF1758F329DA84F11B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966654, "uuid": "b75300c4-cf45-4b6e-8cd7-0dd99b834c17", "value": "6144:CqflAowVf9eq4KYPdEXz3FXDe7Q/WHaMu7p:CqtQl541Y5asVMu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635966654, "uuid": "17162674-be3b-4108-b0c7-fda1c3d03170", "value": 206568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635966654, "uuid": "b4316ff9-39ad-4c55-81cc-d8a82c1961b7", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966654, "uuid": "fa340b37-d4ae-48ae-8c2d-43538c3e536d", "value": "Documents Invoice No XP2102000250.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f2c02d4-3c88-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635931614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635931614, "uuid": "b309e8ed-b5f1-4df7-8765-cacd8380262e", "comment": "Malware payload", "value": "d4e0b6792add9c56a5773d4a61a2aa9f", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635931614, "uuid": "7b01f3f8-a905-4d28-a0ff-3cc95a5f3a37", "comment": "Malware payload", "value": "85ccaa8927223877d099c58c0156dd5a67d2973753721a472933b1282dce863c", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635931614, "uuid": "643947bb-5b4f-4551-840f-50a8e53530fc", "comment": "Malware payload", "value": "c4fddd65d96e3a43285b4f0575a939cfbe7f6908", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635931614, "uuid": "32f77bca-7f4e-4323-a589-ca35e77b7c4c", "comment": "Malware payload", "value": "e96666ff4fd811d67a7c2331d3cf25725492fde72c72f3a7096f9c5a0c43727fea9bcf7797023df091dd67ba4eb8a29c", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635931614, "uuid": "945e79eb-7f12-45ab-a09e-e5b63d3ed9e3", "value": "T101C31297F5F48D484B90E826E5C4633CA4B83AE2E6F56CD42F703C244CBC6447EC5A98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635931614, "uuid": "efa15041-729b-4e37-a765-111092f68faa", "value": "3072:+UYgPfDP5Oz4/KV288ZReT32ive2qELFuKo3uR//WFp++:xnr/KVVneqFuKmuYFk+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635931614, "uuid": "fa3ddc1a-f4ab-4401-bfb5-1d1e2f8b8d06", "value": 122138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635931614, "uuid": "40556ed9-3133-4c5a-977c-21a2414a19d2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635931614, "uuid": "d9289548-ac95-4639-ad22-e731f33eb3aa", "value": "Documento-PDF654225153.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "060dc4c4-3ca0-11ec-843c-42010a9c0014", "comment": "Malware payload (Kimsuky)", "timestamp": 1635941853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941853, "uuid": "90c7c93c-2bbd-47a8-a0f2-e40e6534e26c", "comment": "Malware payload (Kimsuky)", "value": "4d221c328843e34a087aeca964bc19c8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941853, "uuid": "7708fefb-880d-4e38-b143-d85477d512fc", "comment": "Malware payload (Kimsuky)", "value": "85f6db3a74a4f1a367cc0b60b190c5da56cd0116c1d6a20fd7b51cda8f8948d8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941853, "uuid": "9a9e90a0-4fa7-400b-8149-e6437d1c05d6", "comment": "Malware payload (Kimsuky)", "value": "0b3451dc09de42eeffb15519a86a5657c954ca09", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941853, "uuid": "a573e7a7-bef6-4d4d-b0ee-5cc4f10021ec", "comment": "Malware payload (Kimsuky)", "value": "2eb167ff55fbbae185956cc093fe08bc3077a22ace60e1aa875af188935689b374fa162e476aff587c1b732fce4a9818", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941853, "uuid": "d7d33ae0-6386-417a-94f0-897d3d9ed101", "value": "T11EA50A61B549F2CFE48E277C9537CDC6692D0BF842250903987E7ABF7E63D812689C24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941853, "uuid": "0b5fe8e3-1b6f-4e66-a002-1e698e000d46", "value": "c2e52739913f4c6aa78cf11380ab53d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941853, "uuid": "b879d7f5-9f2f-4d2b-bfaf-b8876701423b", "value": "24576:OGGfc+UQZJEA619Qv9xSQEOIet00XkEYJcb5pXQ3PB0lBkY91G1h9vUPqk5u6Dy3:OxQA6zet0IgqJGifxiWqE1A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635941853, "uuid": "b3b9dae4-0bc3-4208-9c90-10f84175f5f2", "value": 2190277, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635941853, "uuid": "db2dc102-da4b-4f6c-bd12-c1a1521fef52", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941853, "uuid": "2e7f7f0d-5261-434c-9e19-83bdb6793d13", "value": "85f6db3a74a4f1a367cc0b60b190c5da56cd0116c1d6a20fd7b51cda8f8948d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "704e0eeb-3c5f-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1635914114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635914114, "uuid": "e907bb24-a3b7-44db-8db6-34efe186a6ee", "comment": "Malware payload (RemcosRAT)", "value": "b71ab7fed7309477c4b38cee807ae189", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635914114, "uuid": "bce0921b-435b-4cb0-80a9-404d11d7bd18", "comment": "Malware payload (RemcosRAT)", "value": "87225aa5bf1b671bd58581ac518326680ab05acd509c6ecb61a7036d4021ce46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635914114, "uuid": "17646407-c9bf-446b-88b3-58fc00c3a147", "comment": "Malware payload (RemcosRAT)", "value": "a4fce306828b5b2059c320b12b2046280306d3c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635914114, "uuid": "ce729b74-6d1d-43f8-b889-b9497a85830f", "comment": "Malware payload (RemcosRAT)", "value": "7686b750b22c4f4326f3a0304586e2b426b491c8f49b58eb67fbd2c26d5bb65253bf2b337d5caccda497547c677ece2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635914114, "uuid": "3dd33d14-e2dd-4226-b889-081e8b4d798d", "value": "T1AC35BE2726C49F95F0BCB73EE264004053F0A917D329DB9EBCD552DB9929F86C252B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635914114, "uuid": "f272cd8f-c53a-4bb1-bde3-3d07d30cc00f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635914114, "uuid": "ba141d73-b8a0-401f-a68e-9cf7dced2c32", "value": "12288:wElhhqsPQdOy9xoPcSEbk6SSj0TCo0wIiH+AUhHZ0l1pyVP929Bqhx3JxrsyCEo:ZlhhqoPcSuTGCq+Aeh92ehp7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635914114, "uuid": "d12172bf-bc83-42d1-8930-335045697d1b", "value": 1080320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635914114, "uuid": "18f3de8d-94de-4ba6-8fae-395dc2673c43", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635914114, "uuid": "d109c320-ab01-42be-8d2c-ad172cef62e6", "value": "purchase order 16985.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a08c3e5-3ce6-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635972166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635972166, "uuid": "4e463fbc-3782-42ba-a485-ce0b434424dd", "comment": "Malware payload", "value": "d298b385147810126c201d4c7d5963bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635972166, "uuid": "add96ee9-0625-4dff-a589-26a0630015e1", "comment": "Malware payload", "value": "8742bbedcdb4e7cede99fc8e506eded36b8ce90ccd383e9522bc3b569b481206", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635972166, "uuid": "a3547271-9ef7-4b55-be6e-9d7f815d7498", "comment": "Malware payload", "value": "8d521a946ac9da01d36e71269947352d4279151f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635972166, "uuid": "e974defd-be91-48e1-9545-2087a606aad6", "comment": "Malware payload", "value": "f6a8f12872a110dc0eba7e4c1f7d55c4abdcda112dd2056c76e30cc3c4b4c6f87ff77bb519b0c0f80acead5cbe686e5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635972166, "uuid": "7d64797b-a4a6-433f-91d8-a209e1bc4770", "value": "T1300509C6F1B3618ED7A3B0784B0165950A470C766B119AF9AF35EA2B15F37A1CAD3303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635972166, "uuid": "3183a34f-233a-4011-a819-67755224c543", "value": "77baa691e6143dcc53adb7b2c5e44e0e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635972166, "uuid": "e69a37b4-b586-4f9b-9dae-285f52c75c2d", "value": "12288:5XbVKbBQ2Yas7tO7Vq/y2vlYPMvVKXsLJRrKqwAUH2/ctImsQIhkYPMq0:581Qqs7X/RvaPMvQ8LJ35UrakKMq0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635972166, "uuid": "b14c1927-a5be-4dfe-a2e6-d625357cf548", "value": 837120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635972166, "uuid": "dadf9bf7-af47-4ad4-80c9-9948b4365aea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635972166, "uuid": "971b4597-0bc5-4b97-8591-448a3666ea66", "value": "Vape Cracked.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1e08fac-3c9f-11ec-843c-42010a9c0014", "comment": "Malware payload (Kimsuky)", "timestamp": 1635941819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941819, "uuid": "4c63abbe-d026-4cda-8887-014ebb5f537a", "comment": "Malware payload (Kimsuky)", "value": "469ed837383e56adf7d79cb9b986e85a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941819, "uuid": "e9164e63-2a4d-40b4-8048-ebfd7bd4b59c", "comment": "Malware payload (Kimsuky)", "value": "8765fab7ddb7abece3dd4b8f348e5338b82c4c2410185ab7b10ebcdb0df8d677", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941819, "uuid": "16e240cb-69c8-459d-85b0-14903c23b1ee", "comment": "Malware payload (Kimsuky)", "value": "779e014f4695e2f17c1a195364c0290b43ea1a43", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941819, "uuid": "07a79029-7425-49e8-87ba-7a50c7f8bb72", "comment": "Malware payload (Kimsuky)", "value": "479e067d7a3770839f320b450790e41aec693bee850527a9089b4e67274ac1b326a9663d1871e55c5ad7ec06bda11da9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941819, "uuid": "69a57a80-dbd1-4762-922c-b48e0de2726f", "value": "T138B52A51B58972CBF49E2BB8856BCD82592DC7FA03244C43A95DB8BF7DB3CC11586C28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941819, "uuid": "0437acb6-1b60-40b4-8743-4c4f38d34da3", "value": "869c528228af8b0b0bb001808e96ee3b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941819, "uuid": "8861c9a7-8dac-469c-9d1e-7c4be5a31642", "value": "24576:G2p5dxlrHIsT8JaIoLjMk6dYNUMAtp+T9TkaeI1+p+g2lBoFON4dDQa:Gm5Wso0JLjMoNUMAHU9PZYouON4Vv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635941819, "uuid": "3d5acdd0-1051-4bce-a975-613ed97e1884", "value": 2492877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635941819, "uuid": "00d3b910-8702-468a-aac0-b544f108cf06", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941819, "uuid": "9d55e8c2-ba11-45d9-88b4-f553c74696fe", "value": "8765fab7ddb7abece3dd4b8f348e5338b82c4c2410185ab7b10ebcdb0df8d677", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af243200-3c9f-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635941707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941707, "uuid": "44232634-403e-4af3-81f2-c3ec4e43003f", "comment": "Malware payload (AgentTesla)", "value": "523d127bdfa7a796a81b9ccfc20f3bb1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941707, "uuid": "e7e22cc4-ac53-4fad-8852-fd6c610af321", "comment": "Malware payload (AgentTesla)", "value": "8773fbe689289159add6e4d01f4b66d0f9767b2bd0b7de3fdb645d7b0b8ebcad", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941707, "uuid": "dbac227a-e16e-4d62-8ae5-531a128f5d37", "comment": "Malware payload (AgentTesla)", "value": "63243e66f0cdd006633f7dff40a28ab8f1786a2d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941707, "uuid": "f36a640e-d02c-413f-87df-da51229e1589", "comment": "Malware payload (AgentTesla)", "value": "b36da51cf57780a055af1c8b67f5b66983ed09c5d124c42273200d7e2ff32bb7253f462c58ea99fa310d0c33a6ff0e58", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941707, "uuid": "8538a4bd-4d21-4f29-b996-2ba6865fd60f", "value": "T134B4F04231AD9B06C75DB7F660AA9310BBB4AD3D1813E65E1EC671CA49733028F31E97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941707, "uuid": "5d137f20-d6c5-45e1-b251-c70abe230304", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941707, "uuid": "63f6e185-f1ec-4d59-a06f-c5b906e3c425", "value": "12288:6HsKIbw8eGW0wNAYi3bPfoVChni9KUzy/4n+JyYUJf1:7Nbw8eGWTNM3oCGY/4niFUl1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635941707, "uuid": "efc6fe2d-8044-4361-a099-f7817b1f88ff", "value": 508416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635941707, "uuid": "95d26e3f-7e3f-4a29-8ba9-cd27413ecaea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941707, "uuid": "04c28c1b-c043-43be-95a6-c34a6bc1586b", "value": "2021-08-30 PI #0001 & Bank Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdda3e32-3ca0-11ec-843c-42010a9c0014", "comment": "Malware payload (Kimsuky)", "timestamp": 1635942188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942188, "uuid": "02016efa-cac5-46a8-9054-464d8a870784", "comment": "Malware payload (Kimsuky)", "value": "8bac633f24d21e9f88425e0d3fbaf5c5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942188, "uuid": "e633f307-5b15-470f-a785-35769a1a819b", "comment": "Malware payload (Kimsuky)", "value": "88a2c526767f7d1f2f9ae100bf2f8e5f7642eac0838e4ec4e345ce02af3420a7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942188, "uuid": "840bb925-cc86-4fcd-b80f-0a1715836b69", "comment": "Malware payload (Kimsuky)", "value": "97ba1054ebe6b36adca113ce0689fadd335d47b4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942188, "uuid": "dfc0d52f-f0bb-41ec-a6a9-71435e400159", "comment": "Malware payload (Kimsuky)", "value": "0edfc18e1c6ea5e6fcb953a20eadcaefbaa1e078c5648bfe110d71338c6b59f80f4dd652848b081012be8ca0800f24fd", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942188, "uuid": "ec2b7132-6045-4e58-8f34-39360ff44ea0", "value": "T19ED37C03B691C072C2A5017D6469DB63867E7D358BBC98C3B7943A9F0D301C2BA7979B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942188, "uuid": "94e99fc1-e0e1-4a34-a41a-6a99d9547c3a", "value": "288245d63d69a936ef9e17651ae9c1cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942188, "uuid": "97684326-d56e-456b-8da7-4bf3298fae2a", "value": "3072:S7514uU3KCvTTKG5p+W/dMltnk7rJzjGY:+5GvbeG5elwe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635942188, "uuid": "2c019df7-8d73-4f70-b007-9727ada0dfb7", "value": 134656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635942188, "uuid": "a40a86ac-d176-4120-a2f7-fd1a4a26acae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942188, "uuid": "fc1d237e-69f4-458e-a06d-fd60acff2531", "value": "88a2c526767f7d1f2f9ae100bf2f8e5f7642eac0838e4ec4e345ce02af3420a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaf83f37-3cd9-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635966611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966611, "uuid": "6e653a04-5411-4c3f-880c-eee93d6310a5", "comment": "Malware payload (Formbook)", "value": "c3f435c1711eb57e13acd2cb1fdf04a2", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966611, "uuid": "25167c9e-d4f8-4fe8-9dab-3f15ca61d1f5", "comment": "Malware payload (Formbook)", "value": "88d6f042585c2e129d891c4bb6217544c7d8cc2a814d4bb61cd7359165e4af84", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966611, "uuid": "e0c6cfd5-2480-41de-a217-919d692d069d", "comment": "Malware payload (Formbook)", "value": "a4cedd66c27cf1aaed9ebf9fc0deb1f82dc937c3", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966611, "uuid": "a16daf14-55c4-4177-a4fe-b5fa3e4f2cd6", "comment": "Malware payload (Formbook)", "value": "41d085e5fb97acbbd833e43cae5cd4704d72707000fc17ad57e8c8bd3b916729f6e16c3fbbd389d34709bbeaffffcd76", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966611, "uuid": "5de48371-0655-4c35-af37-d30e56fa5979", "value": "T1FF8567F0AD01D4C1F57E5B6AF2FD3A48A1343227EBC94A4A00E7E5551EF6A11B90ECC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966611, "uuid": "63ec7298-3b4d-4cf5-b50c-84bde78dfbbb", "value": "12288:6REB4nZ2nkYR5UxLEpyI28DpDwHVfsDpEq3EnG:QKXkYR5UwyI9pg5Y2q38G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635966611, "uuid": "6c4b4714-2d9d-4181-a988-ef54597863b8", "value": 1711849, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635966611, "uuid": "2568bb46-002e-4ce1-ac09-7e6cf0cd5a5b", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966611, "uuid": "e7c1a160-6e07-468e-a128-bb23bb2a3181", "value": "SMC INQUIRY.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96f10ad7-3c89-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1635932218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635932218, "uuid": "b52670b3-7523-4544-bb66-b1c47b7cabf5", "comment": "Malware payload (GuLoader)", "value": "9879c08c6bc64cfa0cfc54e7602ff044", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635932218, "uuid": "7f52e381-b981-459a-83ce-205d5cac83a4", "comment": "Malware payload (GuLoader)", "value": "8a47dc23b95145a827cb2006a210b9a59bb15e324901a0f3d19fc2e3ee321579", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635932218, "uuid": "22980f59-a8af-44ba-a050-52ca39ef5d76", "comment": "Malware payload (GuLoader)", "value": "d33b708178b7fafbd462a91e9a171a39845e606e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635932218, "uuid": "823aa828-35da-4982-8f2a-426658baac70", "comment": "Malware payload (GuLoader)", "value": "8ff0d327b4a481cead36d423b5ae3c45230a38856aa5e9853b36787b535e65439e14159eab85a5b2573dabd3c326e01f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635932218, "uuid": "9dd7350a-7f15-46ce-8732-40a5f044ee55", "value": "T1F2149C22A3ECD964DDA1C774CA2A45FF19AB7C314B8D057F63823B3EDE72696C810605", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635932218, "uuid": "a1a983af-d71f-4ef8-87d2-f776733d779d", "value": "7d29ac55c7221b9c29732750dd7e8a97", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635932218, "uuid": "503811d9-1bf0-4774-ab0d-f4b5cb21c6a8", "value": "1536:pqBy8cI6wWVLsO+3foDVRlcooBbhDy2k/ecASE0t7Jq/88bulhjuu7MRs+j/G1XD:p4KwWWtKzcooBdyASEQltjWBjO1X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635932218, "uuid": "51a2f033-f36a-4328-a7d4-5a7734579298", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635932218, "uuid": "0c17f224-25a4-4324-92b5-c19f884a9181", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635932218, "uuid": "cb775247-c6e6-4de6-99ff-fcbcf7dd967e", "value": "Arimar International Spa Ordine Urgente Nr. 67754#11_3_2021_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fec48384-3cc5-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635958162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635958162, "uuid": "946f76e7-dc5d-4cd4-ada2-e3bdc8b6526a", "comment": "Malware payload (AgentTesla)", "value": "5957bb96d6bddac2ee23752cd04ee53e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635958162, "uuid": "1ad92f33-b473-4e1f-984b-44dc8b2efe44", "comment": "Malware payload (AgentTesla)", "value": "8a648780b6b5ac40759eb747e35db557385a6823e4cad8d7ff6999e2f64f26e8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635958162, "uuid": "e33394af-7ebe-4e10-8d10-8a9b8f9a73e3", "comment": "Malware payload (AgentTesla)", "value": "2eaaf3cdc9d1d541e017d6c236eb0d28886c8036", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635958162, "uuid": "a69f77b6-87bb-470e-a27b-f279e33af14e", "comment": "Malware payload (AgentTesla)", "value": "ffe39bf43537bce8f3b4268f7c71eecf79d6d776a68d7cc30743ac8a206995c5270458d4cf25ae43d44e844ae2b79867", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635958162, "uuid": "68f4e0db-0278-42f8-a827-3a123ac478eb", "value": "T13BA44F1C3B420A72ED0E91308B098A05BB270EC36B48FAE1579BD9CBA75F1671D45AF5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635958162, "uuid": "3655777a-ed01-46b8-a9c7-5a98d50ff01b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635958162, "uuid": "e6431288-e41f-4816-adda-42e7265e9af0", "value": "6144:yXlbd9Urqy/LZbIXr3O6wVTJiCP8G5VMuGiIKokeqKSMRidj3FMKq:y15Cr547Fwx0C5V5GioLGjF5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635958162, "uuid": "7b236795-a9c5-480a-9293-630555f3d712", "value": 482816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635958162, "uuid": "8c8a894f-32a1-4497-a84a-1b72858fd824", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635958162, "uuid": "3694c498-c1bb-4bf1-9df8-2cc6c71ec3ef", "value": "5957bb96d6bddac2ee23752cd04ee53e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6c5f58f-3cc1-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635956377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635956377, "uuid": "c199f1ef-685a-44b6-b8e5-58610d17cd92", "comment": "Malware payload (AgentTesla)", "value": "0d3e2cd5943cce71b8de6c3e9a5839be", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635956377, "uuid": "3c4435b3-ac9a-4b65-a312-6373240bb9c2", "comment": "Malware payload (AgentTesla)", "value": "8a813e10553a21eea3e6bc390ef93497bcba429b3c124f0eeaee8309724955d8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635956377, "uuid": "db142c66-25c4-4d6d-8b08-7b5ce6024e55", "comment": "Malware payload (AgentTesla)", "value": "14a5c30ac2b6ac801f4d2e45839b2b3f8042771f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635956377, "uuid": "2f19fbe6-b8bb-41f8-a46a-5ffc2bf20555", "comment": "Malware payload (AgentTesla)", "value": "c3be6b943404704ce9945132c3e54e9ae44111be81846cb66274fad145a0960fda3f982552eb8d0373efffa89d58c3bd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635956377, "uuid": "c465f149-d106-44fd-9d52-b24d0ef034a7", "value": "T1F6B4D0325216AF85FE7F1FFC540034800FF5B86B9B2EC655FE8A40E626F6950CA65E81", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635956377, "uuid": "b0c50496-a185-4513-a533-a93de9745bb5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635956377, "uuid": "d77ea151-57d3-4117-8adc-a6a0178ddd1e", "value": "12288:BJAqJFTPi97fdewZeil3pjMNxw8cVRWYmmcLsgqrg/Dy4+:BJAqKeIZjox7YmmcIRrwDT+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635956377, "uuid": "9da460eb-6702-42f6-9cfc-c2df2002facc", "value": 518656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635956377, "uuid": "5c05a174-5775-4e5c-8325-911ff3567065", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635956377, "uuid": "c638adac-8fde-433f-85fa-114bc2e6ad3e", "value": "PAYMENT ADVICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6ff92aa-3c93-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635936647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635936647, "uuid": "8a0dafc9-157a-4a15-ab10-9c16fbbb88a5", "comment": "Malware payload (Mirai)", "value": "861fd1f11fe66aa2e72f1036e3aaa463", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635936647, "uuid": "8d6f6af5-05ee-475b-a62f-e86310fcc46f", "comment": "Malware payload (Mirai)", "value": "8aaeb0d44700ec60fc244741c2237303162a0849f41fa0efa9ca364d7d511c91", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635936647, "uuid": "b2fb66c4-0915-449c-b02a-26f3abfb8d69", "comment": "Malware payload (Mirai)", "value": "7144afb1b7903769add037db21447c09665872e6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635936647, "uuid": "a8f4b67a-a6fc-4291-aaf8-f2f5dfc62658", "comment": "Malware payload (Mirai)", "value": "8488c10c2e245ecc779fff0954dd96301c1ca55811907727b69c08593723e9b3683b928f73712ea9c5d6602798805256", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635936647, "uuid": "3309297a-b430-4f1a-b97a-94012dd95698", "value": "T1FE5319867881AA26C7C41777FE2F01CE3718A798E1DA33478D191FA076CAD1F0D5764A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635936647, "uuid": "26363697-c3fc-47c1-8766-6f9108eaf2f2", "value": "1536:7jlmXTsMz+mldF6mJ7BU99MJcBeZWoNdKJY:7jwTs8HliqJAwRNdI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635936647, "uuid": "1699ff14-a5e2-40fd-a478-ba29ac53e3bf", "value": 64048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635936647, "uuid": "23c2ed39-46fa-49c2-b505-60d64faee16a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635936647, "uuid": "23052b81-fbee-43a5-bcd6-2c696a0f1f86", "value": "b3astmode.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8d1ded2-3c72-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1635922369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635922369, "uuid": "73f97e69-96f2-48a9-ba3a-5d288679b599", "comment": "Malware payload (Dridex)", "value": "6f0d7c1052a02debbabdb46057a26767", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635922369, "uuid": "b4ce5906-e57e-4994-af2d-7dd33ede470d", "comment": "Malware payload (Dridex)", "value": "8b28f9624a96597fe1c164ddbb843f0fbc262744efc8154649c31251a71ef1a5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635922369, "uuid": "c857b3fd-f655-409e-b181-b91e8729590c", "comment": "Malware payload (Dridex)", "value": "10ee9a28ef0aaecf138709c350366daa4b61551c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635922369, "uuid": "ad5e4c56-21c2-4f3d-ab98-f9828a77029a", "comment": "Malware payload (Dridex)", "value": "6b2cfc10bd7a7ad50ed885c42925d485ca1705ce588fed34ce15e14d6a62e9d782800fb9fc06727fa53139fd64fbbcaa", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635922369, "uuid": "d1f17180-d237-44d1-9291-4bd9699e3f01", "value": "T1CC83010D9DD621B0E661EA3D4B0D1CE764B677115D00BA8F14A9AE980BE3187DF0F547", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635922369, "uuid": "2a535d1b-835b-4398-b185-e352fd50bec6", "value": "1536:8CWUPrX6Q3cWViBN3yKqxyeHw3vRMgF3oKy5hOORUPMZsTYB6LVpTn:83kqmc3/q0dfaguKyOOiSs0B6LrTn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635922369, "uuid": "37c81f9a-52d8-40cf-8ffd-21bf71cc99cf", "value": 85698, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635922369, "uuid": "5c91b950-93a1-44dd-9fc8-6a4b980fa2dc", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635922369, "uuid": "9e299c60-fcf3-47a1-ae53-1e795901b7f4", "value": "Order.48868.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61e085bd-3cdb-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635967347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967347, "uuid": "27f8aba3-c58d-4fcd-9da9-e27a6e66a7bc", "comment": "Malware payload (Formbook)", "value": "33f3b36342d5d3b5a0724e10aacfa229", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967347, "uuid": "0970a61c-5244-4996-8801-df6d0a8d0578", "comment": "Malware payload (Formbook)", "value": "8b401bedd47d2f15827ae1082d0d8bb90b1280e80051fa3727ee3f4a77843704", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967347, "uuid": "21850b58-2b63-42b5-b690-1adc42ec6b63", "comment": "Malware payload (Formbook)", "value": "85d72e5128c9fe0405801cfef32f9a1fefeac6c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967347, "uuid": "9bab5c07-c024-4805-be21-8f12d0ba424a", "comment": "Malware payload (Formbook)", "value": "e78a47ae4474e5c1c537096aa870eeed6916b80701307922b90194ef6b9629a23fd9967e5674850a2d86aa53e99ce9de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967347, "uuid": "b7ac2295-c756-4874-a38d-673c0a61e3c3", "value": "T1485422B5B7F04977C39653342936B77ED37DC2794682E5870BC82E6B7920285448B3E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967347, "uuid": "9e6636dd-b6d5-4768-81cb-041a7f918930", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967347, "uuid": "0239640c-fcb1-46b7-8f1e-4f6b11574501", "value": "6144:F8LxBsO5nvuCrQujhGdjn1zutmHaGBcQochDnnOHBcFsF:/OxuMQujhUR4md5ochDnOHl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635967347, "uuid": "75be4eb1-b134-430b-9707-39e3a4cf62a8", "value": 290970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635967347, "uuid": "d9436b7e-df92-4bb0-b20a-eb63fafcf080", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967347, "uuid": "be83a3c2-2c6f-44a2-9f02-bd12a3802fe0", "value": "33f3b36342d5d3b5a0724e10aacfa229.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bda805de-3c4b-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635905654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905654, "uuid": "79bbe78e-6d7b-4b8b-af36-1781c1029d4f", "comment": "Malware payload (Mirai)", "value": "029bf62d2c2b0ba32e49c416c62f80d6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905654, "uuid": "30de8bb8-11c1-43b0-a5ff-21a3b5099a5c", "comment": "Malware payload (Mirai)", "value": "8b856df584356615f39dc3e19501702e20992e46e30bc0239d07dc27e8cf9403", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905654, "uuid": "a5c34ade-60c4-4f49-b030-cb6930e16ffb", "comment": "Malware payload (Mirai)", "value": "f0272c05619ae3d6006c8d5015ad944065870cc2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905654, "uuid": "8891b8f7-06ba-483f-a6ec-f3719a14ed50", "comment": "Malware payload (Mirai)", "value": "b0b430cd11dd057a9e4c3efb289505b074fb3ac2b7649530cae6635a695fdb3118c8bd8a7509231e2b46b615b3ccee1e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905654, "uuid": "ad55bc96-31c4-4855-b202-9443e0feacc7", "value": "T1E5C2D0DFF4963985CC1C5CBC259C56E115A9A2C3234B9F0837603DCDAA7645FB89C8B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905654, "uuid": "01721240-5846-4a2b-9494-6a567b9b895b", "value": "768:MLCUFskb2JgIs/E2+OocrfJiHNjfmQ2q7IoqdBW5WS:oCrJgHiOJrfwmQrctOd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635905654, "uuid": "8b89033e-5b1d-4589-b74a-a9c4c6efcd0c", "value": 27244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635905654, "uuid": "be246654-5e85-49e7-bb1a-319880d16370", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905654, "uuid": "c70f3725-7b48-4b8b-bff3-95ed6c33111c", "value": "029bf62d2c2b0ba32e49c416c62f80d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e613d5f0-3c8e-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635934498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635934498, "uuid": "5c7e9a59-6d38-412d-bd72-50d066f655ab", "comment": "Malware payload", "value": "23d180a495459f78af657e092cd4b79c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635934498, "uuid": "f1ae69b7-ec3d-4a62-95f7-8d199d99fdd8", "comment": "Malware payload", "value": "8c1702a2f580b0548babef584ad4ad29043928a25768b36ef03043543f1d5439", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635934498, "uuid": "a3f3b352-a723-4b75-8c20-d5c426073847", "comment": "Malware payload", "value": "a65be87c606e76d62320ba375b836da1c427f65a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635934498, "uuid": "17012484-277c-47a0-9809-a201e20cef14", "comment": "Malware payload", "value": "28059b0fc71ecd972fc6e6a045f2039928944d63b397139e84ad089cc5f8dde8932829d8fa6223d638c41349f6fa157a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635934498, "uuid": "abe9fd4a-d6ef-4673-8860-0749aa799cbd", "value": "T17B526047E10C5E73E4C8B9FD4C520F75FD2248348A0147C737A2825D9E8FAE9EA55BA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635934498, "uuid": "c0dfb423-ab4f-415a-bc48-edc7f6f748b3", "value": "96:wlhlalul+lglTlG1/gpt6I/1pAxu2zCDdjGWiWcMbB7WfIGCrM4kRwcJkUFidxeK:LctpzA7WXRbQfIVBX3khf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635934498, "uuid": "36fa6a15-b7de-42ff-b9c6-5880bf159ce8", "value": 14088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635934498, "uuid": "f14923e2-c3ae-42dc-a807-0d6e945d409c", "value": "application/x-sharedlib", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635934498, "uuid": "8400a4ca-06ad-49be-ad00-c0a3ac7b49b8", "value": "download.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6930f7f8-3c8f-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635934718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635934718, "uuid": "62d8b92f-231b-456a-a388-d9b1339f94c9", "comment": "Malware payload (Formbook)", "value": "3d9388add4eb1436a441f7f2695600cd", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635934718, "uuid": "32f579f5-e7dc-4467-b403-0f2cced9c4bf", "comment": "Malware payload (Formbook)", "value": "8c5a756a70f1bd048e4cce1e7709265f8dd8739fe1490441020e26b01a5fa51d", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635934718, "uuid": "de9fa271-e063-4639-bcc1-c0958a2192f4", "comment": "Malware payload (Formbook)", "value": "0052d2d4b4a96fc7feb893c3353f3e1d023bb71e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635934718, "uuid": "4f66d337-2bb5-4e69-a654-9282ed0d7483", "comment": "Malware payload (Formbook)", "value": "dab4439961b8febc6b4fc7ecd75d1f1093e8f9e3aec882c2470ee74795f3833bd588c416dc151ba98776872e8f4430c4", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635934718, "uuid": "8bec94db-e13b-4d72-ba11-036a7dad545a", "value": "T1918567F0AD01D4C1F57E5B6AF2FD3A48A1343217EBC94A4A00E7E6551EF6A11B90ECC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635934718, "uuid": "22afee9f-9d1e-4684-82c0-5e97bc23edd3", "value": "6144:kBKqt6DUuO/8nmxnGcE2sDBYk6qFLkYHyDnnKemmZbAePJN0Y6apRNmVfdr/+EBB:kBKoGCImxnSz6qZZemmnPVp/m+EB4nc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635934718, "uuid": "7fe98c30-446d-4957-9d1d-d2019cfcc5bd", "value": 1724902, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635934718, "uuid": "ca9fe16a-2562-4139-ae3b-07eb2d1266fb", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635934718, "uuid": "5f2bd4fe-cf13-4ddb-a9b9-e31792c0aa8b", "value": "REQ FOR QUOTE-6000063003-DC12218-1 Offer.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b615de01-3cc2-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1635956751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635956751, "uuid": "596c3358-78b3-4224-b010-8149e49e454a", "comment": "Malware payload (Dridex)", "value": "3902c34a403020c1ed6507c7f1c547f9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635956751, "uuid": "5fe2983f-2c95-4867-9643-9bfc06651258", "comment": "Malware payload (Dridex)", "value": "8c6c5b36589ec9c7eb31218709539aa345305e18c1a9bef3837672722d571e62", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635956751, "uuid": "1f47424c-7e83-46ae-9afc-3eee26fca0fb", "comment": "Malware payload (Dridex)", "value": "a3969bcecc0ed4d83d76d7249fb05880e03dbba8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635956751, "uuid": "07d912c2-c235-4c20-bc97-74e17c0117f4", "comment": "Malware payload (Dridex)", "value": "e20c4a7fddd00ee80abd35182029a1ffce03ed069852293c72f27deaedc3472c6fa2124c9b41f79005afbfccbebb7b1a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635956751, "uuid": "111eec5d-5f13-46f6-9b84-02dae2f8f0e5", "value": "T11DA3026ED192B419C0F599BEC74E1CF19831064A4587BA2FBAAD02741FB90CFB74911F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635956751, "uuid": "509a0212-01e1-4bec-99e6-84a73f7f691e", "value": "3072:83zFzIsj8aipSW4vHREQ4iZKUbZtmV5ojKBFF9Mw:8mOipmvxpZbIAsv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635956751, "uuid": "3dc51250-b917-4116-992e-93fa1a8a86cf", "value": 100339, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635956751, "uuid": "8b683cec-554e-4f0e-8c81-47a275bcb4bf", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635956751, "uuid": "26eda0da-b091-42fb-9329-b802e0bc31c2", "value": "Bill.17597.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2e1a1c2-3cbd-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635954679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635954679, "uuid": "490ec56e-24c3-4319-b559-5d86927a3559", "comment": "Malware payload (Loki)", "value": "5d79b4f8dc69660dbd062b9cb0d84470", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635954679, "uuid": "59328768-0f41-463d-b8d4-42c4bdcf5f21", "comment": "Malware payload (Loki)", "value": "8c6ca14a641899e3a93974f9247b1fd15be0b094f35f35054a25e4f979bc9dfb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635954679, "uuid": "2b6b9977-ef7c-49e4-9b45-a05bebd79264", "comment": "Malware payload (Loki)", "value": "0d5f071488dfc098c73cd1bf73349fe7e160412b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635954679, "uuid": "16674d61-a52f-4bcb-95bb-488a9ce47014", "comment": "Malware payload (Loki)", "value": "359d4c6071c1f7669bb8dedac436795e88b9e9f275a3156383354309a1cdbaff63ae08059b12441179181ca179c5e3aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635954679, "uuid": "5e1f8f24-6dc1-4617-9030-9b53bba5f64f", "value": "T15854F17407E86F63D53D63F524A646104BB0E24B2257E74EAECE36EB9766F044060FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635954679, "uuid": "e75f1f26-65d2-4c93-a731-a1c969283cc6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635954679, "uuid": "1a87e5e5-2b4a-4a6f-bce1-a51e26b1e02e", "value": "6144:wVFJZ7Ku+sncIYlQC3gWUUnf9WiYlTOkYN:wjJZzedVHf9hY12", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635954679, "uuid": "915cca71-6c84-40fd-9c2c-343201b6e474", "value": 292352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635954679, "uuid": "a5fc471c-3dad-4218-82e0-aef142c71918", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635954679, "uuid": "e2532237-6eab-4e77-a230-4cfe3bcb1e10", "value": "5d79b4f8dc69660dbd062b9cb0d84470.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6647730d-3cc2-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1635956617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635956617, "uuid": "4cc68f8b-ee2e-40b4-a2f5-f966736b9964", "comment": "Malware payload (Dridex)", "value": "d4c05dde40d38fe6c29178295540b636", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635956617, "uuid": "7ceefa8b-df83-4069-aef9-0040f9ff67ec", "comment": "Malware payload (Dridex)", "value": "8c855f9c9fb71bce2ca09057ba23fc26760f57feeb492119bc4855f5a2e5cd97", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635956617, "uuid": "ea1d28fb-bb7e-4e9a-8e84-fa39c2839d5a", "comment": "Malware payload (Dridex)", "value": "a34dde59cb1719431b1de25c4dac62c9d97ee1db", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635956617, "uuid": "8f293e04-3132-41fd-85f0-166ee33b2735", "comment": "Malware payload (Dridex)", "value": "578e7d699d9d896db80ba2313a8de673fb573197ce46c6ea001cd11804c54ccc57292ee920419924b4218547eddea269", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635956617, "uuid": "c59692b0-eacc-4d0d-9a49-8af6d2720d34", "value": "T1D883F18ECB4AD8A4C5FB863D8138BEE2704B57149641E30B34A9F70CE8617D7976B606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635956617, "uuid": "450ef749-0de9-4476-beaf-78ff5a0f409a", "value": "1536:8CWhPqrE3gpMokPF58Ik4kosQFVvSuM5A1X/vUS2oDIUSSP5iOJGRc3l:83IEwFkd58IXkOFVvM6R/vULbSP5ilKV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635956617, "uuid": "efdbe230-c1ad-4d4a-a49d-fcd62a4d8ac2", "value": 82886, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635956617, "uuid": "dfd21b41-8558-429c-8136-30c3eca9d3e8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635956617, "uuid": "3ea0f92d-8914-4aee-b633-d8ef103d3444", "value": "Invoice.96826.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81712d64-3c9f-11ec-843c-42010a9c0014", "comment": "Malware payload (Kimsuky)", "timestamp": 1635941631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941631, "uuid": "aa296b9a-46bd-4e3e-8485-16539d18dbd2", "comment": "Malware payload (Kimsuky)", "value": "1976fe2bc1011c02ff50c807f97cb230", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941631, "uuid": "b4f865cf-eba3-4524-b051-4aba8e2adf1b", "comment": "Malware payload (Kimsuky)", "value": "8e263345cfeda4eb6720c47d4eaaee236be294fda693d840199f221d6e1412c6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941631, "uuid": "3c29bef6-81ca-470f-8033-af7c2a5da4a0", "comment": "Malware payload (Kimsuky)", "value": "b2a7a51e635574e183f88008f21f98be67e23f85", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941631, "uuid": "57a21105-a7e3-4064-94cd-e4fee2114f7b", "comment": "Malware payload (Kimsuky)", "value": "bc00eff3a8940a540b37ac557260cbc12da95bafba8cd9b9e059b0e3951fdde9d8026ee709897823482355ee410162d8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941631, "uuid": "7a6e499a-3c97-46fd-bcf8-8b9cc817da90", "value": "T1BAF5223B65542581C5DDC03ACD37FD8072FA127B8A8098BCBED5A9C1379A8F5E6039D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941631, "uuid": "7c1b08da-a5b0-4959-9874-164f6a4f2262", "value": "cdf33c3fdd465315e1b268ca92734a67", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941631, "uuid": "ec78390d-6381-4355-84c3-88a6520cc853", "value": "49152:SEr/mcvmpIg6Y/4CxSatJjyzPZTqoQUsjMAwUUsNg5865J9W2O3cIuVyTThk2Doy:ScmPp3QCxSESZTKjRg5865w3XiAkPG0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635941631, "uuid": "da39c4ba-1126-46bf-8c33-e7b019c1cea9", "value": 3500032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635941631, "uuid": "106c3468-4fbe-4e20-ad9f-a03a5d473407", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941631, "uuid": "a1219af5-7b68-46e5-8368-13bc141c6aa8", "value": "8e263345cfeda4eb6720c47d4eaaee236be294fda693d840199f221d6e1412c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86e32a33-3c70-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1635921453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635921453, "uuid": "cfcc235a-8bf8-4be0-96f3-e07e2e9a4012", "comment": "Malware payload (Dridex)", "value": "b6b4e24168a62acf632b84a68f78dc19", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635921453, "uuid": "01819b5e-8d80-48db-b543-37f70b0b8724", "comment": "Malware payload (Dridex)", "value": "8fb49ddb6f0a80159141d618c7ad7306cd733790043ac91611cac399e8a51dd7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635921453, "uuid": "bcd96a7e-a986-4531-8058-e0fd05d63cc8", "comment": "Malware payload (Dridex)", "value": "b26f2f229efed60df229e80fba58616f7b3bf272", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635921453, "uuid": "a9a63909-e53b-436f-aa08-ba8dc6dc677e", "comment": "Malware payload (Dridex)", "value": "7e0aceeaadc937d4088c4db3ed39d200d72d62d6d988be81d5491669bd2ccf79808de06270dec00b65ec442a4500231b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635921453, "uuid": "282356c8-6441-42ce-be5d-babf7d0d1142", "value": "T1B97302BDC0E424D0C2AC63BC386D6CE5A85AD0426A92D35F2C6E6E4403B15AE7F9F11D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635921453, "uuid": "b4cc4289-e7cf-4633-a80f-ef7622c2436f", "value": "1536:8CWWPFwJpvc1e+BwT8YIbDMz+1d6xZJYLq6PldtcgNbcLt0qu:83xMrbDu+1d6xn8ptdt5YCqu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635921453, "uuid": "b7417515-e33c-45d0-ac28-1786846c9908", "value": 75277, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635921453, "uuid": "b273dcf2-0149-4a0d-8993-5903c83079db", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635921453, "uuid": "36d74bf4-d391-4ca6-b453-22121a8ac043", "value": "inv.030976.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ec637b5-3cb5-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1635951129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635951129, "uuid": "ead91075-819a-4841-a13d-faa74523222f", "comment": "Malware payload (Dridex)", "value": "83c83c511aea0757caf68852ee24b63b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635951129, "uuid": "957637e1-8a2e-4e83-901e-f19b8ffd8321", "comment": "Malware payload (Dridex)", "value": "8ffa8a52992a0596b8ba1316355c1eefa7d9ab8d46c56eb96d1f06c031dc9055", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635951129, "uuid": "2fc627ee-6083-412f-abc0-df5e2d1a3138", "comment": "Malware payload (Dridex)", "value": "a3ac758e1a13e70c6fb28035239dd7bc466ad54d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635951129, "uuid": "b2a6e591-0ea5-44b4-a74f-c044be9e28db", "comment": "Malware payload (Dridex)", "value": "99fd7d40a832cf11478eae78a9aca6e7e23b02aa2db9995808a281cbe424ca9c29a9f071176dbdf356dbad1136354437", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635951129, "uuid": "30777c34-7bde-4a84-868d-1a2418078a24", "value": "T14E73F19DDDA4E044E3624EBEEB6648E1D2090AD3AC4D521B28D6B7043EFF3571F9E041", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635951129, "uuid": "4d935eed-00b0-444e-bd6a-a21ff3305298", "value": "1536:8CWoPuALLImemeKHqeK7Ync6c1pC+9hFNExMGqqOknyrH:83H80XKUYk1vFNxqOkn4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635951129, "uuid": "f6b470e2-90f8-43af-9e53-32dc2891e23c", "value": 78514, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635951129, "uuid": "1a335e5b-b6c3-4994-9aca-7d8b6cf6c0b4", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635951129, "uuid": "04789b78-9df6-40c1-aaa1-c2fe1a20ff24", "value": "Order.199996.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac39fb82-3cab-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635946856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635946856, "uuid": "d0dd3fca-a0ed-4d90-bab4-b36635e11d52", "comment": "Malware payload (AgentTesla)", "value": "509d634ddd2c8fcc7e936cda1820b28a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635946856, "uuid": "6d2ee9db-c3c7-4644-a3b5-2c0310ef9646", "comment": "Malware payload (AgentTesla)", "value": "903ddb4e441b5536881b07f8633ee88d28bde2edee5b70d95a063729c0960500", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635946856, "uuid": "a525c4c8-3117-4ff7-88cf-0ceb48d70768", "comment": "Malware payload (AgentTesla)", "value": "3d4478c28ccea5bdddc5a4a2bdd9897cc1b72d73", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635946856, "uuid": "35911f2a-20b1-4365-8dbe-35ac0ce4d7e4", "comment": "Malware payload (AgentTesla)", "value": "928ccf774cc63d71dd483f31a9ad4951cd1a64cc185ec28b501b08a09976c06c0e43c88a89283666cefa3596b48e699d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635946856, "uuid": "6e3bba4d-7964-4001-bff2-19682d8b4a5f", "value": "T10545177174E8788DEDE6883044992C121D59FC733A9AF15A90D3AC0CC47B097AE6EE77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635946856, "uuid": "f535a26e-4e41-4d2c-b0b4-4d93c1670840", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635946856, "uuid": "c2670ef3-516b-497c-bcf1-32bbec96f875", "value": "24576:ec7cJccH10tDtoqtpuM/xY3fSfigvrj9oF4Gh6:rPpoI8Mp8Qdj6WGh6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635946856, "uuid": "2c2e2538-bfe1-431f-b04c-b35f206ddadc", "value": 1249280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635946856, "uuid": "67bf049d-e4a8-4a0a-a897-62bd76a33c80", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635946856, "uuid": "cffd1cd2-da84-4b4c-8afb-24ab9a6e8689", "value": "statement of account.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf00acbc-3c8b-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1635933144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635933144, "uuid": "bd7234fa-1540-440b-b260-8fea39cafd0c", "comment": "Malware payload (Dridex)", "value": "3d4b4960fe90b061ef20f8e38b6da964", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635933144, "uuid": "68aba6a2-e821-4f7d-a7e0-81be258cf563", "comment": "Malware payload (Dridex)", "value": "90dd46cc4ee0a5aeef3d04a887e233b29657b9ca8ff6aa8e48bcaff475d08b14", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635933144, "uuid": "88af258f-8912-4980-b26a-85f40eb30ce9", "comment": "Malware payload (Dridex)", "value": "44b007e572100d78059edde0c5450c83927a1bd4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635933144, "uuid": "dca606c4-bb3b-4c69-964d-fc1512c6cbef", "comment": "Malware payload (Dridex)", "value": "bb0a985ad05fa4ad6b63452bdea5e9f60baef473981ffff796e8cff62edd62af780befed4f4cc9ef14eccf3a86c679f2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635933144, "uuid": "3a6df77f-93d9-481d-82ee-975b17f7b4ed", "value": "T17063F1975B05B4A0D1BF85BC410EAFDAF50F62787982D10F3CA5260088D42DB939BBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635933144, "uuid": "c6fcefab-e738-47db-852a-694900657f00", "value": "1536:8CWuPqrE3gpMokPF58Ik4kosQFVvSuMTzQPlHXgATiDc4UW:83LEwFkd58IXkOFVvMTOQA1W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635933144, "uuid": "a16f9c77-5dec-49b1-9551-93af293eab1b", "value": 73146, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635933144, "uuid": "74025391-9eaf-4d1b-90d7-7e44e6674db9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635933144, "uuid": "d1cd6747-f4d9-49d5-a7c2-14bde41c723d", "value": "Payment-4091.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99fefddf-3cc2-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1635956704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635956704, "uuid": "a796b560-308e-4be3-97d6-b815afb2f84a", "comment": "Malware payload (Dridex)", "value": "ccdf8cf75b9b23225c93364e26caa1a4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635956704, "uuid": "69a66589-578a-4e51-af4e-b052106b91fd", "comment": "Malware payload (Dridex)", "value": "91297db5ba8cbde03961bc1224f223e832a2d2a7c6ca985d3b6c4e47e531c7dd", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635956704, "uuid": "d9a95099-46b8-4894-ac6a-a00ae2c7c226", "comment": "Malware payload (Dridex)", "value": "b604db30b9a655f38dc21cadf90324bd7e22ae8e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635956704, "uuid": "d3407002-2c98-449f-9e67-f9f04a18e8cd", "comment": "Malware payload (Dridex)", "value": "e8cba97c371f09312ce569b668379c8499018a7dbab47700bbc3f51cc27d69039bbeb05f3d30ca40e590dc047f3cf86e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635956704, "uuid": "a14a8969-aaeb-4df5-b1c7-34c8b8c6771b", "value": "T1BC93025F9B6871ABC6A9ED7A510C2DB7ED50A25058C847E95CECFE0C40F1246F70E14E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635956704, "uuid": "e451309e-8420-4cda-9bc4-9b0cb10c18be", "value": "1536:8CWiPZZKz/1eCzbqzLkh/OPvTFV7N8G+AU5eSNbBVwzRwcIe7sNhwQbC:83yEz/9qGWPvZV7yT5eSNFmw87sTxG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635956704, "uuid": "b2ce1dd1-a4fa-46b8-bb95-239907112a25", "value": 92940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635956704, "uuid": "13f56b1f-6bd3-43c6-ac45-c60cac4d3fa9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635956704, "uuid": "34ecee00-5da5-441a-8df1-f2c7596fcce3", "value": "Order_69788.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8246d16-3ca2-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635943065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635943065, "uuid": "98d97083-f25c-451e-b598-356094773f2a", "comment": "Malware payload", "value": "090d0fbe9a4a6b95835d54f2aed73e04", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635943065, "uuid": "cf067502-d2ac-41bf-9ace-9b0d123a398e", "comment": "Malware payload", "value": "915afcd074d35cb9f074928939a9a7b6752249e1ebfea30f8e1e1591ea98e543", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635943065, "uuid": "614a0542-7faa-4839-b4be-dae1a19cc2f5", "comment": "Malware payload", "value": "41aa3a63fa01e25adaed20a9e013c45ad27c503d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635943065, "uuid": "c368ab7f-f9d2-43bb-b311-59fcd606efee", "comment": "Malware payload", "value": "34f249faadf451c24a80e942e42130046a52f4307b2845338c0c55e0f71ffc47034f928e83ad6a3d2c87e9088fbce1fb", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635943065, "uuid": "9490fe63-7972-4efc-a6fa-22fc457dfb30", "value": "T192F2E03DE614F111E22BF8BEF26412F0F5088001B1A1C06F1596F75E4BB02939ABBA4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635943065, "uuid": "56367e80-dd78-45de-ab34-5b75ebf64472", "value": "384:TeT49JYUAvqZZjGnv0GBGOngj0EEYpcVhE1ltmTV/YZO4NSCWl822TnU6SdesybY:KUTZjwvXnf02VWnZdw9822zG+tDGU4P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635943065, "uuid": "429f0e95-b727-4f96-bc2e-849067546837", "value": 34983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635943065, "uuid": "a1df74db-e008-4aac-9cc1-e7704d41f1d6", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635943065, "uuid": "8954b148-23f9-4500-96c3-7c6996c407d2", "value": "tell.010.21.2021.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "611969cc-3cdc-11ec-843c-42010a9c0014", "comment": "Malware payload (Hancitor)", "timestamp": 1635967776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967776, "uuid": "a77630d7-e342-4115-9d2e-5dcd549f004d", "comment": "Malware payload (Hancitor)", "value": "ee6533a8f2332056197ad12ca7c945dc", "object_relation": "md5", "Tag": [ { "name": "Chanitor", "colour": "#3242A0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967776, "uuid": "af63c2c7-0208-42eb-a8d5-82a6d76ab355", "comment": "Malware payload (Hancitor)", "value": "915ea807cdf10ea4a4912377d7c688a527d0e91c7777d811b171d2960b75c65c", "object_relation": "sha256", "Tag": [ { "name": "Chanitor", "colour": "#3242A0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967776, "uuid": "575ed609-d197-46dc-a7a4-15261c62051c", "comment": "Malware payload (Hancitor)", "value": "569ea04796550cf0f8811e2a5aad4b9d1552aefe", "object_relation": "sha1", "Tag": [ { "name": "Chanitor", "colour": "#3242A0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967776, "uuid": "7f92a87f-3c7f-4465-abbe-d021bfb1aa10", "comment": "Malware payload (Hancitor)", "value": "9b3bd77d3c3265b5639475787ae04dfb9b7a5a3e146059f9da97fe76bc72511db9da24c6b64db3a8050e1a4ee9d1d78e", "object_relation": "sha3-384", "Tag": [ { "name": "Chanitor", "colour": "#3242A0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967776, "uuid": "351bb727-47f6-4a9a-8515-1f36950bf7da", "value": "T167C40103F9959F57E51BC3B87E628C696B6DED494B08B7CB10307F0EA7B43609C4264A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967776, "uuid": "1d17b9b0-df2b-461d-88fa-669187d5c996", "value": "12288:DV9iQsDr8NQ0tEILt/5J0RiCFNpQU0czc:DVXkr8NVnLl08CDkcg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635967776, "uuid": "3d9f480a-22a8-4cf2-b75f-a2cced2125cc", "value": 589312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635967776, "uuid": "1140ddec-5635-4f5f-be5e-eac7e690c702", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967776, "uuid": "1b4e5254-1e8c-4f28-8aad-9e643e393c13", "value": "1103_788528522604.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "176136d8-3cbb-11ec-843c-42010a9c0014", "comment": "Malware payload (CoinMiner)", "timestamp": 1635953479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635953479, "uuid": "19269c6c-52b7-41a7-814e-37809aaf53e2", "comment": "Malware payload (CoinMiner)", "value": "9e3ad5829733a008a01b1814ca502b86", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635953479, "uuid": "36ecb9f2-e299-4230-b529-2fc77627147a", "comment": "Malware payload (CoinMiner)", "value": "92977c656b167ada3e570f4873e3edc37185486a2bc27eab4f9ac179e220c7a7", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635953479, "uuid": "4d362469-93e7-4646-bd15-ffe5b3d53795", "comment": "Malware payload (CoinMiner)", "value": "3c84a70c376c41783498690ecb754cb5d3757446", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635953479, "uuid": "1dd9e9d6-e019-4a49-a52a-d80e217ac4d8", "comment": "Malware payload (CoinMiner)", "value": "85193ec9b90fd42284a51a267b7c971c905544186dda403f72a1186cf859be9bf79046ce76203bf63ff6570b661755ed", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635953479, "uuid": "3fa6bceb-8d2f-4186-8d40-5d1c8f9ccf05", "value": "T1EB9533E8C2794FC0E4AB60FC9588561D0CA665B664E07CB30D086DC19D1B3BDF69E23B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635953479, "uuid": "17d5912e-d529-43ca-b561-3bee5511ca49", "value": "02549ff92b49cce693542fc9afb10102", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635953479, "uuid": "15aeabf3-1726-493f-9a78-fb2a0a1ccdf7", "value": "49152:U0d8XG6MtvISq3NuPXmhN774rYFopr9AmxKYSUFZPolkSOh/LUA03R:UGSMtQ5uPWz4gGr9AmXZPolkxFLt0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635953479, "uuid": "1959de22-333d-4fff-b5b0-2d6fe3808990", "value": 2042880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635953479, "uuid": "7dffc8c3-6226-46e1-ae6b-81f87d116b19", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635953479, "uuid": "7aa02558-5d0d-4d0d-b532-3b20b975eadc", "value": "9e3ad5829733a008a01b1814ca502b86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a619f008-3cab-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635946846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635946846, "uuid": "b7d6f34f-b910-47f7-bb5f-a27c1b6a5e1d", "comment": "Malware payload (AgentTesla)", "value": "dc69783a40cc3ea1ec3e42991e27cf0e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635946846, "uuid": "afff2c0a-b594-4e4a-9564-de69fe44aa3d", "comment": "Malware payload (AgentTesla)", "value": "92ab60fe91023a6dc12751688be746888f51bca3ee67de78cae1893b0f7c8d36", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635946846, "uuid": "c6e7c9a3-aa74-47cf-9766-a0b48b75583f", "comment": "Malware payload (AgentTesla)", "value": "1464b1abc1a42226f69d959aaf53384ee3a17270", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635946846, "uuid": "b72b5ab4-5046-4062-9ac0-b5953c68e43e", "comment": "Malware payload (AgentTesla)", "value": "ca63cf26cc0c33050825fc5526a38c87105035977fd46136e2287cc821f08636eb142e54c10f7db02b820cd2beb970ed", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635946846, "uuid": "822aadfc-a5df-45fe-a3ca-71dfd8f6848f", "value": "T187E423B287C5EAC2D20B43B9E610B2E019445BABB6EC971EDB1BB1DC52599057CDC0FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635946846, "uuid": "62e50cba-8ed0-4711-aa35-b4041f24e5bb", "value": "12288:rFiw8WJ48cg8O3WHIKUw2hZ4UVhbeMTm9EAgvSubRNlIkgNVNUNzG62jFdyO9:Uw9JWSWHhU/ZHdSqLau9NjgNVNUwbjF/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635946846, "uuid": "b1aa4bb0-06c5-4cbf-9337-104b070cdaee", "value": 671372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635946846, "uuid": "fbe3e5f1-674b-4275-8f79-c91dce36974e", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635946846, "uuid": "9130e505-5382-49b6-96b3-ba6a35696583", "value": "statement of account.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3560873e-3c88-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635931625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635931625, "uuid": "acf45228-9027-4aeb-981d-2457f481a3b1", "comment": "Malware payload", "value": "702246480598fe9b93a9ae1349b4402e", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635931625, "uuid": "300989e4-a46c-48d2-a269-04da3323b259", "comment": "Malware payload", "value": "92e02f07f16d0a1b8f3e91c6053f298a0fae34623f6e56f7689c547c254e47ab", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635931625, "uuid": "0a3bd630-9ce8-429e-8392-64ad449bd110", "comment": "Malware payload", "value": "ab2f52289dc99f26a88d55d41eb5582f808c5408", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635931625, "uuid": "ccf1115f-fd1f-40fb-98be-be89a6333572", "comment": "Malware payload", "value": "8e9df266f20898db114c3834d11669d8476827e8a38aba7670a36f1ff9602a70718d47bd584c59518e0b2d4d5b13361f", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635931625, "uuid": "e3fc0b58-21a2-45f3-8c51-c1cddd6aa40d", "value": "T183447C513BC9C13AD2AE063785BA9B66363A7D710B30D0CF77947D6C5E306D2AA39342", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635931625, "uuid": "8318aae7-785e-4103-a2e1-5ca8a95572aa", "value": "3072:bsspAtOImXwCGjtYNKbYO2gjpcm8rRuqpjCLw2loHUvU4yGxr53qM2a8tIrU:bStOIiRQYpgjpjew5LLyGx1qo8tIo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635931625, "uuid": "03018ef8-eac0-4a1b-b47f-3e179a7701e7", "value": 266240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635931625, "uuid": "e1bffebb-2c06-48da-add3-8598d370862a", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635931625, "uuid": "1de03fd2-90f9-403e-bbfb-fb5f6c83d567", "value": "Documento-PDF65422515373.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a18acd66-3cae-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635948127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635948127, "uuid": "f37f46ce-b981-4454-ba0a-4722d8381abc", "comment": "Malware payload (Formbook)", "value": "b94efb11bb057e324e00967a077a9c3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635948127, "uuid": "82d8e520-fe5f-461c-b100-ae2e2c895914", "comment": "Malware payload (Formbook)", "value": "93570be59d8c3f3608ffe0b137503c6555e6f40514af2c22989fe61a2394ecd5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635948127, "uuid": "7c1fac6d-4d52-4ff7-b22d-bf07552b868b", "comment": "Malware payload (Formbook)", "value": "a96358b10168fce176481019f26e9d331c03ee57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635948127, "uuid": "0d6e5d11-06e9-4cca-b99b-c01f0ac3b037", "comment": "Malware payload (Formbook)", "value": "399ebf24da03db92cd91724bbba050d63b983a0a2e25cea03d6fbdf5a823b8a9e69df2ecd0363882ed9343164cae5855", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635948127, "uuid": "f97448e8-63cf-4a97-b3cc-fe73056993ed", "value": "T1CCA4F18631AD4B24C76CB7F460E69340BBB8BD3A1422E54E1DCA71CA597B3118F71E87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635948127, "uuid": "825e7463-435b-43d5-a9ab-ff60a9267cfc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635948127, "uuid": "af2d5123-33f5-4688-bc18-a8d05c036e68", "value": "12288:67Ibw8eGNElI0/6Fj4v2Z4HjxGGAuDl31:6Mbw8eG2lfSj4v2ZQTb31", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635948127, "uuid": "9501d534-0038-4684-ab05-12c47fed6fb5", "value": 475648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635948127, "uuid": "f4d83a19-2a74-4125-830a-a4bfc1fffc51", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635948127, "uuid": "d6726d3d-2a54-40ec-a371-cf6179b5961b", "value": "BANK SLIP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a994a44-3c83-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635929432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635929432, "uuid": "7e1c6949-7eaa-4856-96e4-d362564ad2f9", "comment": "Malware payload (RedLineStealer)", "value": "d549bdaa241387d09550d79742bc5c66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635929432, "uuid": "bf9d212c-c015-473d-9970-2224b60c5790", "comment": "Malware payload (RedLineStealer)", "value": "936fec4f4692c9198d5e16e5dfb8800e02235cf053a3580fa4dfd5e6907cbae1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635929432, "uuid": "0e7d98f8-3907-4d7a-94bb-042dca1d9d1c", "comment": "Malware payload (RedLineStealer)", "value": "52c51e8c39d61c89d9c2dbc7fc56209d5e52cd00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635929432, "uuid": "997cbfc8-4795-46cf-a78c-e1ffa4399a3d", "comment": "Malware payload (RedLineStealer)", "value": "269398441e6fd303e8e75d59a60d9b304a382bcfbcdc2f782481b9622d1e329166d6600ec2cc90d230ddf388cf80a594", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635929432, "uuid": "bb775871-22f0-474e-bd21-3ddc6342b9a9", "value": "T12E54E121B6B2F872E49335304574D7B43E7BB832297051DB7BB42F6E8EB16804A74326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635929432, "uuid": "656a36b7-c4d6-43d9-9c20-057436ccd491", "value": "2d072324798956717a479868e71b5c9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635929432, "uuid": "0a553351-ec90-4d52-ab6e-058240df82c4", "value": "6144:IRHSnBjU6YQ7lTHPlQj33uncG5U9nITFy:zhU6F7BNo32u6I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635929432, "uuid": "8f5d2812-7672-4404-90eb-d95709f4ddc3", "value": 291328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635929432, "uuid": "499da5a4-3a62-4fae-9485-82e175730ad6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635929432, "uuid": "691cdbc0-2d32-43dc-90e3-2e214a8fc2c2", "value": "936fec4f4692c9198d5e16e5dfb8800e02235cf053a35.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2caaf03-3cd9-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635966732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966732, "uuid": "5c18cca6-fa78-4adb-9bad-60706e63e3bd", "comment": "Malware payload", "value": "add7fa9119e32bf7b846fff3a6b9ed0d", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966732, "uuid": "982e6f54-3c7f-4e7e-ae6b-369b42a3cbd8", "comment": "Malware payload", "value": "93e0b4dab465ea87342e42a866572fa7446ec240f1f93b0e723133d871e80554", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966732, "uuid": "d8adbb24-9b41-485a-8706-5d5c707d123f", "comment": "Malware payload", "value": "2b07908e42a9f5dfcf6aeca60676bdb477d056b1", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966732, "uuid": "eda73367-280e-42b5-8669-e3e41be364a2", "comment": "Malware payload", "value": "aca5c3170e110339aa4ab6b989c2b6d20336baf0280497d1ff888b9fbe6603ffe2201275f9bc3dc61d64a15d6cbf25af", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966732, "uuid": "afb5f493-3839-4e48-be9a-c6bc8d8904f3", "value": "T1221412F53F63A987C6189D712F6B01469166EFC00EB78514E0347E958C7AEC30BFAA19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966732, "uuid": "d51ae91e-7c03-466f-8e97-8d3cec409d83", "value": "3072:H8RR7mVBULSclfvuwvroWwCjKbj18u6m+32RG7ZNkw9ef8eH4beSSDuyDR:H8RhmVBU5nbobj18tm+mRuew9eQaSNM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635966732, "uuid": "e28e32a0-ae83-4b53-b3a3-afd8807c6099", "value": 206472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635966732, "uuid": "a86f15c1-187f-4d32-acd3-2a130091d25f", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966732, "uuid": "7dc93c29-706a-4fed-9515-861419c570a5", "value": "PO2608.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad2c4ba5-3ca6-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635944710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635944710, "uuid": "91bd8876-0883-4380-bcfd-4817928c13c8", "comment": "Malware payload (Loki)", "value": "48aa6603ed22a5fd237f2fb39b3f673f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635944710, "uuid": "8f339887-269c-4eb4-bfb4-7056866f23e6", "comment": "Malware payload (Loki)", "value": "947232296936d9d634d7a6a28520fbf5e3f87474ae96d4068ee77859a3f160d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635944710, "uuid": "44385ea6-9a60-4b12-896e-17332f85ca60", "comment": "Malware payload (Loki)", "value": "7f4d333d40cec58194539a21a4c11c39904faad0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635944710, "uuid": "61cc0717-b34d-407a-aac5-50798a22534c", "comment": "Malware payload (Loki)", "value": "179861e67decbec6100b6dabb1fe27b1fac0ddf683b8556cc847cf3edcac678d6382f54b94036edfb97c10ca5f4ad41c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635944710, "uuid": "dfb06e7c-27a0-4ba6-b3bd-d25a26586a02", "value": "T12984F045396D8B20C75CB7F660AA8350B7B4BE3A1442E60D1ECAB1CE49773028F75E87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635944710, "uuid": "feb50923-1d8e-4b26-a36b-626b447690c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635944710, "uuid": "97ebdd02-0fb5-4960-8643-4216dad6ef90", "value": "6144:qcWD7MbwN2s7GQYiprBXLUNJjaZa/AQa7hvwxBtMM/cMvLaslTL:qfIbw8eGHOLcJjWlXC3tMtMWs1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635944710, "uuid": "b93efeb5-9264-4044-ad01-5758335d834e", "value": 385024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635944710, "uuid": "0bba5b2b-9238-4acf-94a0-de32050ab002", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635944710, "uuid": "7ae2202c-1610-464d-b9c5-0071cdce6273", "value": "NEW ORDER INQUIRY_B9020289.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44c35a3d-3c77-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635924349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635924349, "uuid": "9cbee258-441d-47e7-bcf4-b3b6feda748a", "comment": "Malware payload (Loki)", "value": "2db5998312d48c27bff9183910a9d5a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635924349, "uuid": "10a79a3b-bc1b-42ce-8939-c2f0c1049d3a", "comment": "Malware payload (Loki)", "value": "958d393ff5f1af2d061f3b682a1c133f4fef7bd2f6b4b86465d4152a71513b40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635924349, "uuid": "dbb0bc08-c41b-4adf-8b3f-6305e43e543d", "comment": "Malware payload (Loki)", "value": "421618feedae02995e48aad3cdfcae13414c16a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635924349, "uuid": "b6009da4-1335-4e77-b714-ba80074da9a9", "comment": "Malware payload (Loki)", "value": "5f558784643d5b8def980303aa6769839fee610b8161f264ed22701ade391f98d761d1f4994e821bb3b20cbb007ebb46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635924349, "uuid": "27424077-5de8-4dd2-beba-0c75dfeeaea0", "value": "T17794D0C1A3E58502D62E0F7090712D2092B37FAE3D08F68E6D9D79A776777C64160BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635924349, "uuid": "0eaf68a5-9bfc-4e6c-bc58-c84200cff584", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635924349, "uuid": "2f65798e-ea7b-4576-a4a1-052f1120624e", "value": "6144:TvRRXQcenBgarTuoDjQkWkIrqRyn4QY04mIMY7H0pzOgIMdoW0wvl1P:L3WrTl8kWnqRKYlXj9gNP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635924349, "uuid": "0eca764b-60d1-46a7-a66f-43cc1085f5e9", "value": 416256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635924349, "uuid": "88f0cca8-dfd1-4cf6-a884-eda71712d9c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635924349, "uuid": "fa3b69bf-1e8a-40f0-b1f3-2252c05995f6", "value": "NEW ORDER - WTCL01 - POR015409.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f136320-3cd8-11ec-843c-42010a9c0014", "comment": "Malware payload (GCleaner)", "timestamp": 1635966027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966027, "uuid": "b3151e76-7e1f-477a-9124-ea19ff56d8d1", "comment": "Malware payload (GCleaner)", "value": "4ea672ca05b3c1e7d131ecc108c7e7f1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966027, "uuid": "c9d07f00-f51a-480f-9bd8-4f287fe7fc30", "comment": "Malware payload (GCleaner)", "value": "95972f593721107647a703bdd022f36f88737204c2ad575a77c25acfc2f21d4f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966027, "uuid": "cf934d4c-921d-4e69-a4c6-9170e6e28ef8", "comment": "Malware payload (GCleaner)", "value": "e816730b9fc1cef43ae269452fbd60dc7a178c3a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966027, "uuid": "06a015de-846f-4757-a126-48ca650c96b9", "comment": "Malware payload (GCleaner)", "value": "acc454167213417dbf82281e1e9a90e8784b16f9255883f455a151788446df698ad8db325142d5f3c6846abbfce8cf7f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966027, "uuid": "a390ef02-3f1e-458b-a4bd-4599f9bf410e", "value": "T1B5043B386291B436E4F30435A4ED97F598687A3067948CFBB7854F2E0B796C2D630B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966027, "uuid": "1ee53d24-beb3-4860-ad46-95044ca1d772", "value": "2c02c1999142edb52caad79376c81ce6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966027, "uuid": "69fe6d43-0487-42c0-b1d8-08fa3a4d0d23", "value": "3072:LSftzo1YmKFiiIKhb6xKcB3bV3g2Zh+15/yyvcOGkXOxTxoAHL+laxn1955Nh8uq:8H4qMxKeV3PANyyvcOGkXYTxjil61b55", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635966027, "uuid": "df7a83d9-b27a-4e15-8fc0-b465fb97e3b3", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635966027, "uuid": "c9a0ba40-a845-459d-b254-309bcc540999", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966027, "uuid": "71f17ade-2498-4f0d-8ace-508f88fbc81f", "value": "4ea672ca05b3c1e7d131ecc108c7e7f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d701044f-3c70-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635921588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635921588, "uuid": "0d80d06f-c595-421c-b49c-ee465dc868ff", "comment": "Malware payload", "value": "dac2a8cf85f8e5d3577a37100593ac41", "object_relation": "md5", "Tag": [ { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635921588, "uuid": "19564b0d-5a87-4d31-913a-c108ae071fa9", "comment": "Malware payload", "value": "95ad01f767b60c2d0c633ab33ecf38237dacb9b48b2dd3b50a8a244f61e9d2c1", "object_relation": "sha256", "Tag": [ { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635921588, "uuid": "594f79ef-7c6c-4c5d-acd4-18eb27515692", "comment": "Malware payload", "value": "7a32873b49b31ec13cb0758630301e1fa9e2ec57", "object_relation": "sha1", "Tag": [ { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635921588, "uuid": "f81a7416-f630-47d8-848c-a0dffba94485", "comment": "Malware payload", "value": "db19ddab2455f14ec843a063fbf0a4141121281bac39f54314293b585d1a99ea31e14f0c3e0b940670507b21b777f219", "object_relation": "sha3-384", "Tag": [ { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635921588, "uuid": "a2fa0d18-324e-47a6-9359-dc176583e0f0", "value": "T110A302ADE0D1381DC0FB94FE838D2CB1A4790B1D5846FA297DBD52285B6518FBB8F054", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635921588, "uuid": "610ecade-f2d5-44b6-971d-05013b2d3906", "value": "3072:83WFzIsj8aipSW4vHREQ4iZKUb+95jS+HNoq48q:8rOipmvxpZ8952+Hjq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635921588, "uuid": "98a05bb5-9913-40fa-a317-c01d47ae8740", "value": 106536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635921588, "uuid": "6ca2145b-7f81-4011-b840-fbab808ffbb4", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635921588, "uuid": "11fad27a-2ae9-450f-9294-991ee726710e", "value": "Bill_66803.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8ba5f09-3cae-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635948193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635948193, "uuid": "ef3205b5-cf4b-4bd9-b9f7-2391c073e128", "comment": "Malware payload (AgentTesla)", "value": "d9483971a555673e46304ffd1d85c6da", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635948193, "uuid": "ce238a5d-a5fc-423d-bb5e-c5c7f4f3f146", "comment": "Malware payload (AgentTesla)", "value": "95f4761892d3a8ff33e50993c4deec598933dd024b3427c5b34ab5119de3b490", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635948193, "uuid": "3e939ee4-a594-4924-a2c5-5bb7e95918e5", "comment": "Malware payload (AgentTesla)", "value": "50844812c25a28885a53c3b27f92f846f093f280", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635948193, "uuid": "bf9e978b-2e3d-489e-a766-bc35482afe3f", "comment": "Malware payload (AgentTesla)", "value": "66dc2081ae8c1ea103eaf3479955593e41b8567dd5bc0ad2f065dd63d7f7f2c01e732c871663f938a87e4bd12f21366f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635948193, "uuid": "576de5fa-f7ef-4661-90ca-6081be73c308", "value": "T1B3A4F142356C8B25C72CB7F660EA8351BBB5AE3A1502E60E1DC972CE4A733108F75D97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635948193, "uuid": "628b0a1e-1f1e-4e59-8218-d949c3da0271", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635948193, "uuid": "6a30f6c7-3243-4c03-9e9a-93be4e54b038", "value": "12288:pJIbw8eGtPMJK5AjlK0RNzEMWjMEFuXyz1:pSbw8eGr0RNznWjhFuX41", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635948193, "uuid": "b0bc2929-b63d-4002-bbfd-bc1475aa031a", "value": 492544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635948193, "uuid": "209b0b94-d94f-4f58-9c75-59928355d18d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635948193, "uuid": "7fc2f5a0-b91f-4ee2-8048-c180012c0bd2", "value": "payment details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adabc63f-3ca0-11ec-843c-42010a9c0014", "comment": "Malware payload (Kimsuky)", "timestamp": 1635942134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942134, "uuid": "899e5421-a756-4b6a-ad23-c4ad7b6371bc", "comment": "Malware payload (Kimsuky)", "value": "1305506bc1777f82315412c9faf71b63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942134, "uuid": "3de21019-04d5-4ede-a51f-8421b01448e1", "comment": "Malware payload (Kimsuky)", "value": "96845370215310f0f2c8ed848e2579a5276e44e50db746b8fb0e75dfe277fcbc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942134, "uuid": "8eb78a21-e7f5-4706-a305-301d151a97c7", "comment": "Malware payload (Kimsuky)", "value": "a927fafc81daceecb5342a76129961332ec34428", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942134, "uuid": "c74ff436-398e-46c0-a695-5a9dac77bc55", "comment": "Malware payload (Kimsuky)", "value": "ecafc666de367f34efce863d964e934204549e46724313d5de24dc0bc8a81dc614f41b6cd9dd726a3a08acb09ae921d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942134, "uuid": "c3c231e6-d44d-4071-bf83-4becc1b2bc48", "value": "T12DE3490677A400BAD49AD138C9975B66E3B27C550330A79F47A4B7762F333D1BA3A321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942134, "uuid": "b3d2a526-1c7f-49ed-9d80-2b6bd470d2a3", "value": "1ba0d91983b9709aa1b7c73a4e27512c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942134, "uuid": "56036f2a-ec4d-47a1-bdba-4820d31c7ba6", "value": "3072:wrM7op1RfB0lA/I5rMkchTJzwnENeT+6HhWF3ft9AIbA/HB:KBZychTqEERHhWF3gIkfB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635942134, "uuid": "edb2eedf-2816-4f3c-bbaa-97c08185b971", "value": 152064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635942134, "uuid": "649d0959-3c02-4e83-b645-2cf4a2ef4110", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942134, "uuid": "9123fa79-1aea-4f5e-bd6f-98214af534ba", "value": "96845370215310f0f2c8ed848e2579a5276e44e50db746b8fb0e75dfe277fcbc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "983f568b-3c6f-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635921053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635921053, "uuid": "120ab176-9850-4838-9ca9-76c750d2c7c8", "comment": "Malware payload (AgentTesla)", "value": "34f28cc926e4b5b2904637bf2b77abcb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635921053, "uuid": "49fb0e29-5ca8-49c9-9bbe-c9272b1ab182", "comment": "Malware payload (AgentTesla)", "value": "96bdfb2985bbe71afa145991d761de0c11a0106e43fd5932e1dfd1fefc5f9c3b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635921053, "uuid": "bc8dbda5-8862-47a9-a158-72e88ab2b823", "comment": "Malware payload (AgentTesla)", "value": "7ab858f9f8fd63b075fdb8017ae67ebacb7dff41", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635921053, "uuid": "1d818e1c-2aec-4b80-80d7-2edfd7153e90", "comment": "Malware payload (AgentTesla)", "value": "f108578ec7c0949c39559d3f8af54facfaa368cd2850b33d18611a27a9b02966578f2c6a84968742a95cb067df87eb1e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635921053, "uuid": "46cb3cf9-db5f-4f73-a0a4-c83f96fc2ed6", "value": "T1CE055930B35D8D89C6FC3334CF25E1B117A16C6E26108A1924F43DFBBABD65366316A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635921053, "uuid": "7f81a376-961d-48c1-8684-ff29ec6feed1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635921053, "uuid": "57760307-9b97-4e2a-9e5d-42ace69a0907", "value": "12288:4a32KVcXya8QwOlWJHuyO26s5auFWx1syuF7EzqZEJNLTei0:M7XyaRVIJHuH26s5tFq1syuNNZEnSi0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635921053, "uuid": "b8e3e947-7f9f-4242-a5f6-becad1abbb02", "value": 864256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635921053, "uuid": "897be6b8-9a80-4580-bf8b-522816312b30", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635921053, "uuid": "1c8d8def-d6fc-4ee4-b379-c184847c39ab", "value": "TRANSFER SLIP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dd06c1b-3cc6-11ec-843c-42010a9c0014", "comment": "Malware payload (Socelars)", "timestamp": 1635958187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635958187, "uuid": "1acde8bc-f143-4cf7-98b9-8a8f3fc1eb04", "comment": "Malware payload (Socelars)", "value": "2ba1dd330ef73ab2e48faed5a7e70492", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635958187, "uuid": "2d909f48-9d6e-45f3-b243-3f0cad69bdff", "comment": "Malware payload (Socelars)", "value": "96edac817bfbdfa36ad06884077dd1de14bbd0d0999e9771aa10021f8835ccb9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635958187, "uuid": "63470bd0-d749-404f-9291-e50f33fe0ba4", "comment": "Malware payload (Socelars)", "value": "82fcb1851caee98444d6f81835edca7ce4f457b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635958187, "uuid": "9aa87301-58d0-4b7c-bde0-9cba3a6bd268", "comment": "Malware payload (Socelars)", "value": "ea1b22967d25687ca1a5347a32d1011a37f243239388224b69849d10041e0ef60aab0d07fcbf81cca46ebfaa148c5677", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635958187, "uuid": "bd6b9424-db7c-428d-922a-80baf8705267", "value": "T131659E11E642A036ECE3017282FF4AFE8D2CB621431854D7E3C46D695E619F37A37A5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635958187, "uuid": "03cb0b5e-26c4-44be-8d26-7d0b58334c99", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635958187, "uuid": "07a06757-1e11-49cf-b90b-e54fc6a02f0b", "value": "24576:d/JpUQbEvIaIhGAxIRiMAvsRQVU2xb76btVBnQIEdb5JW:bprUzfelI7BnQIEdbLW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635958187, "uuid": "bc50b278-98ad-4209-b0f5-582a827d81f9", "value": 1490432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635958187, "uuid": "3b977513-8fa9-4963-8f19-9172573bf7c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635958187, "uuid": "f3037e80-7f7d-4c0e-ad45-b707cf739c82", "value": "2ba1dd330ef73ab2e48faed5a7e70492.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f308f4d2-3c4b-11ec-843c-42010a9c0014", "comment": "Malware payload (NetWire)", "timestamp": 1635905743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905743, "uuid": "cdce19f8-fd22-4964-a0e7-7c8bcf40ee61", "comment": "Malware payload (NetWire)", "value": "e296446578790b7f09977f2654cdcd92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905743, "uuid": "065c34f7-8efa-4478-9e57-17793ae8b009", "comment": "Malware payload (NetWire)", "value": "97c7b0acbb0d187d280e20cd3ac147295ea599462d57f0d56488cda19fcaf3ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905743, "uuid": "c8ea1cf8-639f-4bc6-9c35-6708020a1d94", "comment": "Malware payload (NetWire)", "value": "062f06a29a8215409ff26e9678e6c2b43cee6204", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905743, "uuid": "ab044f78-ade8-452f-9cf6-64fe8c89ac36", "comment": "Malware payload (NetWire)", "value": "1e969e728f3d497ae22fb2c01bb5d795e22583b32af028c9eb45f57c817b4f317ec7d9a7f5f44532019dcac98f0e8420", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905743, "uuid": "de3703fd-0423-44cb-ac73-a976c8cba110", "value": "T1D7D48D83EAC16116D9358EBC91644E307256EC3B7DE0F316ADE4F05E2A3BB818C52797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905743, "uuid": "71e4a3bb-9650-42a6-a0c4-a0ec77f7b93b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905743, "uuid": "2991b403-940b-446c-95d1-77096d8e7af1", "value": "12288:quTla5JgRDtdRtJX15+oLaA8wSK8gzizdF:3TUL+Zn15V83gzu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635905743, "uuid": "7b648259-c2b9-49d6-8faf-a3cbfd5a4b72", "value": 626688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635905743, "uuid": "3cf4093e-6a3e-4b85-9be1-111ec09fd064", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905743, "uuid": "b8571ada-61e6-438b-880f-bae16445bc19", "value": "PO Doc 209173.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9bc121b-3ca4-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635943873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635943873, "uuid": "5b6526c6-4eb1-4a65-afa4-41a3b6f64f21", "comment": "Malware payload (Mirai)", "value": "d6d5b7ffa3092a9802841b44471032ec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635943873, "uuid": "4ab7cfd5-2744-4068-b104-3d7d6a7cc459", "comment": "Malware payload (Mirai)", "value": "97cdb1842a81ddd2f8844e9ef6b13e5ac76f7a7eda377c28b4bc01e9dcdcba12", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635943873, "uuid": "ef60e114-7ef8-4fd4-aa8b-24eea220cabc", "comment": "Malware payload (Mirai)", "value": "d23d83d8406280ca95d0632552987009fae2244a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635943873, "uuid": "91309811-2991-4fde-9119-c272f036f9ff", "comment": "Malware payload (Mirai)", "value": "c7ac02391f42b8cc21cd9a3c593158ffb87b2102bd9143452c2b072ddb3da44740a145041668363033d397aac4d13d72", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635943873, "uuid": "8ed8ab11-3a38-4c65-a670-72f1f827b88a", "value": "T16833D79578D25A2AC6E4237AF9AE40CE332073E8D1CF3217CD151B147AD592F0DA7B52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635943873, "uuid": "7be9e4d7-07e7-411c-8c6e-e1a4ee65cf19", "value": "1536:S5Z4fJ6tL/yXFeL5zvL5nrHwcA7WhKpQY:S5ZIs5LL5nEcAihWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635943873, "uuid": "eae983e6-d4db-497e-8ce6-88cf349a61d1", "value": 51168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635943873, "uuid": "93a908c7-1b3c-43c4-8ea8-725537be6584", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635943873, "uuid": "4dcecce8-8e6f-48f2-9366-c8e61ea3ecbf", "value": "d6d5b7ffa3092a9802841b44471032ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b6fcb14-3c73-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635922615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635922615, "uuid": "a87fcfe4-468f-424e-ae18-1aa397b798b5", "comment": "Malware payload (AgentTesla)", "value": "e49783b89c08acff5013f6b44a657614", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635922615, "uuid": "07aef71d-bac5-4a9e-9f76-2d85aaaaac52", "comment": "Malware payload (AgentTesla)", "value": "97d89aae1488eceae84b696ace3fee7378e85c4f15d37c7f778869496d17bb0a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635922615, "uuid": "bfe292fa-7236-43ea-96e1-c2436d76b17d", "comment": "Malware payload (AgentTesla)", "value": "0f6d7b7aec28f14843519c787843eb3301a98655", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635922615, "uuid": "63a77bfc-b6bf-4acf-aeec-d4611c21c3fb", "comment": "Malware payload (AgentTesla)", "value": "6ee3289a6e207bfc8c1be606fa40a9bed022711bf64f1d54708b806ab72f7a0b05c11297f25b7ce20dbe34c27c1ec192", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635922615, "uuid": "d9bf8b65-72d2-4f38-ad23-1c3d9797a9ea", "value": "T13E45813174E8748CE9D6483084DC2C621D5AF973399AF15A90D3AC4CD47A087AE7EE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635922615, "uuid": "d4c79bd5-4b4b-4793-9e63-d9c6835815fc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635922615, "uuid": "de8ad8da-1bd4-46db-97d1-60c19b51624a", "value": "12288:0l7JVCvrW4rb9bRZ9bRoqJFTP1tqDb3SG+2FkTk99FATx9yt5QmDnPDdb+gKj+Q+:0xJVCvrWGtDtoqMb33FgRTsRt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635922615, "uuid": "8ea72822-9f43-4ac7-a2e8-2fec8c128013", "value": 1192960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635922615, "uuid": "247b73f2-f3c8-445b-b6d2-3c10f0be4ae9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635922615, "uuid": "e2705a69-32d3-4de9-8cd0-02a327704a28", "value": "Ship details....exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ea2799a-3c9e-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635941196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941196, "uuid": "15646b38-e60b-4315-84e3-dcf3e8150d4f", "comment": "Malware payload (Formbook)", "value": "ffd35b1b25dc314e2dc8f85e8f9b4496", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941196, "uuid": "a151f4a2-8799-4215-9aa3-02f6a2285774", "comment": "Malware payload (Formbook)", "value": "97e2308f489be583ecaa74518e3c42be2da1e3f61347b983eed293ce3424a5f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941196, "uuid": "2aa1690e-9184-48d5-bd80-f5f781cafcc5", "comment": "Malware payload (Formbook)", "value": "3b026a316aeb62a216bd7a4a318183ceed9e4b1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941196, "uuid": "2d0b7706-9b2c-4874-9385-72d6f18afe86", "comment": "Malware payload (Formbook)", "value": "21e86c3d68e96a809e5b67428db2dadc820abcc856e6912854a53473becff96129c816f2f7048907cf19b4f32e58891c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941196, "uuid": "aca620f7-e51f-4dd7-86cb-0768edef4a11", "value": "T15E05CF4530B9AA8CD719ABF310E482007FF1AC29595DE20E7D763BDE09773412E75BA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941196, "uuid": "798fb3c8-e17e-43b5-b83a-3ecea04e6098", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941196, "uuid": "447c5a0c-572f-436b-b9ea-c8e070ebeae0", "value": "6144:iXWD7MbwN2s7GQUKvxGLIGp0bxQrOA20azqJ2oMF4zIPdBhZBA6Oz5LS8J/b/BT8:iwIbw8eG2hOE2XnhUv+MnBq5L151", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635941196, "uuid": "9833019f-4deb-4f1f-8322-acf9e29ab6bb", "value": 840704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635941196, "uuid": "fde498af-b15e-447d-a848-4b262b9d42b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941196, "uuid": "57fd3b0d-28a7-4378-8f48-449ce78aa221", "value": "HIC INTERNACIONAL - DOCUMENTS(RFQ20212211).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c0f59c7-3cda-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635966908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966908, "uuid": "d718b17e-c143-4bda-ba42-77aa16e502a3", "comment": "Malware payload (Loki)", "value": "29ecd0305a61125e87690e58dea792f6", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966908, "uuid": "e2f5726a-879e-46a0-a14e-8a623e70e111", "comment": "Malware payload (Loki)", "value": "981b69a1e69723a5d2d5d31caf0664ff78231c860ccf1fd5ad8e1eb06b82cd09", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966908, "uuid": "841ab450-6429-4513-92eb-687c1c63d6c1", "comment": "Malware payload (Loki)", "value": "70aa084d66996db4686c76636be04f75733f2133", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966908, "uuid": "3ade9c8f-43fa-4e27-9405-9e50db7d0228", "comment": "Malware payload (Loki)", "value": "58cf8c6fe4a036bd421cb829680eb8c8006e0df385542f409d6cf243b830e13f7b7089ed3502c48106ae954800e24d44", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966908, "uuid": "8288b427-a0da-4d7e-b6b3-77496259f73b", "value": "T1FA1402B43A231788F662EB3804C9F8594B08FF0517A0873F2297BB1C07BD964DD35A69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966908, "uuid": "b22a73ae-4664-44d6-83cd-b2800ff1d265", "value": "3072:JFWWgAGxhi2dXJt9mDSGnId6Id4xENTM1BmexXIY4iC6ZGN1RcN1YQrV2W52jeup:JFWWgr3i2d2nAeENTM2ZkGmN15Jf5EuS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635966908, "uuid": "ecc42c35-3f6e-4e94-b4b8-ba1f704fabf7", "value": 206376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635966908, "uuid": "72ca6c11-0bff-4975-a009-269f9c72c0ac", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966908, "uuid": "2b26b91f-6030-4677-9c38-47004ae27b29", "value": "PI.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3de61f33-3c74-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635923049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635923049, "uuid": "59056cb0-ca20-4efd-82f7-7cf8fbd01de6", "comment": "Malware payload (Loki)", "value": "a404184b7b76aed9334e51806f40460d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635923049, "uuid": "c326363b-775e-4088-b90b-2df06384609e", "comment": "Malware payload (Loki)", "value": "983944bac685159da2c8b7e64f4c3f89c604b77b482d24a64d14f591b1f4aa2f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635923049, "uuid": "145f5249-fe31-4686-8cd8-7f922edde245", "comment": "Malware payload (Loki)", "value": "41fe5ed1fc3cda76128d3399c0e9b87ac7243d61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635923049, "uuid": "0e2d70f9-2f62-42b6-89f5-7c93c19600d3", "comment": "Malware payload (Loki)", "value": "c66ed218ebd34ef335d1af9f888544ec1cb3c8113b00a4bdc6273f96c4cf09d78c40f03b8708f9afec607f56a5587fb1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635923049, "uuid": "38a1f943-4dd0-4da1-b63c-a64c2ca92676", "value": "T1D084D0D292E48312D5A94FB410712D3143B37FAE3868F6D86D99B8E73673BC24121B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635923049, "uuid": "3628f647-14d6-491f-956a-e3295e7cb852", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635923049, "uuid": "1a3a80ce-313b-4b90-90a3-c277061a3f43", "value": "6144:CrvIl1Jga6TuoDjRimRnNALvMB55ysP1ajIXCihDiCdhaVj:C66TlQKNwMH5yslSciC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635923049, "uuid": "a9da30fa-db47-448a-9398-445d16a3b0ea", "value": 375808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635923049, "uuid": "909eddf9-fc79-4033-aea0-7f484bda6535", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635923049, "uuid": "ce77054d-9ea1-4b39-a823-ecb1dd65bed2", "value": "PAYMENT (2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37fdfd28-3c86-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1635930770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635930770, "uuid": "51436491-bd7f-4965-9d35-b626fcef98e1", "comment": "Malware payload (SnakeKeylogger)", "value": "64e455f3068810dc3f436cc64f458889", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635930770, "uuid": "dd30fc2d-1163-4a79-b0b5-5c4fa9f4fe25", "comment": "Malware payload (SnakeKeylogger)", "value": "983d88fd85614314aa9890ba0104ea9d5589726636140011249f7931c1e13e7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635930770, "uuid": "4e69f018-e8cc-4421-b84b-922355872119", "comment": "Malware payload (SnakeKeylogger)", "value": "dca5c7c31be2fdd52b64bff52eadb888bcf7d3d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635930770, "uuid": "536e7ccb-8250-435e-8f71-82390359cba4", "comment": "Malware payload (SnakeKeylogger)", "value": "eda6315529fb896fbe0081ce2ab7e96187ba252e3b90378daca6cfe2674320be711c758e8a5e175511b51011d973b803", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635930770, "uuid": "4579c464-096c-4c7f-b36f-704b5d81e7c1", "value": "T1D8C22A60B658053ECB2A4D37B0968221F23C6349F81FDB5938AB595E8DD33421A573BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635930770, "uuid": "f2c357eb-9578-40ed-adf2-2a1b28fe92e3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635930770, "uuid": "9915bb63-47a4-4f0e-aec3-0f119ac852aa", "value": "384:vSuS1xrHSDBHSpSQSaS3SrOrOxscc1Lf9rSVTo8HJi/PhMWVM0zd4qjJvJSm5hS:PvDdWSQSaS3SyAncALGPhSYdvJSmhS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635930770, "uuid": "7a729f43-35aa-4fed-9673-5ed94633b014", "value": 27576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635930770, "uuid": "42e21868-4ed4-4c99-b450-589ca8815e41", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635930770, "uuid": "faeaaf06-8542-4067-95a4-5e5fe2433bf1", "value": "amaert.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1865c98c-3ca0-11ec-843c-42010a9c0014", "comment": "Malware payload (Kimsuky)", "timestamp": 1635941884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941884, "uuid": "9bfe5caf-bdf5-4e41-9304-1e21de50c6ff", "comment": "Malware payload (Kimsuky)", "value": "c2a7b3722c3517b14986092fd61b79e6", "object_relation": "md5", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941884, "uuid": "f96b348e-86cf-4bd9-b123-ce502252638b", "comment": "Malware payload (Kimsuky)", "value": "98909e68fe603a86de5488b8f8860a33dafdace03eebf56f9d680a84c2b66521", "object_relation": "sha256", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941884, "uuid": "d9c1960a-f947-4fb0-b0a3-6a9c4b1afda1", "comment": "Malware payload (Kimsuky)", "value": "d5af22de750d7e3fc91dc154163019b7a245651b", "object_relation": "sha1", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941884, "uuid": "3c7e3998-82a4-43d8-a044-3dcbde564fe3", "comment": "Malware payload (Kimsuky)", "value": "278b1f2d53ba04d24fa5c49ab29d507de7344be5c3a8c21caf5bc5399724526ce19993c900fe69b2cd458725c6aa40b6", "object_relation": "sha3-384", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941884, "uuid": "d514f6d3-0a77-49f5-818b-006cbbc0ae99", "value": "T110356B02DAC08E67CC7D933EA9F747512331BAC8AB5787470249E6B1FC4B1D9ABD5188", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941884, "uuid": "adef1bfc-d018-4016-afaf-6168f762dd3d", "value": "24576:2S02/ie7ly0fjADF2j6TGRchsBiuvm0tlv2e3Tl:2R3eNf72FSB5mKDR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635941884, "uuid": "fed4e013-434d-452a-b3b0-6e15f802335b", "value": 1142276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635941884, "uuid": "3e6c305c-4b3d-48a8-8fa5-7afda3c878f2", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941884, "uuid": "454342ba-e68c-4c71-8600-ac6d43906704", "value": "98909e68fe603a86de5488b8f8860a33dafdace03eebf56f9d680a84c2b66521", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9611d975-3c75-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1635923626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635923626, "uuid": "c1995701-2f93-473f-a9ae-59d35be3ea59", "comment": "Malware payload (Dridex)", "value": "24d188b5deb52d7517ee307c110c1687", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635923626, "uuid": "87691cd9-b3db-4ef5-899d-cce5f4d4e6b2", "comment": "Malware payload (Dridex)", "value": "98bc46a08efba8e3e2ed017f5e3517a0f91cb63de1917b2259c7525bc293f542", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635923626, "uuid": "7f67a6ee-dfc3-4ee9-a0a7-e703b61d90be", "comment": "Malware payload (Dridex)", "value": "052046f41d1c35f8e2ba55f5207730e621011c06", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635923626, "uuid": "a14776c5-6432-4cc2-a847-ccf028694281", "comment": "Malware payload (Dridex)", "value": "30deda239894b03ea709435b823dfe020c686bfbc844a1be6497096ea935ea01cf92cbd5c4879de3436fe1d7d8e38ef7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635923626, "uuid": "7177b2e3-e6e5-4e11-b8f6-323a91be75b9", "value": "T11673F1ED9585F549C311CE7ECB2A4CD1D74A1EA79A4CE60B28967304BEB73430FAD188", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635923626, "uuid": "2bd75008-95e0-4387-b8f7-a1b17381e7ac", "value": "1536:8CWaPuALLImemeKHqeK7YncGk+xH3EZ0WaVVVVVVVVb8v6J:83R80XKUYQEXu0WaVVVVVVVVWu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635923626, "uuid": "95ed5a25-5df2-461d-a1fe-aef5883bd4ad", "value": 74099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635923626, "uuid": "da8a1bd8-f49d-4033-80a9-cf4debece435", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635923626, "uuid": "1be2b89f-982d-4d9e-8ec6-bfab3a4b1f10", "value": "INV 055091.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "209aeb34-3cc2-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635956500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635956500, "uuid": "f266cb3c-50eb-42f8-97cd-2347091c3fee", "comment": "Malware payload", "value": "3a7c205fa0ef5969ac10422bf5900920", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635956500, "uuid": "7d679e55-d80d-4a3b-8266-86ba499cb53b", "comment": "Malware payload", "value": "98c9baa39aed94e739d0066375b675244c021d3fda0e1c0080725db7cc390367", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635956500, "uuid": "d89f8252-2592-4a45-8e78-1e625ba3d3d6", "comment": "Malware payload", "value": "345b95ca1d2da825170dc2707d9768c1108935b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635956500, "uuid": "9a6166a7-ef52-4197-b71d-e6608b4deb07", "comment": "Malware payload", "value": "ac6d93a033ad7296d20544f7af25ad5cf2f08bdd238a59ce4eb6c5b021d90fe8f9434d3e851fcb15ac342a4277e8ba94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635956500, "uuid": "88d5be13-9c04-4a93-8dc8-d46559f70c9b", "value": "T1F1C43C2DA151C14EF48526B2CA5DED18DC02AEB0119854BE20E93C6E7A763A7DD4FF0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635956500, "uuid": "cce97eba-cc06-49a7-a3d6-4e04bac380d1", "value": "6cc3e683b5666aced638e14b55af8465", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635956500, "uuid": "fc3e31db-8106-4c05-8fef-e646e2246ae3", "value": "12288:6o/u7YhTXIw6gV7wL4PY2joHlSD3YlWJ2mxeSz46DF3PhHMF3:6o/u7YdXIw6gV7wL4PY2joH4D3YlWJ2H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635956500, "uuid": "6d2b9c66-ebd8-458e-a0c9-22274eb04d3f", "value": 584704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635956500, "uuid": "92031315-ce0b-40a7-abec-41d12306fa44", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635956500, "uuid": "d36568cc-6a69-4671-8667-d211eb1923c3", "value": "instd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f37ddaf9-3c85-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1635930655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635930655, "uuid": "0d0c2370-4c4a-4fdd-a442-de37fa517e96", "comment": "Malware payload (RemcosRAT)", "value": "de91e235669aed0583dd5ff40262d4dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635930655, "uuid": "8f39721c-c655-4c04-8a34-52aa74a47899", "comment": "Malware payload (RemcosRAT)", "value": "98d971bea4bbc94a366d1a4292199c3f001f17d4a00dd2756d234705f503998c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635930655, "uuid": "bdcffbfb-30c5-4c68-8a1b-c4213d060145", "comment": "Malware payload (RemcosRAT)", "value": "98ee38eabfaa1fcc9271e50de022887f1742bcd9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635930655, "uuid": "eae76186-5eb1-48cf-9c75-51ac579cf8f1", "comment": "Malware payload (RemcosRAT)", "value": "acad589ab75e92a40fb8e1eb3a1c8e7200f1dfd78b9e7377c5db89de8c24d679412507339eaaff497de742bb2ae20093", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635930655, "uuid": "ddfff044-06b1-489f-9883-3ff2afc3dbe5", "value": "T11FF4014A792D9B61C75CB7F1A0A58360FBB87D3A1403E66D2DC9B1CA0A377019E31D47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635930655, "uuid": "bcf97128-afdb-4286-9b9a-2a7e6549df8f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635930655, "uuid": "53c8ec77-8274-494e-96c4-34023db1c618", "value": "12288:+iIbw8eG3YNzSnFVpL1eMI9+dzYjg0IaQ3aKKGHTdDOi2qHBC1:+Fbw8eGKzSnDpddz+g0Ia6HVHT8i2n1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635930655, "uuid": "b9457b1e-1be9-4051-addf-b72d336f6d4e", "value": 751616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635930655, "uuid": "71803949-0b26-4f42-9faa-88ac58dde49c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635930655, "uuid": "18f9b3d1-ec54-49ff-b68e-05b795dc7387", "value": "NewOrderPO#960780MTQuote.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cccfbb3-3cbb-11ec-843c-42010a9c0014", "comment": "Malware payload (CoinMiner)", "timestamp": 1635953488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635953488, "uuid": "bfc940ca-f980-475d-9ffd-83333406a39d", "comment": "Malware payload (CoinMiner)", "value": "0ea242160e0b415f8a4713cbaba9e473", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635953488, "uuid": "728d6d72-f945-4ccb-90a0-b8ec60de10b5", "comment": "Malware payload (CoinMiner)", "value": "991a018f820da2612375d9c0a38ff605ff02f0f20132f2cea18b66ab11f6a193", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635953488, "uuid": "2c52c6c4-57e0-4ea5-8c2e-33a351825ab6", "comment": "Malware payload (CoinMiner)", "value": "f63b112a26c6b7c4743bac50956335f7f1a638e4", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635953488, "uuid": "8df04f5e-9a47-46a0-aa7f-5be29304619d", "comment": "Malware payload (CoinMiner)", "value": "8c414907311bc3932947400f498eefe1a14fb5033221661903acbd3b3a45ec87c3819343993331fe247e16ff9ea046ee", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635953488, "uuid": "c41ea259-2279-40d3-b9c2-a632a73cda32", "value": "T1799533F3D2D81835D20B6AFCA36120AED9B9C55CC53E32A281E35DC1C4B06B55295FBE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635953488, "uuid": "db2cc21c-ef44-4a29-962c-5ba34bf8e9bb", "value": "02549ff92b49cce693542fc9afb10102", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635953488, "uuid": "58e153a0-1c9a-45de-a779-8d224b81a21f", "value": "49152:dyWVWerzT9OCV6dt7H8wfGP5tLfjwn7rY+TXk5gZGL4:dyWQy5OCVCt4wfGzLiE+gsGL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635953488, "uuid": "6bfa60ce-7a35-44bc-bbef-6b92cde6ee38", "value": 2043392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635953488, "uuid": "808cf18c-7ff7-44f6-8e82-9ae12bb2379e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635953488, "uuid": "9e788967-ed1d-4112-8760-005c3dbba4df", "value": "0ea242160e0b415f8a4713cbaba9e473", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fb61075-3cd3-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635963935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635963935, "uuid": "a325805e-acc6-44c7-ae64-9bdddcc9e5dd", "comment": "Malware payload", "value": "4d663e29157024edecb438268eca5b0f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635963935, "uuid": "ba42a19d-f9a7-45a8-b357-651feba28dd7", "comment": "Malware payload", "value": "996e7eb302d89f9acb3aa842afed1651c35032e9f487f2bef20168c90525641f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635963935, "uuid": "04eb3df0-c42d-4f1d-859e-f6a577550e2d", "comment": "Malware payload", "value": "2985442e7f2c0ec7f2cde09470c65aec3ca48946", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635963935, "uuid": "ae8d8093-7cdf-4908-aaac-c2e07878bb37", "comment": "Malware payload", "value": "9d26c42a39538ce8f02a49d1feac7fd205214d8c4dcf066ec1f80143e19fdc39cf13fe648e17ef18c74d6257e51e02c5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635963935, "uuid": "3241cb82-23e9-44dd-a196-41712eb8e786", "value": "T12CA4BF04D1EA0676D52B62FE71FF0CCA47104DF9B506AC84D3435A6A5B32FEC3A7A849", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635963935, "uuid": "bcace127-30e5-4a57-9c4a-684d9e9bce57", "value": "ccdf79216449388cf5a36d38a385d866", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635963935, "uuid": "d1c1b506-0e9c-4641-9908-409f9b4bc515", "value": "12288:fZKEZNxJPdthZz/MqmOce24Wqa+cKdDSFczjJgiUCeoCqoE:fZKEr/1jhz17Px", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635963935, "uuid": "750f1551-7350-4394-9965-27c1ed939373", "value": 471040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635963935, "uuid": "7e36a43c-f4cc-4ded-b275-ea5c0f559491", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635963935, "uuid": "5bd07a52-c32e-4a1d-b937-16873d85c79b", "value": "SecuriteInfo.com.Suspicious.Win32.Save.a.31701.31703", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "616d335b-3c7d-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635926974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635926974, "uuid": "2d246a45-e029-4a0f-8618-2a09a5d35b61", "comment": "Malware payload", "value": "6edb5def1d82d09bf827d85cb42ab07e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "FreeBSD", "colour": "#75A699", "exportable": true, "hide_tag": false }, { "name": "Speculoos", "colour": "#0CD716", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635926974, "uuid": "bd50c36e-8efa-40eb-9e62-ab970f5b6ea7", "comment": "Malware payload", "value": "99c5dbeb545af3ef1f0f9643449015988c4e02bf8a7164b5d6c86f67e6dc2d28", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "FreeBSD", "colour": "#75A699", "exportable": true, "hide_tag": false }, { "name": "Speculoos", "colour": "#0CD716", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635926974, "uuid": "7a819205-f1b7-4b03-8acc-9126f5a253bd", "comment": "Malware payload", "value": "6d43b066cd188f4ca687e9c6d7f45d3df6ee3251", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "FreeBSD", "colour": "#75A699", "exportable": true, "hide_tag": false }, { "name": "Speculoos", "colour": "#0CD716", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635926974, "uuid": "4cc0e9a6-67ca-4947-b993-1365fd6f9d10", "comment": "Malware payload", "value": "73cff09322f96058119652eb6da3a0a5b286d4609b75a82f786b006d694cf5f16a9a73c473823a319552377b6e858727", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "FreeBSD", "colour": "#75A699", "exportable": true, "hide_tag": false }, { "name": "Speculoos", "colour": "#0CD716", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635926974, "uuid": "606a4bc8-2cf4-4c32-a877-b97ba8a6259c", "value": "T1E4F2D837CBA1CF3ED08A8AB92DDB04715677D0B5D33AF20FA544B6387D562A44C1E226", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635926974, "uuid": "603789b0-82af-42ca-8684-c8c48615e9f5", "value": "384:NXm0JfGGZ5gvCWD7eJ2T0ogu385kQ9W7cpI8mEzGYBW+YP:NXPJft5ICwCMfs5Ucp0JYcDP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635926974, "uuid": "12f6fc05-fb37-4282-aed2-f7f174f75114", "value": 34976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635926974, "uuid": "4dedb152-7d87-4d20-9090-6cc91d784eab", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635926974, "uuid": "2e528c3a-380f-4f05-b452-bb66eb98f457", "value": "99c5dbeb545af3ef1f0f9643449015988c4e02bf8a7164b5d6c86f67e6dc2d28", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58b0f60a-3cba-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635953159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635953159, "uuid": "2084b991-7825-4d22-822d-476303e77c9f", "comment": "Malware payload", "value": "eea8c7833f8322d29ff6c08a31ea8651", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635953159, "uuid": "3d8d9f7d-5bab-4609-9df9-624fee447db5", "comment": "Malware payload", "value": "9ab4e1fe6cf46287202fb8dc36fbcf8f1dedebecdb3e3de978973d409810ee32", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635953159, "uuid": "0f29e423-2a41-4829-8004-e2a4f0368f0a", "comment": "Malware payload", "value": "14322a02d716c7735b5ff40726e301ef610b197c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635953159, "uuid": "5d811b55-542b-49fc-ae78-b78f5f32b650", "comment": "Malware payload", "value": "92b9593f3b8c5ffbf7373e246b5960e549c747d5edb2275cacc3e7ea0955b97dbb58436c9c63cabf7b3199acfad8cbae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635953159, "uuid": "c825bab5-2d91-495e-887b-220f47abd37b", "value": "T1AA91D69BEF55DA6AC71F0031337302202BF5D3A1118106BFEA5846FEDBD2D96580B20D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635953159, "uuid": "0feddeaa-6547-4f20-818b-a91919a5d260", "value": "4bfde1223391e32fec766cd1d41fa3e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635953159, "uuid": "17e1d529-d147-419a-b548-2c403632413c", "value": "48:6Qe+ZNW3zJARzqVS+AcA/c5DqyxmEtxvAZv8B13aLlzUR:LZNGQqovc0Kxxv2kv3aLlYR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635953159, "uuid": "c422e16e-34ad-4e74-b552-911a0bf66782", "value": 4608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635953159, "uuid": "459f58cf-49c3-4978-a31e-9424f09afb38", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635953159, "uuid": "7c5fdf19-9204-48ca-875a-b60c09708a5c", "value": "eea8c7833f8322d29ff6c08a31ea8651", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d3c023a-3c9e-11ec-843c-42010a9c0014", "comment": "Malware payload (Kimsuky)", "timestamp": 1635941087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941087, "uuid": "c8486ed0-e5c3-4f2f-9f71-c89852296b82", "comment": "Malware payload (Kimsuky)", "value": "a213a2bdfb76bcb4957568f08f753b85", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941087, "uuid": "725a2551-5fe6-4c1a-95ec-e17cb8bf58e5", "comment": "Malware payload (Kimsuky)", "value": "9b3ef338629b1be626d3e8c5f8846888ea31bda04bca8dfaa3eb3ac19847e523", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941087, "uuid": "f260b809-7344-41fe-9f83-bf10f1480da9", "comment": "Malware payload (Kimsuky)", "value": "236dd12fad9d9852d8c44b65a3efbbd22b0a4cd6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941087, "uuid": "f5e07247-2809-4da1-a586-fbf9e9e36e14", "comment": "Malware payload (Kimsuky)", "value": "4dfcf307de3cad888bb116252b9cacfd3b50a0379781b34f76794557daae12f242972b123075cf9505a35ced8bce5453", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941087, "uuid": "f387097a-6fb8-48be-bed1-6dab9708054a", "value": "T1F3C5AE12FF8281B2E9DE417961A747BF4D3D59189320D8D38BE218A9DD312D1B63F389", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941087, "uuid": "516bf262-2904-4cb8-9c76-44ba340d034a", "value": "b66bca5781c0c2f0ed75956c9538733a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941087, "uuid": "fd7e2608-7654-4496-b422-57579b2feba1", "value": "49152:h/WnCslDTRBh1tpoy9gMv6eOXA5dpgg7anyhBTf9fVYuzSDIPvb6wO1BOa2byQK:hOnCkDTRBh1tC0gMv6mgg7anyhBTf9f1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635941087, "uuid": "2ba362df-f66b-468b-a3dc-a6326138f304", "value": 2621440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635941087, "uuid": "bdb06569-e269-4755-bfa1-487cf997a8de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941087, "uuid": "19672df5-1304-468b-bdf3-5507645c1c84", "value": "9b3ef338629b1be626d3e8c5f8846888ea31bda04bca8dfaa3eb3ac19847e523", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7cec537-3cd9-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1635966606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966606, "uuid": "745cc67b-6769-49b4-be9c-6baec3169a84", "comment": "Malware payload (SnakeKeylogger)", "value": "7d995de95bebcc28ba69afcb8d4afdfe", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966606, "uuid": "006b630a-b4a6-4aab-b9e6-ea0630328a6c", "comment": "Malware payload (SnakeKeylogger)", "value": "9b49b62977071085eebb17d9fd69c7b7bfbef857581b136fa365df00630ab7b1", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966606, "uuid": "b5a2ceff-269c-434d-bd67-9d965a691d2d", "comment": "Malware payload (SnakeKeylogger)", "value": "7df24c2da47ceec2839d688a5a06cb1bff75c9bf", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966606, "uuid": "59449acd-0166-47cc-8142-fa210b7556ae", "comment": "Malware payload (SnakeKeylogger)", "value": "7dfbe19f24496c921e6caffa3f6fd22ae8c3608b4c59e46567e0ec1bd3d2808ec9d1303848011ba72ddc36922e045678", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966606, "uuid": "76314c80-05b9-4da5-b5ed-5e783e56c710", "value": "T146B483ACD19747EC8FC9B7B46A1A1F891208B76DE344E5533638A7B12B93C7B9007874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966606, "uuid": "dc36f351-5d1e-4c45-8297-e6c04d9b9b7b", "value": "6144:qAiC2Gpqop+PHdIN7o/EZsrfh7qUdIR5JBmz9y0CDmNguJLxLrXgMqBJvg:F2GMo8FTNaxK9CDKgAQHBW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635966606, "uuid": "ebe9c8d9-96c7-43e3-a479-f19d000a47ce", "value": 515483, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635966606, "uuid": "80d7ffc6-82b7-4cd7-ad2d-0f41a0583d02", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966606, "uuid": "00cda906-0838-47cd-8954-6d54e0afdbd6", "value": "IMPORTS INVOICE.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3ec728f-3c99-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635939246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635939246, "uuid": "c95257e4-c765-4e64-b86b-afad72b0f0d4", "comment": "Malware payload (Formbook)", "value": "1fefc11b33956003889da1a5337179f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635939246, "uuid": "88f5b34c-c691-4497-8b74-f437e0b62f55", "comment": "Malware payload (Formbook)", "value": "9b4f227304980351439c58e4b8a29844c7929c11de71051cf7c79f348996e8b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635939246, "uuid": "bc6e20b4-ac1c-42bf-86cf-b586d65a4389", "comment": "Malware payload (Formbook)", "value": "01a2773637fa5eea87508ee768d7ccff9bd09f7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635939246, "uuid": "87d35923-0d7c-46fb-9a56-41d735f4a3c1", "comment": "Malware payload (Formbook)", "value": "4016c1ab600a6cc7127a6b1040141b5bf42ec6792141696ef7c28e56b8c2aaf2709730eeb5d4754e334155ebb9117647", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635939246, "uuid": "0ef022ce-e901-4bc6-9bde-0e60bc86ce9e", "value": "T14B641243B3D144B7E2AB02B81C76A369E7BE8C281531FFCA47CC1E39340A987651956F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635939246, "uuid": "ef9e5ebb-af89-4d57-bf38-142bafa0e643", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635939246, "uuid": "e012a62e-31c8-4b8e-8750-8ea790e00f11", "value": "6144:P8LxBakvtn3vSt5/QGLQMkuFkg3xJKhTDz+bj193o4PdbO:nstn3W5LxkyBuTebw2dC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635939246, "uuid": "a4d1289f-b522-4481-9e97-6c95e27cc10d", "value": 312127, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635939246, "uuid": "3b006ab1-1c45-48dc-afd2-c0fbb3150581", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635939246, "uuid": "804e988c-e16e-47d4-a079-41376dfc6fff", "value": "rfq.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8be03885-3c5d-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635913301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635913301, "uuid": "7169c84c-a569-4c01-bc98-f1c2c7694679", "comment": "Malware payload (AgentTesla)", "value": "8bb1ecc46795da314993f877a76cc11c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635913301, "uuid": "bf3dbe28-71d3-48b8-b376-f7effd7f9168", "comment": "Malware payload (AgentTesla)", "value": "9ba9df49f63179604559bf72824423143070937231c9c222fa1eeb902bac27ce", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635913301, "uuid": "0a12efbe-0ba4-45f4-af3c-e5e36efd43f3", "comment": "Malware payload (AgentTesla)", "value": "ac28ebbb19f529d8832095ec3a4b49cc84c8e980", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635913301, "uuid": "26d4d7cd-3f70-4a84-afad-0bf0be97e009", "comment": "Malware payload (AgentTesla)", "value": "b2498ccbf2a61844f327419c92a11c2276b5b5f591e0dd4221c820e7177145c3c6e36dff6fbbc02bdd17fd14b4a9b04e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635913301, "uuid": "3b066702-7dca-4a8b-b8a5-8b8c482098eb", "value": "T1A0055920F35D49C9C6FC3734CF25D1B117A16C6E2A108A6924F43DFBBABC65352316AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635913301, "uuid": "a9441d44-805e-4dd0-824b-a22e306f52bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635913301, "uuid": "396af608-d92d-4dec-9770-0efd9b5f698a", "value": "12288:KVgVLDt0vYwPaHLrY2qA8LHdGi6gh15yuF7EzqZkJtLTex0:keevYwPaHLc2CHggh15yuNNZkHSx0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635913301, "uuid": "84759cdd-e178-4cd9-bcfb-aa5c5813a89c", "value": 856064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635913301, "uuid": "b2f8eb18-adc4-4536-9610-28aca3d61b1f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635913301, "uuid": "2f3a002e-6c7c-4560-8980-94726038ba1f", "value": "New_Order_PO#960780_MT_Quote.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e3c9150-3cd9-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635966429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966429, "uuid": "f4753af3-7e2f-45dd-a5d3-c4602671e238", "comment": "Malware payload (RedLineStealer)", "value": "76fb65cb412e236329eee2be0c0a0a24", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966429, "uuid": "67cd7c2a-b5b5-49dc-b0c7-102b0f95d577", "comment": "Malware payload (RedLineStealer)", "value": "9bda4cca15e830160b1951ff00396f7ac2d2c9da1d263fb7f43a4cc61478d94a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966429, "uuid": "f6fe50c9-1bbc-44d5-9864-0f39219b6cbb", "comment": "Malware payload (RedLineStealer)", "value": "01f9c4126215e765168284f61de2e5343ca2fc61", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966429, "uuid": "a558084b-64ca-4bbb-9e65-6b26530003c8", "comment": "Malware payload (RedLineStealer)", "value": "cce1dfbcf8969809f3387bba7eb420e2fbaa9558ee23bfb3a64776998705f2e6cfba338d26dc372302ad7ebd2b2d7910", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966429, "uuid": "d614b00c-fa49-46bf-bf7c-03e088a357c9", "value": "T1A80519C6F1B3618ED7A3B0790F0125824A471C7A6B129AF56F35A96B11F37A1CAD7303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966429, "uuid": "1ba115af-c648-434b-8c3a-979f8c55ba8a", "value": "77baa691e6143dcc53adb7b2c5e44e0e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966429, "uuid": "a293c9fc-e544-4e85-a5e4-45748bf1fe19", "value": "12288:0g7TaPyznAjvrhA5/UizuffyguZhTLNioL0ot+xcIre4pE6MrGtkSpzqenRVZ:LdznAg0fKZhTPVcbQGaSpegVZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635966429, "uuid": "28237687-ae47-4c27-b34e-de6c79d57599", "value": 839680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635966429, "uuid": "1dab35d7-b5c9-4494-9dfa-e89d55dea1fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966429, "uuid": "47bb450f-362e-4439-8513-5c617ce3137e", "value": "76fb65cb412e236329eee2be0c0a0a24", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd85da38-3cda-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635967179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967179, "uuid": "ad6bc092-1763-4b74-9e61-613efbe35f84", "comment": "Malware payload", "value": "bd4988b2b9bb7d97a874eb2e92874d0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967179, "uuid": "f4c8c509-6469-4f6d-8b60-47ed44e93aa9", "comment": "Malware payload", "value": "9bf9de901dffe69038a43b00a40ba62136a106b3827aeedc37ccebfa0cd47718", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967179, "uuid": "b3818a4f-ac32-40e6-a5d6-9bcd5652609e", "comment": "Malware payload", "value": "0f5b1dabf41d36ffb3df2cd0d113daf7bb501b3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967179, "uuid": "bcb4ae43-c1ab-4884-856e-06c95e4c7aca", "comment": "Malware payload", "value": "3356764dccf6deb880008cf2d9e117f6607a0aef14c62caca2d2df98fceaf2643c869ea5298af975b09622c17e09d6fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967179, "uuid": "4133d6e2-e40f-417b-8ecf-a93ce1dc0e1f", "value": "T1C9740211FAA3D33DE1A659304C35CAB55A7B79712932058F27B8662E2FB43C05F3A316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967179, "uuid": "06d29add-aac9-40a4-8951-dbf4d897ffdc", "value": "adc309f4258aa7e488ca350060834acf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967179, "uuid": "fc01afeb-395a-458e-8e23-82eae2a7a795", "value": "6144:f0EcZdh01n3tnRKaGdmMNFZimyh2pWSF7CldsgAPCUoWvKBWVWRn7:cvZG3tn+dtN3RijUDKBWVWRn7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635967179, "uuid": "f05d1d68-f48d-454c-a7fd-a96a40102286", "value": 361472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635967179, "uuid": "246fef2b-4370-471f-9c89-c4a39ca3acce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967179, "uuid": "bbfbc2e7-5192-47cb-b941-c73e68fa265e", "value": "bd4988b2b9bb7d97a874eb2e92874d0f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "068a34d9-3c4c-11ec-843c-42010a9c0014", "comment": "Malware payload (GCleaner)", "timestamp": 1635905776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905776, "uuid": "52154f1b-0fe4-4da7-95a7-ed26342515d9", "comment": "Malware payload (GCleaner)", "value": "09dfc7f65a996b7f6b1e5efc8c9bbb21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905776, "uuid": "1f813744-812f-4554-bf17-79c58993cf90", "comment": "Malware payload (GCleaner)", "value": "9c650b8eddf1ade268de962e1ed3ec37eb3ca2e4e39f90dc8ec14895f9c8e27d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905776, "uuid": "21d14f58-7086-433a-8322-282af534cad7", "comment": "Malware payload (GCleaner)", "value": "72556797ab6ee2ce5faff1db89205f295f4ff57e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905776, "uuid": "e491bd2d-e9e2-459e-a639-3a71afb7e8d5", "comment": "Malware payload (GCleaner)", "value": "227cc1c61352d45ba9620d132527795937aeb0b6234f5605d85155c500d6164efe6f3191f4e6d8f914d3acd6cf2e7443", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905776, "uuid": "e20ee002-f8b1-4ad3-901e-ea7a29a5f357", "value": "T1CC946B34E201F036F4F20475AC2ED3BA59286B30675548EFF7D44E69AAB56C1E238B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905776, "uuid": "800040cd-b162-4084-891f-e57294a8bb40", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905776, "uuid": "463cc95c-1d38-489c-8fcb-ca71b284b4d9", "value": "12288:SGrstMQ1PVNDTrQ8j+xS42uW3o/Pp60VuQ755HWTTzH2:9rstP1vrQ8ixSpvkPlHHWfzW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635905776, "uuid": "8ddc5e48-bc89-4c48-a224-9ff50f24c990", "value": 444928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635905776, "uuid": "a928ba02-3241-4c55-9339-d2e91ab13c58", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905776, "uuid": "81d69d18-284b-494a-b661-70458df95d7c", "value": "9C650B8EDDF1ADE268DE962E1ED3EC37EB3CA2E4E39F9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64edbb93-3cdb-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635967353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967353, "uuid": "382fad7c-0ff0-4f13-8f2b-d9fa2e1267e8", "comment": "Malware payload", "value": "a79b484fe355aa0f1eb042880f7a8e6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967353, "uuid": "b82a09ff-f617-4a1a-8c89-5cfebabc0413", "comment": "Malware payload", "value": "9c6781b91c95ee7c4ed3a5cee94c57af0efdd794f2c5852f10c9c3a8b1e829ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967353, "uuid": "a4252d7a-79ca-4ac0-8e80-b31e49699c0c", "comment": "Malware payload", "value": "356ef3cf707ba3e568f02eba9b900337f95acb00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967353, "uuid": "082e6c1d-d095-4c47-8d83-6725d1b48c36", "comment": "Malware payload", "value": "6a16269ee6aac4be920cf3c802144e4881460aaf4194c29a7bdda3ad46a44a5a3e5685a5f9c3f23d1dc44b941df1a47f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967353, "uuid": "f503d9b5-61d4-4dac-8e7d-de6c7528b318", "value": "T138A4CF00A6A1C035F1B622F84AB59369B93F7AB16B6450CF23D566EE5734AE0FC31347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967353, "uuid": "a08f51a5-150e-4a3e-9a9a-da1b5a762cc8", "value": "e024db68009cf7f32dd817cae1867bf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967353, "uuid": "53a51591-b0c8-4013-aab9-70de29f6dac7", "value": "12288:Nn7TBzpN8I2DleA0nQ2BfWD1JqSY5rKt4txLr6G/Q:NZzH8IAmXBuh0SEbL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635967353, "uuid": "b13a613e-7e2b-4e95-8f5f-a06f013cc952", "value": 478720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635967353, "uuid": "7426163f-283e-417b-908b-e255bc1a68a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967353, "uuid": "bb30e311-f516-4a01-8946-6a2eb2a2fba1", "value": "a79b484fe355aa0f1eb042880f7a8e6b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f60e5be7-3c9f-11ec-843c-42010a9c0014", "comment": "Malware payload (Kimsuky)", "timestamp": 1635941826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941826, "uuid": "0332e5ed-70e6-4af8-a0d1-4b3498169102", "comment": "Malware payload (Kimsuky)", "value": "0e3ace5328dfa8193d10927c297205a0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941826, "uuid": "690542d7-e0f5-4fff-940d-0a83cf92b2b5", "comment": "Malware payload (Kimsuky)", "value": "9d0d5daedf2a6bdeb963915a9a28340422137b9e56651e75a1196fb1820decbf", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941826, "uuid": "8c185c07-614f-48cf-aa6b-a2f720f0bfcc", "comment": "Malware payload (Kimsuky)", "value": "01fac521998686638d34e9a9abfed9700ecae1c9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941826, "uuid": "2fdb5747-b0d7-4044-b243-5203f45ee463", "comment": "Malware payload (Kimsuky)", "value": "0936a4618dc3678c03d80b12ba7256e862fec0c1a2a03a3ce21454fd0a57b163b31387ecb664845fd1f05b55988d9611", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941826, "uuid": "dc05d779-5dac-4250-8e11-963d7aac16c6", "value": "T12DB519A1B905B1CFD48F27789D27CE86695D47B80F270803A86DB4FEBE63CC11696C25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941826, "uuid": "4d3c52ca-c137-49a6-8c36-bd3759dae3e1", "value": "74c18d2564058cf2aaf7e61eda41c07b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941826, "uuid": "65a3f4d6-c245-4b96-b977-ed906408f59f", "value": "24576:sAs4Z36WjBpzrB9qHIsT8JaIoLjMvNFeDZasMAeyVyivP4ox5W7MGxuc3smajxgr:dZVLxso0JLjMeUZArnDSYjxgM6YM5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635941826, "uuid": "7a6be8e7-59b2-413c-ab4f-d740e3bdc1e0", "value": 2421507, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635941826, "uuid": "c3994173-7d72-4669-875b-21127179490a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941826, "uuid": "35ead7e6-dd58-4505-b4b0-9fee2ca4c340", "value": "9d0d5daedf2a6bdeb963915a9a28340422137b9e56651e75a1196fb1820decbf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe93d24b-3cd3-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1635964174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635964174, "uuid": "fda1c1de-4afd-415a-b1a0-d0040fafdc1e", "comment": "Malware payload (Dridex)", "value": "4121e7f152ee4deefc4709a294801661", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635964174, "uuid": "e0ffe512-f248-4da2-9ec3-92bdcb42146f", "comment": "Malware payload (Dridex)", "value": "9dc3953c173bdb1ffacd6ad0e94ee5757bbc6b0268fd2b8d331996e2d379b450", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635964174, "uuid": "22bb4cd2-d34b-4c5d-8e9c-73a6d31e1c5d", "comment": "Malware payload (Dridex)", "value": "7ceddd63cfbfd09d0d6f2bdd7ab469eaff3cff29", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635964174, "uuid": "7dd5fcf3-2c85-4dd0-8939-e6e2d4191484", "comment": "Malware payload (Dridex)", "value": "22a943bad5289b6a59b8ec8d7ae4d0d5636ca526be872093e240c5a517bdac8ac1ca31f4e247c67fdfbdbe43d0de717b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635964174, "uuid": "c4a7d114-bb9c-4d6c-9109-aa74f1abab93", "value": "T15993029FE696B408C0E6ACFE468918F1583D164E0407B93E3DFE125827AB18E8B5C91D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635964174, "uuid": "5ad26639-cd8c-433c-96bd-ce336fdf56b9", "value": "1536:8CWcPFFxgFzx5YVqHS2YzayhpSW4vHR05Q4r5UZKUbSiWpizqC4F34obaeOS8iO:83fFzIsj8aipSW4vHREQ4iZKUbPa3hhi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635964174, "uuid": "8193ef82-3032-4de8-be1b-b8189a08046a", "value": 97012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635964174, "uuid": "20e59f6a-8194-44f8-8798-36a8c4a45725", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635964174, "uuid": "ceee0295-b055-4a28-8d62-4a65f1162f4b", "value": "inv-129028.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cfaa499-3c84-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635930000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635930000, "uuid": "f31f9ea2-d07a-4ab0-80c3-9c889898ca67", "comment": "Malware payload (Formbook)", "value": "f53f2805b2ff38db246434e40e5d00fa", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635930000, "uuid": "0ae0bb10-29b6-4fa8-b089-96a82f8274cb", "comment": "Malware payload (Formbook)", "value": "9e8b087bb324191ea0f7ec8a4282f29bb6e525565fd5e20c78d8e28e756711fa", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635930000, "uuid": "25ca6783-95dd-4da6-804b-55516c89f00c", "comment": "Malware payload (Formbook)", "value": "0c646db6fa59e1c310b5931ffd2d9cdfc2756d8e", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635930000, "uuid": "c1d0dd5e-7572-4786-96d9-bbe9f36f4df5", "comment": "Malware payload (Formbook)", "value": "b9af852b77e772aaacfdbd31bd684e3da79e607515b36d031ea689b2220fcbc605bd134f7e068425221c488837dc3d1b", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635930000, "uuid": "03001cd1-3214-4416-862d-f870082296b5", "value": "T1685423F92E4129CE96E5D221EF8226122445022D5F039A2C9D6D9BBD08B78B5F41DF3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635930000, "uuid": "f99b2356-44c3-468c-809c-dde3bae471d9", "value": "6144:kHvhpoSyYDPrCJzQ9053lQriViBg8S/9ehqVdGYVEbqJHIWgXm0FdI:WhpoHsPrCJc9Lr9gBkhMFEbyoLXmKI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635930000, "uuid": "0686e5b7-38fb-4842-93f0-465fa7a27a32", "value": 281401, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635930000, "uuid": "b642268e-bc54-4057-9366-1ee0baba9d15", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635930000, "uuid": "698ef9be-8cae-4086-b1cf-704066034cbb", "value": "USD Payment Transfer Copy.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df233bdb-3c9d-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635940929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635940929, "uuid": "d57ab0b1-3730-4c88-97f4-061f98baae46", "comment": "Malware payload (AgentTesla)", "value": "eeac9c070b35ab87ce9e9bed12c292dc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635940929, "uuid": "d93c4c3f-efa6-453c-9b8b-04b11b4373a0", "comment": "Malware payload (AgentTesla)", "value": "9f19a6bd7bebff98fea962b9c7c4c44800a27eb139692d5fc85b1033bdc343c9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635940929, "uuid": "0bd0b318-c264-4420-85c2-c6200515f34f", "comment": "Malware payload (AgentTesla)", "value": "780d7ead3893fa532e693b3e7fcdd09ef08f28c1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635940929, "uuid": "fee1e7a5-3a9b-43ac-9bbe-981f446043ec", "comment": "Malware payload (AgentTesla)", "value": "969d87a7e6d9bf9511e8a16bf57929583c7b115952fb49c1b61a4af5d567f4a95f21723156aaa5495628e38a85468337", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635940929, "uuid": "8774ff80-e369-4052-b437-ff57edfd538c", "value": "T143A4F041352D4B65C36CB7F160AA9350BBB8BE3A5412E68E2ECE71CA0A377158F30D57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635940929, "uuid": "8729ff2b-c078-44e0-9d42-dffd7633c8c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635940929, "uuid": "d62767c0-e4d5-4762-b929-97983c76161e", "value": "6144:qTWD7MbwN2s7GQH9JNlsl1aI7keXIl3ZoWzXdYlyFCx5b5tF/8MY56i2wE39fqoL:qEIbw8eGQpah9eVEhTS/E9FjDGh1c1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635940929, "uuid": "26877354-3e7f-4581-b4f6-c5d86a83e443", "value": 484352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635940929, "uuid": "810b7b80-a468-4124-905e-dfb422881fb2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635940929, "uuid": "afc6abbc-2446-4ec9-96e4-58f221fc2d61", "value": "NEW ORDER PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8de1bbc-3c84-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635930100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635930100, "uuid": "54eb504d-4542-4359-a27f-287c16a8e766", "comment": "Malware payload", "value": "8fc20f3224060e919dc0a613982b4434", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635930100, "uuid": "35684173-0863-4dd8-9c78-a46a85b9298f", "comment": "Malware payload", "value": "9f1e044c16dc0f51839a66069ac2464626d6ab4c2195b4618564e4426a759530", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635930100, "uuid": "a7d4c856-ea3b-4a24-8998-0aa88f6a9513", "comment": "Malware payload", "value": "adad4c9b2eb11b2cd3a5c7295a3e32f66f616852", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635930100, "uuid": "0edca413-04ec-4eb2-a155-dd2f90a0ae75", "comment": "Malware payload", "value": "464adce9622051e2eae32e1f5988fe7606f204712778b676893ff399f128879f5b076c6c855535936525e2ba137ee8cb", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635930100, "uuid": "86334137-56e2-4383-92cc-653b3f23aeee", "value": "T13A41AE2117F6031CD3B24A3DECB7A324D7B2BC51E996CF6D4150509468AA221F9B5F2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635930100, "uuid": "e71408f8-4cd8-4f58-bfbd-a377da114559", "value": "24:8WejOJXqTuC+pKnWXkAtWC+/CWapbvClUQrefk4o0aYrabVIJ0wm:8WrJaT6XzFvpQrgoOraR20w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635930100, "uuid": "39989c89-0abd-45b8-98c1-626e87dd85f2", "value": 2323, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635930100, "uuid": "e56deb99-4459-4869-ad61-09ae4546530a", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635930100, "uuid": "e145d481-13a9-446b-83c2-d20c02c62465", "value": "004.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3e7574d-3cdb-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635967512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967512, "uuid": "98dd86cc-2318-4e66-983b-aa192544e63d", "comment": "Malware payload (Formbook)", "value": "34c80f81e518370f859cc9f2454e6d83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967512, "uuid": "cc99db31-af55-4176-8bcc-64cf826cd735", "comment": "Malware payload (Formbook)", "value": "9f71ef7a27369674f7f5bb4f6203358a6485fcbd0c25f0c80272364716a73dea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967512, "uuid": "1dd155d9-7645-49eb-8fb7-f7664887596f", "comment": "Malware payload (Formbook)", "value": "dbb94e0f0a99558b8786a2c2ce3322ba281e7f9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967512, "uuid": "c78a5bda-86b6-4414-b1df-c009225c6476", "comment": "Malware payload (Formbook)", "value": "3c6f19af40e4da07ab9142c85c0aa2796a4bcf8f01fb91e782315041f7ce53e1f3cb06975237fc028fb62df5ee676d0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967512, "uuid": "dd96f776-3a19-420c-bd5e-2fefc271e90b", "value": "T1A4255C915E5A84F6D85B2B39103B9A2972346D702D252846DEFBBD830DF72C3A1F5C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967512, "uuid": "afacc302-8d6e-4ac0-8bdd-9ca886023e5a", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967512, "uuid": "b8884534-8466-4891-ac69-7aef9c9bc69c", "value": "12288:leMZj0Cgr/vTwXTnYQUluk8wRR51Pyu4y:kM9Y/vOTnHNwrJyXy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635967512, "uuid": "1190543c-05c6-423d-9277-adc4a642e0e7", "value": 1047552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635967512, "uuid": "fed6992d-94d7-4dd6-afe9-f7d960f7a7fd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967512, "uuid": "73582598-116a-4c8c-948e-16e4e4c87bc1", "value": "34c80f81e518370f859cc9f2454e6d83.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8c1c92e-3ca0-11ec-843c-42010a9c0014", "comment": "Malware payload (Kimsuky)", "timestamp": 1635942180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942180, "uuid": "c9836563-db21-475b-b74a-36ebb170173c", "comment": "Malware payload (Kimsuky)", "value": "f82c07feea45f745fa1e7be834f92bdb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942180, "uuid": "d6f30a4c-b380-4bf0-bdaa-d9bdb95ab794", "comment": "Malware payload (Kimsuky)", "value": "9fc8d922fe99cf83954b31a8af5a41a8dac0e14c55724cd62cbcda5c3689ab90", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942180, "uuid": "287e4064-2340-40da-88c1-fa5f5e914151", "comment": "Malware payload (Kimsuky)", "value": "2a5e848ff95df52950b2b8c55a0a2cd6b0a71a7c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942180, "uuid": "cd391b46-e282-421d-a46e-8af311270b7d", "comment": "Malware payload (Kimsuky)", "value": "bd02d1489953b559015d41e8566ae16fbf825b619c2133fbe56070cacff968f1ad515d746697ee7d4bdc66dd7b29a8af", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942180, "uuid": "f8ce395a-5233-4310-ab17-98749c4b34e8", "value": "T176D37C02B580C072D196023C6579EB239ABF79754BBC84C3BBD40A9A6D701D17BB67CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942180, "uuid": "e290c69e-9a0e-4856-8e48-2b7cbf8b1286", "value": "0c5d7f0d6a0fb611a6035403210f939e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942180, "uuid": "a280d1b3-93cc-4bda-8827-30e04952d55a", "value": "3072:oInWskE7Ks38duMQApzriuAueN4olAeFE:oInWskE7Ks38UupeuEN4ob", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635942180, "uuid": "d2c00e64-f265-4a32-b8bb-4f80e07f5d51", "value": 134656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635942180, "uuid": "d7b21c51-0b1b-44f1-be29-2765a74859f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942180, "uuid": "e740de65-5111-459b-a3d5-27987577fc99", "value": "9fc8d922fe99cf83954b31a8af5a41a8dac0e14c55724cd62cbcda5c3689ab90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f3a9d08-3cc3-11ec-843c-42010a9c0014", "comment": "Malware payload (Hancitor)", "timestamp": 1635957062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635957062, "uuid": "16108bbd-8351-4089-8e43-b605d5e895c2", "comment": "Malware payload (Hancitor)", "value": "cdac327051604413c250acf0929faa02", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635957062, "uuid": "fe0936b2-1c09-4126-a81d-50e76d387a57", "comment": "Malware payload (Hancitor)", "value": "a1f173f18d33706927bda262dab94695160d8d419c12b76a03ae0b9995902398", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635957062, "uuid": "a1ddabc7-61ac-4056-86f5-12d24011dbd4", "comment": "Malware payload (Hancitor)", "value": "e0c05a0178fa6e65d4f95973249fc055be13f2bc", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635957062, "uuid": "94e57241-19e2-4739-bdb6-ad4b1d242ad4", "comment": "Malware payload (Hancitor)", "value": "ea623a958c615e680160768e580dbba609217d05f7e0bd2507b65b93be27b70b5967a6cb881c0e5ff4ce761e7b826507", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635957062, "uuid": "164360f9-2717-467e-bed5-f676583fe4e7", "value": "T1ADC40103F9959F57E61BC3B87E628C696B6DED494B08B3CB10317F0EA7B43509C4264A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635957062, "uuid": "d9da42b0-433b-4f0a-8740-f8766c27b3f4", "value": "12288:7V9iQsDr8NM0tEILt/5J0RiCFNpQU0czr:7VXkr8NZnLl08CDkcv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635957062, "uuid": "a26f0bb8-be43-4602-8780-64feb382eb1a", "value": 589824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635957062, "uuid": "87f656f5-74ec-4d7c-95a1-436dc03ce1a0", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635957062, "uuid": "5cfee8be-8135-40d9-973d-9a9b1c88aad9", "value": "cdac327051604413c250acf0929faa02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f27d4b7f-3cae-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635948263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635948263, "uuid": "bd73f1f2-54a7-4b61-bcc9-cd2d2a66f0e8", "comment": "Malware payload (AgentTesla)", "value": "8bafb89e010b50c9c9be983caeaf86c3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635948263, "uuid": "b15beca7-aa66-4faf-aec5-a3f812f494c5", "comment": "Malware payload (AgentTesla)", "value": "a274c376050bfac4417305de13935827644ea25653d504b036a0f7b2442c7005", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635948263, "uuid": "97000eb6-e44d-497f-aadc-7f7ff8030b82", "comment": "Malware payload (AgentTesla)", "value": "0ea9df7a5b242eccacf6ebbc4321d700a7ac099c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635948263, "uuid": "76789605-720f-472c-a919-4176c51d5249", "comment": "Malware payload (AgentTesla)", "value": "30388586740f3d838ea7415022b1c3f9a3c83fa752b6fb28f8915ac853ea8dde7f5d2af152fad63f6233958693150d34", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635948263, "uuid": "c468b9fa-8c86-41b0-b19f-5cd77359097f", "value": "T19AB4E0D262E44215E56E4FB050707D7053B77EAE2918F79C6D98B8EB3A73BC24120B93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635948263, "uuid": "f7a46331-6b50-4694-9a42-5c4268413aaf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635948263, "uuid": "220a9b79-b870-4832-b80e-087ea0bb0916", "value": "12288:BRTlWCV1JR9Pyc7kbYsfPTb28g1BFExXPRG:bToCVHryksfPTbIRaXPR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635948263, "uuid": "4e6b22a8-81b4-4b30-acad-0aec3494b8a6", "value": 498176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635948263, "uuid": "766655bb-ff08-44ba-a825-c1661b187b09", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635948263, "uuid": "60437d35-849b-45e6-8506-1e0237267908", "value": "Quotation_567605645899978.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f045a833-3c8a-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635932797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635932797, "uuid": "10375caf-40d1-40cc-9f91-fdfc2bb309e5", "comment": "Malware payload (AgentTesla)", "value": "ce578a8b9741004bfa60e8f583a9ed6c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635932797, "uuid": "68b6d71f-c261-4829-8154-1fe95263d0c1", "comment": "Malware payload (AgentTesla)", "value": "a291aa6febce55582ceea3c70d00263934b3b99f1aaa4710930925863e954b4c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635932797, "uuid": "9ca10932-d2cf-4eee-b14f-ed78b2ea8e2b", "comment": "Malware payload (AgentTesla)", "value": "d9b03832e43ad85df3e3f79b8815d4c54d3118cd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635932797, "uuid": "a7a0299d-cc7d-496b-931e-96dc9da72aa7", "comment": "Malware payload (AgentTesla)", "value": "fcf16be962eff2a9d62eafc999783fd551acedee5753a85458c5b34b09da815a15b312e8c6f502d999dcee18f4a9e2b6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635932797, "uuid": "4bca8f7e-b04d-4301-904e-daae5fb45d51", "value": "T186B4F106356D8B22C35DB7F524EA8310BBB87D3A5852E24E2ECA72CA59377019F31D47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635932797, "uuid": "ff056019-6e88-4f95-8644-ddee8d305c6a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635932797, "uuid": "a053bba9-65b8-4eab-a08b-602d80b95608", "value": "12288:093Ibw8eG8ixLGGPaACdDDaFUZgX4KW1:u4bw8eG8iV/aACYFUZg/W1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635932797, "uuid": "52585334-8131-4391-952a-39f9432dc002", "value": 502784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635932797, "uuid": "550ab037-2308-4617-931c-94c7b31feaa4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635932797, "uuid": "9f5b030f-d082-4714-8574-3fdef880da14", "value": "AWB201210311623545632,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d32f10c8-3ce2-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635970544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970544, "uuid": "9f453940-1dde-447f-ab80-2e84efcc042d", "comment": "Malware payload (RaccoonStealer)", "value": "b2e0d22e49205aa750772b2402ddddc1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970544, "uuid": "f8f429ea-f8ed-434f-bb15-a3a8b550372d", "comment": "Malware payload (RaccoonStealer)", "value": "a2aa1c44fd2959c30b487784af0cdd4e92988bdf080d1e25ba08777c68277c73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970544, "uuid": "7e868894-0957-44f0-bce6-57f6ee7dcea1", "comment": "Malware payload (RaccoonStealer)", "value": "b319f6d043f37cf77086e25e8bdd1746203cfacf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970544, "uuid": "2f0c038e-6a96-449f-9657-c3d755219420", "comment": "Malware payload (RaccoonStealer)", "value": "676ec3afd524f6aa5bbb4bd3d506916ca05a02cf5bda0412c6bb8a1ccf40e44dac8cfe38bde94128528d1fbc7d1bfa7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970544, "uuid": "246ddfb1-de01-45ac-ae8d-526d3894a813", "value": "T1DEC4D000A7E1C030F0B652F8497693A9B93E7EA16B3584CF13D526ED5A34AE1ED31367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970544, "uuid": "228185f0-0094-49da-8850-624b5d526188", "value": "59ee824971f432b778ca9bd24dd5ed5f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970544, "uuid": "ee85ecab-554b-4e44-ba4e-f1567f784a74", "value": "12288:RptsoqTqnzMNNBk+/58+XuYu/KPlSWzpI3qdy5LQDHw5B3uhi:TBn4NNS+x/eYu/KPlja6dypF3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635970544, "uuid": "21f15979-5c0e-488d-9271-96190c656279", "value": 552964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635970544, "uuid": "2de730d9-089c-4970-94ca-7c341e0bf7fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970544, "uuid": "a19030f6-8429-4a94-bfc0-586b3569fb97", "value": "b2e0d22e49205aa750772b2402ddddc1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63cf8d6a-3c9b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635939863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635939863, "uuid": "ea70ccc0-9d52-4af6-a05d-94b3fb003462", "comment": "Malware payload", "value": "39dbc4ef4e0c317e47c9612355a227c6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635939863, "uuid": "b25a907e-ffaa-48c9-9ee0-4c2d49b92d10", "comment": "Malware payload", "value": "a367ae797b1fab95ed1349e396d428a1ff031850622362b501481501d47b998a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635939863, "uuid": "e899fba2-2d83-4ff5-a17f-bf2a696cbba9", "comment": "Malware payload", "value": "de6ba5327f46083e76f91f93f373e961eec775e0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635939863, "uuid": "ecd25897-d8bd-4fdc-beda-8db5a09ce240", "comment": "Malware payload", "value": "b089bd928eb8e1946f8b8e9409b6d42989141ef0407c93a374e574b9f12b4fe89c878ea6f301eace933544daa7c9fdad", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635939863, "uuid": "99476081-106d-430d-b295-29ea623c0b7d", "value": "T16F44DE673151903354D0FB0A038A3A50DD4B7238E9ACABB33284B11B3B969BD7DDD978", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635939863, "uuid": "48c44e0e-9d4a-41db-ad05-708938d53173", "value": "6144:t/hJ8HzV9mSlw3HZaLhUeX2FzPFwv1XOe3kRHkT:t/h+R0SlRr2xavZP3ktkT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635939863, "uuid": "41874870-250a-4481-8c50-46a2194f3dcf", "value": 261191, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635939863, "uuid": "2079dddb-92ea-4637-9073-308b551c20eb", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635939863, "uuid": "d0ebfed9-cc06-426a-948c-af9ec2282935", "value": "EdZZ", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a233f0d-3c4d-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635906239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635906239, "uuid": "cd56b5b1-f50c-47aa-bdbf-cc2870140842", "comment": "Malware payload (Mirai)", "value": "9df22bd39d4d1fb36b0656669a6485c8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635906239, "uuid": "873857dd-d401-4bc4-8a9b-a48ed6ade0c3", "comment": "Malware payload (Mirai)", "value": "a39b07ab506dc23e2000821095ab37bb97dbef0684c96460968337528af4b54c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635906239, "uuid": "0362f4d1-c3a9-4464-93a6-3ec823f3f220", "comment": "Malware payload (Mirai)", "value": "d38a7907e04d50b4fa21ddc0fa28ce946cd14202", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635906239, "uuid": "487545f8-c4bc-43fd-b41c-a68825df6509", "comment": "Malware payload (Mirai)", "value": "65b798afa85765cddd24e2b6bd0bffe2d81b8d34cdbbc0b41deb529d06db9fdf76239fcbd22d7a090ac0e7c927b8be2c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635906239, "uuid": "d0eb1c19-f4c5-4de9-8c39-a8b62da7fe71", "value": "T120432925AD792E26C0D8B57E11F7C724F2E2220E25B8C65E3C721E4EEF04740A5537BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635906239, "uuid": "56977521-fea8-4f96-beca-ac3c2d513153", "value": "768:eLobAxU6q9Hfymp0xginuYvCkLB6WsTwIC1DQdszoDaS0O+DCD9:eL0AxvSHfymp0xgunvCkV6vTMDauS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635906239, "uuid": "f5c8e9cd-b82e-49b4-bc50-bc796f90019b", "value": 60412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635906239, "uuid": "297ac486-7aac-429e-b44b-5d91663f6ed2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635906239, "uuid": "de72ccbe-8133-4368-b391-15b7959d134e", "value": "9df22bd39d4d1fb36b0656669a6485c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a05881e-3cc7-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1635958691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635958691, "uuid": "3e212807-7557-46ae-a5ef-91b280c1c991", "comment": "Malware payload (Dridex)", "value": "3cd5379c716909baf6725bd35b128636", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635958691, "uuid": "9d102dd5-3035-45ba-950f-95ee2a72481f", "comment": "Malware payload (Dridex)", "value": "a3bba0d2e5b70b84432108d470217fb20a8961273ad8df296e17654ddc03cd59", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635958691, "uuid": "52fb80c2-755f-4058-9cea-c4b54623a8c1", "comment": "Malware payload (Dridex)", "value": "f8029abe4005c1d63c6c343639f270691c9db071", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635958691, "uuid": "c50b8267-2449-4d6d-9d94-323f1582ed1c", "comment": "Malware payload (Dridex)", "value": "c595ae1488884c776ddf089ea0792269787f765dca82ad52ac30f65165a66cbbcb9f4da603e681ed7261aed1e5c83f91", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635958691, "uuid": "a1addee5-0cb0-44b5-9310-9182c41049fc", "value": "T1E3A4BF04D1EA0676D52B62FE71FF0CCA47104DF9B506AC84D3435A6A5B32FEC3A7A849", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635958691, "uuid": "e1e26024-2b0c-47a1-9062-817170a81add", "value": "ccdf79216449388cf5a36d38a385d866", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635958691, "uuid": "59b8e10a-4437-4ae1-b42b-f226fff857e6", "value": "12288:4ZKEZNxJPdthZz/MqmOce24Wqa+cKdDSFczjJgiUCeoCqoE:4ZKEr/1jhz17Px", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635958691, "uuid": "99979c97-735d-4211-9517-e8473b22cd88", "value": 471040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635958691, "uuid": "2d314cad-6381-492d-a879-4d251026bcc1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635958691, "uuid": "7acc88ed-d7a4-4f5a-9671-370e6be8d2ca", "value": "rQCxkHPFvvY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c130e0fa-3cb2-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635949898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635949898, "uuid": "77708ae3-af4d-4b71-a12f-d360532e57c6", "comment": "Malware payload (AgentTesla)", "value": "a6546e2648aeb1504f1254e90881cfcd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635949898, "uuid": "27c48fd9-28b2-42e7-821a-70468c7d35c0", "comment": "Malware payload (AgentTesla)", "value": "a3c80f9d7c052ca12bb23d7274dca1b664495a84feb81eaad42b603b5bb065cc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635949898, "uuid": "d793cf15-6104-4ea8-9ce5-6f3958191db9", "comment": "Malware payload (AgentTesla)", "value": "eed099ce1bbfbc7a73de56d260956fc53d03dc7d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635949898, "uuid": "8dee48f8-5aed-4897-b6ff-b27321cabd5e", "comment": "Malware payload (AgentTesla)", "value": "931b97cc62db8347d54438b9f717e60dbad73c1d7b32e954cae96e488a15c642ca5c0cb170c1b26066fa044d836c3b7e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635949898, "uuid": "96aac708-fb90-4197-be27-ada7c2096a65", "value": "T16F741206E2E45DDBD18A66314F36ADBEFF3B03686521E703C720AE2719514EF4E96603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635949898, "uuid": "62f4526e-20f8-4dfd-9f39-f47873d97032", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635949898, "uuid": "3367d405-e45a-496b-ae0d-8e1b8ebdf70f", "value": "6144:F8LxBsViQOmm7NndN7CHuzvcHyzhYdxg3tf7ICPMp+T718e55wbjYNY:/YQ4ZndN7CHuLzhCatfrkp+n1Ls8Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635949898, "uuid": "48e9c06b-f183-4334-9f06-8488cdcec8f6", "value": 347519, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635949898, "uuid": "7a6894ea-b555-4c0a-922b-a543a119db1d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635949898, "uuid": "5cc52644-6708-4877-953c-a615f7291d25", "value": "max.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7cf743a-3c9a-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635939574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635939574, "uuid": "89ce5c24-e360-407f-9610-34fe20def9a1", "comment": "Malware payload", "value": "bdd7981cb7f004156d2f14b621783180", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635939574, "uuid": "30e499fe-51f2-4670-a059-15548407c3fc", "comment": "Malware payload", "value": "a48b683ad09c43db24b96f8219886b004aa3d879eba6139efef997ed9a464e35", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635939574, "uuid": "0695bd89-f888-468a-a4d6-48ef198f463a", "comment": "Malware payload", "value": "9816fb8f6c93691cf774909051d5f9b15d9102a6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635939574, "uuid": "993b1e52-22e4-4b26-9e41-a0cbfe2188b3", "comment": "Malware payload", "value": "f02b824a673b73334b51465162e6798dbf783a31f570ac36c48c07eb032a550b68e1f7a4a434e67ea2e1a29763d3f115", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635939574, "uuid": "1050c794-9a2b-4fd7-9c35-163a69d3725b", "value": "T15286337313721081D1F7C4398E277DE8B2F752688982B4B87967E9C039B69F8D617A43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635939574, "uuid": "085e712f-3c89-40ba-a2ba-ba2d79fe25f4", "value": "2dd3dc1f6d11c518a18cfca01ec54b82", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635939574, "uuid": "57a5452a-9e23-4d8a-938e-f4ec38dff128", "value": "196608:1bnKbn/oDze5py+DjhkNMLBfMxt9uW+n/ZMfKLugLFGb2:1bKbn/om5A+DjnLBfoCW+nhTLugLF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635939574, "uuid": "0d954323-8677-448f-a1de-8e96bb98960b", "value": 8164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635939574, "uuid": "a405d070-0653-4147-961b-632ad270e776", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635939574, "uuid": "17b59223-23e3-48cc-9d54-187e6a906872", "value": "bdd7981cb7f004156d2f14b621783180", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91d3e2c6-3cae-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635948101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635948101, "uuid": "2cd29574-c00a-42d3-8f26-92aab3923121", "comment": "Malware payload (AgentTesla)", "value": "ef1b7d9b08de89c9adf667c8c0b41ab1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635948101, "uuid": "72163732-60a3-4b41-b73d-6a23703489da", "comment": "Malware payload (AgentTesla)", "value": "a4ff2f7ca7bba8799c99159828a505d38e84cd80448a0b985b8e9edab28dae74", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635948101, "uuid": "2296a4c8-417a-4561-9df8-60b343ff690e", "comment": "Malware payload (AgentTesla)", "value": "ba7fe5f22cf522b3432a72704d32bd23293ad4bd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635948101, "uuid": "4dc65376-6ba1-4e6d-b1bd-705f4c6b559c", "comment": "Malware payload (AgentTesla)", "value": "8cbacce10ff503c7e1689bb24737874aeab8a2d9267f89f0958020281d3ba647b3ad40377be3baabc6e9ee19caa52f6c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635948101, "uuid": "c2af799d-bcce-4203-9314-883190af9062", "value": "T142059D6077694845CEF8B7388F29D67017232D7D6A50C61E60F03CEFBAFE6470622A65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635948101, "uuid": "17b125b0-cd24-429b-b7d8-019dad194752", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635948101, "uuid": "3a21892e-8b65-4cca-a848-caf1d88cf681", "value": "12288:vTMMXRC4021h54Rc4D2we1wNmeeKPLTQV0:ki1PCf2L1HeeeUV0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635948101, "uuid": "70a44aa4-1b4a-4c19-bc48-0e1158e1ab23", "value": 808448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635948101, "uuid": "4bb088e8-f446-42d8-84cd-3170bac8127c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635948101, "uuid": "66c3be27-f25a-4b84-a4e4-7f107187d11b", "value": "Invoice copy II.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c22206d9-3c9f-11ec-843c-42010a9c0014", "comment": "Malware payload (Kimsuky)", "timestamp": 1635941739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941739, "uuid": "b313874c-b229-47a8-9982-285fe855b14d", "comment": "Malware payload (Kimsuky)", "value": "2c49b207dcd0454e6e7486ce6126f3e0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941739, "uuid": "cb49533d-ca28-48a1-839f-e2ec97a00b3e", "comment": "Malware payload (Kimsuky)", "value": "a6441c8cea0fa8263ec9573a2cf5a2749e488da9c1ec745bcf65bca1eaa74f80", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941739, "uuid": "8bb770ea-aa65-47dd-9462-26460d2dcd72", "comment": "Malware payload (Kimsuky)", "value": "4987e39ffea5849952d3e5fd2485c3ef64b12235", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941739, "uuid": "3b09d029-bc70-4a1b-a360-016f1bd8176c", "comment": "Malware payload (Kimsuky)", "value": "bff91a8b97c4353b92bdb49e0031e2e8fb8f73f09347000b3ff7d8e18580f358f9df02874ace8f85361537db8856f44d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941739, "uuid": "4d5e9d48-7357-47ee-b332-d560ce731a83", "value": "T1F8C5AE12FF8281B2E9DE417961A747BF4D3D59189320D8D38BE218A9DD312D1B63F389", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941739, "uuid": "63014b68-44d6-4197-8f18-402465f4ed14", "value": "b66bca5781c0c2f0ed75956c9538733a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941739, "uuid": "646640ab-a022-4547-9825-0577776b0c61", "value": "49152:v9WnCsl7TfBMltpoy9gMv6eOXA5dpgg7anyhBTf9fvYuzSDIPvb6wO1BOa2byQ5:v4nCk7TfBMltC0gMv6mgg7anyhBTf9fv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635941739, "uuid": "efac92fb-f6f5-456b-adec-f8241e980651", "value": 2621440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635941739, "uuid": "ace0eff5-c158-4c18-a1fa-b534b04d0414", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941739, "uuid": "1b00cf7e-f579-41d7-b2ba-47dd9771080d", "value": "a6441c8cea0fa8263ec9573a2cf5a2749e488da9c1ec745bcf65bca1eaa74f80", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30717249-3cd9-11ec-843c-42010a9c0014", "comment": "Malware payload (NetWire)", "timestamp": 1635966405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966405, "uuid": "dbe70217-5fb7-4d30-bcbf-377b8771873a", "comment": "Malware payload (NetWire)", "value": "29005d6fb4742e63fddb3468cd6b6144", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966405, "uuid": "75baeaa3-6e7c-4790-a0ce-31cd8daf6029", "comment": "Malware payload (NetWire)", "value": "a74b66e2fb58eefd13212d288748a597c2936a4bda531f896f1776464bb20f36", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966405, "uuid": "6c7b0e2c-0732-4f36-a3da-0e3b3b010474", "comment": "Malware payload (NetWire)", "value": "dd757e25919d5a8c6acc9606199248e775783d36", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966405, "uuid": "c822a5b9-b05c-4fec-ab0b-f552b3820f88", "comment": "Malware payload (NetWire)", "value": "08365297ac80da7896ccf7927fc06dbc226c20fffc09daf14eae39fa1ada400b744f9c61c4c4d627d024207eac52f28d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966405, "uuid": "5ec9e35f-9332-413c-b8b2-e1290d29231f", "value": "T1AFA55DF400083893E1AF5157F65B7C952761F96B86CFA984717EE7F26393AE2DE18800", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966405, "uuid": "315b36be-6894-404b-a7d5-ae181f0403f3", "value": "24576:90U1O8RkwPmbg3KZppJ+sElU0zyr9/BBPA4444L2Zjjjfjjgjjjjjjjjfjfjjjjm:g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635966405, "uuid": "ec0ffcc3-17a6-4e16-ad9e-59c93aa6f1e1", "value": 2098598, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635966405, "uuid": "bbf5a24f-f3ce-4c0e-91aa-289cb9886ada", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966405, "uuid": "753e6fcd-7525-469f-83b4-81c804835cba", "value": "R_Quotation.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62381339-3cc4-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635957470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635957470, "uuid": "02eb0b5f-7f8b-4402-9d4d-4a1ca54b9655", "comment": "Malware payload", "value": "5d6897f40a5cb7219396bf464656c2b4", "object_relation": "md5", "Tag": [ { "name": "CRMP", "colour": "#AF02CC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dragsteal", "colour": "#A5F30A", "exportable": true, "hide_tag": false }, { "name": "SAMP", "colour": "#C06F87", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635957470, "uuid": "f06ccdfc-82a1-4cef-a447-a57069dcb622", "comment": "Malware payload", "value": "a75e0e7b64b4a49fc74064facce5fbedc88abf562f2f23756128f27fc945f5fb", "object_relation": "sha256", "Tag": [ { "name": "CRMP", "colour": "#AF02CC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dragsteal", "colour": "#A5F30A", "exportable": true, "hide_tag": false }, { "name": "SAMP", "colour": "#C06F87", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635957470, "uuid": "50677d49-82af-448a-91e2-44598566100e", "comment": "Malware payload", "value": "b0b47de85e3fa8959ef66f2b5299c524c1856499", "object_relation": "sha1", "Tag": [ { "name": "CRMP", "colour": "#AF02CC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dragsteal", "colour": "#A5F30A", "exportable": true, "hide_tag": false }, { "name": "SAMP", "colour": "#C06F87", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635957470, "uuid": "415815c4-7565-4b51-88fa-6a9aedcd80ef", "comment": "Malware payload", "value": "6deef7c250274daa35958e36ea00c3e652b709c4e6ffd8cee26b8760b722a3c91303b656a82a6e50efb27fb236f82821", "object_relation": "sha3-384", "Tag": [ { "name": "CRMP", "colour": "#AF02CC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dragsteal", "colour": "#A5F30A", "exportable": true, "hide_tag": false }, { "name": "SAMP", "colour": "#C06F87", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635957470, "uuid": "77b7c935-6a34-4f9b-9e7f-970b69aada99", "value": "T149723C82F50A4AF3D7E80475B42557324A6DEF703FA420E3B7E70A68356A1D3B439B81", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635957470, "uuid": "fc2fc92f-2f00-4b58-92fe-e56f4908f871", "value": "1312224dc33eefd07c1c769cde645b83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635957470, "uuid": "1e3a2088-c57e-40a8-8028-896d52f3d991", "value": "192:ypXqVKdFSZBAi3brDpy2kdg56zdSHNYYlLdYcLfKdNGViR08Jf1MDZdigMjkbhpt:UX2KnSdXpy23wAOYldiReVggbhpEqf5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635957470, "uuid": "b2746b39-67c3-4be9-a483-544ac897fff7", "value": 16896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635957470, "uuid": "b91db00c-0bdb-4381-8b05-39167f73c6e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635957470, "uuid": "763bd5bd-1e0e-4eef-9264-2fd7242be784", "value": "ScreenSettings.asi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f917d7de-3c70-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1635921645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635921645, "uuid": "76c6a1ad-a998-4188-92a7-e4af30a111e8", "comment": "Malware payload (Dridex)", "value": "fd4f08f685a1190db305d27f4b9fe700", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635921645, "uuid": "d4127053-bda2-424e-8fa2-3192ab6a86dd", "comment": "Malware payload (Dridex)", "value": "a77d66e37425c8210de308a8617f5214d0a96393577ac1bd30473e73a82dd73e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635921645, "uuid": "ab4a3de1-d295-4c68-9837-4f858161d974", "comment": "Malware payload (Dridex)", "value": "3095e88622663e3f1a54232f5ca6faa4fc2d1515", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635921645, "uuid": "a7041dd8-8616-47d9-b48f-16981e12d4df", "comment": "Malware payload (Dridex)", "value": "06fa4d29a90d48632fbd8b0aca21428f18da17707a63633761328dd5e87ea298d1ec7d3bf06caf1dafac220e2d3676e2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635921645, "uuid": "6a178aea-41be-4b08-a323-3cda72a192a2", "value": "T10F83026EE76872D6C719E43E434D0CB6BE14A6A358C0C7AF49A8971C45F1383676E08D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635921645, "uuid": "df81d855-31d8-4931-bd97-c8e37e02989f", "value": "1536:8CWgPZZKz/1eCzbqzLkh/OPvTFVT3WkBU6Twhy7lwDRccaVI8QzX:83YEz/9qGWPvZVT3Je6hw2jI8QzX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635921645, "uuid": "55cd05bf-dec8-4708-b775-edb196a7183b", "value": 81941, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635921645, "uuid": "989d5b4b-a920-4159-89d7-8987437b8869", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635921645, "uuid": "b900eb40-7664-4f35-ab4d-4d6368467196", "value": "Payment.64360.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0e7dd88-3c4b-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635905659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905659, "uuid": "5cba5c54-8dc4-4a2e-b716-9c1044ff6cda", "comment": "Malware payload (Mirai)", "value": "93d50e345a1e05a0056f4edcb7dd60bc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905659, "uuid": "9c342c31-e0b5-4558-8ec7-a0a7aad3d6e9", "comment": "Malware payload (Mirai)", "value": "a7bdf8c098eeaa7c4274c8651092f0b63d21cb8376d91de6696f6d6301300121", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905659, "uuid": "d0d28da9-f710-45c9-9a23-12d9eabdeb91", "comment": "Malware payload (Mirai)", "value": "01f60f8ec91b0a84bcf44e8e718a497c2850462e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905659, "uuid": "ec39eff3-d3f1-4b82-8ed9-9e853244ed2c", "comment": "Malware payload (Mirai)", "value": "c67e768a53ff67170df5f9598cb4195a23ebfc0beede7d8ad9a64b0f6c1fe5887b32e5007e21a66e6697f9582e4dbf60", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905659, "uuid": "d39528e8-5d98-4155-b05f-a8c0e68c4b40", "value": "T1D2D2E1026641FEE1C5B00231E9678A5BB2253D78D1D534FA973D0DF8A6E9A0D87F8A43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905659, "uuid": "d011e227-fd31-48d4-83a4-eddc3a165c52", "value": "768:tusHfRavjynNKnjFcZIhQzhKMXgP9q3UEL75:9RwynNIOQQ1KMw+L9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635905659, "uuid": "ba33e2a6-22a6-4693-a017-7df9b8e9c2fb", "value": 29464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635905659, "uuid": "edd63f09-94c8-4698-b5ac-57a90e906e1c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905659, "uuid": "31140e5d-d64e-47ef-aeee-903153546d30", "value": "93d50e345a1e05a0056f4edcb7dd60bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "384da9d2-3c5c-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1635912732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635912732, "uuid": "4003a549-93ba-419d-a5ab-e459741b5918", "comment": "Malware payload (Dridex)", "value": "c360e2825639e343db04da2f562d91d3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635912732, "uuid": "f0b13f10-a519-43e8-9e22-a9b2bab67260", "comment": "Malware payload (Dridex)", "value": "a818386d20e121682a3a9c713519b9e36126801546b555a0f01ccdfb93f2a271", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635912732, "uuid": "e347e664-fb6f-4c81-8bc0-01918659a442", "comment": "Malware payload (Dridex)", "value": "cdd0c2a865d67443e70bc2d95b57fdac22e2763f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635912732, "uuid": "00da30ff-5c9a-4e91-8011-622dd9fe7350", "comment": "Malware payload (Dridex)", "value": "c70aa07ae0e5f417dac1da9f356a9e61434de23a3c533cce704b3a527388953eb47a6aba738f8dce0e9e437c5cdbd431", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635912732, "uuid": "da65c481-5d63-400a-94ce-3183c4644356", "value": "T124A4AE94FAEE40B8E5187A74C4DB19A56E821E24C4AB1615F4587F0E4E338F3970FA73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635912732, "uuid": "98f3ac75-f07e-4ee6-aed7-2f51c8247b11", "value": "c6e29838e1e1c81859cd162bf701404b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635912732, "uuid": "f244788d-60dc-405c-87af-02ab1f2ed490", "value": "12288:uGw8ObmVk9gbUngly9sp+ROx8ufNX/7vuZU/4BLl2iv:urxC+mggkqIwG4X/7vuZ44Zl2iv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635912732, "uuid": "5610e8f0-85e8-478e-81d7-aada6db45908", "value": 462848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635912732, "uuid": "066783e1-4b31-4c12-9872-7c4029987dd0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635912732, "uuid": "83cf7d0d-52c3-4ee4-950b-d52972c90435", "value": "SecuriteInfo.com.Suspicious.Win32.Save.a.9478.17730", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc21f343-3c9a-11ec-843c-42010a9c0014", "comment": "Malware payload (CobaltStrike)", "timestamp": 1635939608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635939608, "uuid": "e37cfd4d-7dd5-45b8-8dd6-e32505721e06", "comment": "Malware payload (CobaltStrike)", "value": "de0fa6f1d534522f35c4295b82737bdd", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sangfor Technology Beijing Company Limited", "colour": "#10F549", "exportable": true, "hide_tag": false }, { "name": "Sangfor Technology(Beijing) Company Limited", "colour": "#C514A3", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635939608, "uuid": "9587bbff-6d2f-446c-aa1d-557d74132d1d", "comment": "Malware payload (CobaltStrike)", "value": "a9efd8ac681f197a4dfadc0179ee11c404004ca43ebc311a1786af001671a776", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sangfor Technology Beijing Company Limited", "colour": "#10F549", "exportable": true, "hide_tag": false }, { "name": "Sangfor Technology(Beijing) Company Limited", "colour": "#C514A3", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635939608, "uuid": "15b9eaef-f3d0-4c16-a23e-00f86373eb77", "comment": "Malware payload (CobaltStrike)", "value": "556494c42f9c4e0b182bc3a446e299eb8435787e", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sangfor Technology Beijing Company Limited", "colour": "#10F549", "exportable": true, "hide_tag": false }, { "name": "Sangfor Technology(Beijing) Company Limited", "colour": "#C514A3", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635939608, "uuid": "88fc75fc-b5b3-4b19-b6ad-78b2b6d71abe", "comment": "Malware payload (CobaltStrike)", "value": "91857eb796597728d0ba39aa38f724af868da0fc85a92d30e92c66cd5d9966d30a0e1e1e4b43a585f338f9b37b79fe66", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sangfor Technology Beijing Company Limited", "colour": "#10F549", "exportable": true, "hide_tag": false }, { "name": "Sangfor Technology(Beijing) Company Limited", "colour": "#C514A3", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635939608, "uuid": "739521df-29c2-4a90-afa3-60fe3799fca9", "value": "T13FD446F85C8A643EF01A797D276CB97306E63F4461C4FB52A38827AE0866B3957C3345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635939608, "uuid": "ede30a19-f75c-48e7-a9ed-ff1dc79623fc", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635939608, "uuid": "bb9f8bcb-4ce1-429f-8824-1ebf87aeb30b", "value": "12288:a4DjhtFDU1DIecq8Ud5CC0SZiOeSSq0jrxsv5QknUZTVK:aOjh8Rl8Ud5C/BqUrxsuknUZA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635939608, "uuid": "89ce439b-e349-420a-9807-d6cefea56d72", "value": 640344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635939608, "uuid": "0583e710-d058-4503-9ae7-d73548d024b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635939608, "uuid": "89eb660c-a010-40e8-bedd-790f1f0347d7", "value": "a9efd8ac681f197a4dfadc0179ee11c404004ca43ebc311a1786af001671a776", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "280e856b-3ca1-11ec-843c-42010a9c0014", "comment": "Malware payload (Kimsuky)", "timestamp": 1635942340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942340, "uuid": "46051b1c-6f9f-4af1-90ba-b421bd63a6d5", "comment": "Malware payload (Kimsuky)", "value": "36f769effca947d021de4819badc604b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942340, "uuid": "f6242d24-281c-42c7-bc90-9697b9c5aee3", "comment": "Malware payload (Kimsuky)", "value": "ab84aad295f1a1790a769eb043ef438a04e86ab62526026f4ea627c8457dc150", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942340, "uuid": "8f2c1424-a51c-4b94-ad4b-8ae0cb66c9e1", "comment": "Malware payload (Kimsuky)", "value": "79fdd8067cf5581adcbf1bb350b5625a88581e21", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942340, "uuid": "6adb7801-6996-4920-bc96-661e66a4ff57", "comment": "Malware payload (Kimsuky)", "value": "47ac690af671660d6c2d25b556088fdde20da20ea887a569b0958b0c1c168f67f7441e295c2406bd4f707ba445d04d5e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942340, "uuid": "21f6cb4d-9450-44c0-89b5-ed5a5ea02178", "value": "T169A37C51B0D0C471E1BE1E3D0538CA711B7EB930DEA8AE9B239801795F642D1AE3AD77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942340, "uuid": "ff17607c-9571-44df-afc1-57d2073c5a42", "value": "2afd2da9c3259651243d04ead92fde91", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942340, "uuid": "10f3dd62-9694-4115-83dd-ab12b6ee301a", "value": "3072:uKv4t2U811wI48wLJY3/F+g+wHc/kcVaPAxrIJiGT9MMt:uKgs36I4e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635942340, "uuid": "7bb33c1b-15fa-4f81-b975-3e0ba00816b8", "value": 105472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635942340, "uuid": "b84c782a-6bf7-4143-b6b3-0829127138a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942340, "uuid": "e4be814f-f0da-4fc5-a99f-9f87641493f3", "value": "ab84aad295f1a1790a769eb043ef438a04e86ab62526026f4ea627c8457dc150", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74fd741d-3c4c-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635905961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905961, "uuid": "4a5cd528-8af6-481e-a86f-16a98070a1e4", "comment": "Malware payload (Mirai)", "value": "fbeac4823cdb96bb81ed894831e9e18f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905961, "uuid": "8c5ce1f6-05cb-4b21-a8fb-8e43ff62a0f0", "comment": "Malware payload (Mirai)", "value": "ac104c1413ce9d48c0df32a127bd043992b237233ea618aa4d89770d3b28141a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905961, "uuid": "31fd36e1-bbe0-4341-a297-298ad365dde8", "comment": "Malware payload (Mirai)", "value": "a19bd9f6f2d63ac8b5dd4b28c210477be6c43513", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905961, "uuid": "82423169-abcc-4667-9b0b-f813a01ac678", "comment": "Malware payload (Mirai)", "value": "e77483ce1e914b10b1eeb4164d192ca749ee9cfa8fa586f43c62f61e91b817b92b0c3e6e1345490e17f7d55989bff374", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905961, "uuid": "2b6f4be5-1cd4-449b-abf4-4edf5073ee38", "value": "T1A9C2E0981B492AE9C2F9C17843B80B681D640F66F809DC8678FDF7629D8E4753017ED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905961, "uuid": "9bad2ad7-f11b-49bd-b225-913be304a996", "value": "768:I2G214DFyosXqgvV9o1ndB08WlJgGlzDpbuR1JK:I2GdDgosaaO1ndmVJuA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635905961, "uuid": "4bbcac5f-8603-404f-bdcd-5c043ba7d2c4", "value": 26184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635905961, "uuid": "a11a490a-4a33-4f0c-aefb-acdc3a00f9e6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905961, "uuid": "ec69204a-b4ff-4648-acfa-5510f0fbbfc2", "value": "fbeac4823cdb96bb81ed894831e9e18f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a714132e-3cd9-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635966605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966605, "uuid": "03747714-1031-49b2-9355-247d9c5e123a", "comment": "Malware payload (Loki)", "value": "694c298aea0a15abb3a929a2b65cae68", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966605, "uuid": "952b37c5-83d7-4e71-a11a-f26569abe1f9", "comment": "Malware payload (Loki)", "value": "ad04954e951c5327c4d39f8b54de9f54951e6650965b6ecbdd5e1e839af52d34", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966605, "uuid": "e270d4f4-2bc4-4261-ac6a-a1a967683ea9", "comment": "Malware payload (Loki)", "value": "ba9922ea8e1ac51c179cab419c2134b36135e128", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966605, "uuid": "abe32611-a83f-46cd-874d-b12bec447178", "comment": "Malware payload (Loki)", "value": "802660cb26cd131de5315be54b32d06ed8700291c165e7447c52997f499fdd4cc62f90273e70b834a774fd73bf460807", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966605, "uuid": "60f1b06f-736e-41b0-a4c6-8486127974d5", "value": "T1CAA2D27DF18B0E88CE87C6AC160A3B821548F95D73D994E237BCDB38764596B9213D38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966605, "uuid": "b69a9f5d-772a-4167-965f-1cedcace70e2", "value": "384:58yCiCSTrXDlVKwU+uxJKNKMUdGcr6LgvrQcYecQ7Q1yTEBDTnFh5St:iyCiCSblArxJKXQ7QRDTFy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635966605, "uuid": "de513d26-a128-4759-ae45-c393e4f59b73", "value": 21911, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635966605, "uuid": "536936db-2aa4-406d-8b1e-7e301693ac63", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966605, "uuid": "4065640e-03e0-46cb-a063-a6e7e3b654fd", "value": "3D drawing.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93609660-3ce0-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635969578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635969578, "uuid": "af1c5559-b99e-4cb3-919d-c6d8a864b528", "comment": "Malware payload (RedLineStealer)", "value": "1811312f9f6c8b0589f919fa52ae7bf3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635969578, "uuid": "0007b49c-58d7-4b4d-bce5-ba7ee437d49b", "comment": "Malware payload (RedLineStealer)", "value": "ad135b3550b16cc057faf2a605729a9652c7c067107443038a8bb3f232abe4b3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635969578, "uuid": "446ccdc2-bb66-4c04-9f96-ccd72ceb316f", "comment": "Malware payload (RedLineStealer)", "value": "e2354414ce4943588b26b95fea5a0c8a677d376f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635969578, "uuid": "bf1e884a-8874-4edb-b513-c3d5f1b3f630", "comment": "Malware payload (RedLineStealer)", "value": "8f2836c52ae15143f836a4f56e16fcf4ae346c626b2ff1365b2cbd77160201408053d2158956a198938fdd807b1b657c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635969578, "uuid": "c1a41767-0e2d-465a-ac30-983c653d0951", "value": "T11C84BE00B7A1C035F1F612F849B69369B93F3AA16B7494CF12D516EA9B34AE1EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635969578, "uuid": "5933db37-7cff-49f2-b663-d867b4366d5c", "value": "618406fbb822203fe0a0c735aaa630a3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635969578, "uuid": "2c4b5240-e1d8-4270-a13e-94cbdb3ea935", "value": "6144:nYIQhTJbFATBSTnmT3JJLCpOgx+0bq216DP8ufP3KDo22OXl0EmOx:nYzBvMBCnmTZQwgx+a128ufP3KD9X6El", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635969578, "uuid": "023db715-758b-45da-bcf7-7a61e399474a", "value": 371200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635969578, "uuid": "9b38f4ef-c706-49a2-aa1d-8df85eee1273", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635969578, "uuid": "f8971d3f-0da4-48bf-bfb1-234c539d0fb0", "value": "1811312f9f6c8b0589f919fa52ae7bf3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3e846df-3c8a-11ec-843c-42010a9c0014", "comment": "Malware payload (Tofsee)", "timestamp": 1635932776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635932776, "uuid": "4f3efa8c-8699-4c8e-8aaa-420d6215cfcb", "comment": "Malware payload (Tofsee)", "value": "e02d7e72ac3c10c149242b621c698c25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635932776, "uuid": "7ed5c015-f1dc-4c22-8298-7cf95de7224a", "comment": "Malware payload (Tofsee)", "value": "ad226d0d0d65f6b2cf338844fad2229e5556df67303fdcd0ba079f6c0dd0345e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635932776, "uuid": "3fa63371-6ca9-4257-ae8d-d4d697a63516", "comment": "Malware payload (Tofsee)", "value": "dc9bd2b73ce19fb63ab941d392a79ee8b49b38e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635932776, "uuid": "78853398-18b7-4ccb-9e1d-e24a1afa6bd2", "comment": "Malware payload (Tofsee)", "value": "dffe7e9bfb95ffd631103c21a3938b9e58238a4adfc1613947dd2ae4a58a878680a6c22b344f503f91c895d2098f6a04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635932776, "uuid": "0fa390af-1571-407b-bebb-47e75edf2b45", "value": "T1A3549D10ABA1C035F0B256F88ABA9379B83F79A1AB3454CF12D517ED5634AE1EC31347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635932776, "uuid": "61b5b97c-4340-4ba4-97c9-984558e5e0a3", "value": "7e51d9833813c1a3fb57baba54855909", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635932776, "uuid": "835f7b70-62d7-4a35-8f8f-1063cc65bbdb", "value": "6144:0MkYpOwqapK9JtUYHzV+KVZFEM444mzfwzHWIDa:07KOw9StT+mEM44Pfwz2I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635932776, "uuid": "1bb907e3-456d-4170-95ff-52df29e1780c", "value": 295424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635932776, "uuid": "510f0f57-af6a-460a-89d0-ac566f7b2cce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635932776, "uuid": "fb743617-3411-49cb-b0f7-05a645a5422b", "value": "e02d7e72ac3c10c149242b621c698c25.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcc5b001-3cd1-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635963259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635963259, "uuid": "01c52a82-98bd-41d9-9924-6ea4716593c2", "comment": "Malware payload (AgentTesla)", "value": "432f1aa7e662bda7937e691485901e76", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635963259, "uuid": "dae01d7c-c1b5-497e-9542-4e4b84ca37cf", "comment": "Malware payload (AgentTesla)", "value": "ae0e98826e3acf72d8c4b77ddd66fe2633ebf86a79462f3bedb2fedde0d5ead1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635963259, "uuid": "8a09d2d9-82ff-4c6d-8d3d-f0b1f6c9ea2b", "comment": "Malware payload (AgentTesla)", "value": "f9e2d7921db7dd105dc961378838afb79ff2f361", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635963259, "uuid": "6ec9f947-fcb6-4204-887b-74faca464723", "comment": "Malware payload (AgentTesla)", "value": "919f4935998a478fdb13f4fed09c7639f4cb0bf0dc4c3bbf163d96949257e60bb4c49cb2623f6fab00776717cb2738ec", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635963259, "uuid": "537b2cf2-6655-484c-ab9e-4136ec08ea4d", "value": "T1A3B4E0F0AA5CAE92EC2A5BF6047545200375AE5E14E1D10E3DDD3FAB72733422426F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635963259, "uuid": "7b1f2258-d4b8-414b-bb52-c85ce238a9bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635963259, "uuid": "cbf41830-7b94-4fa0-b2a1-b844b5451667", "value": "12288:eP2Y6kMXlT78DBfHL3ZTp5KwlB3KjzLTe1F5nNC:eP5n5HL3Z15KiBke10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635963259, "uuid": "349e8617-81d8-4312-97ef-e1618af0c464", "value": 514048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635963259, "uuid": "d77a5905-b141-4a4c-b524-5d37b0198d26", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635963259, "uuid": "e01c6256-d4b0-4fc9-8104-d10f3b9a1a03", "value": "SWIFT COPY_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9c70802-3cab-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635946933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635946933, "uuid": "7786f982-1bf1-48ed-8504-69fd3a2d1c34", "comment": "Malware payload (Formbook)", "value": "1ec1e11ac3014b8dd331b3d08972f21b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635946933, "uuid": "d668e24c-2f63-4ddc-acd4-0bdf2ccb668a", "comment": "Malware payload (Formbook)", "value": "afcf4012f8671a224c6856e0d968b7f7de88d7d96f0caddc97cd0f985694e530", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635946933, "uuid": "7e62d481-a268-4934-9ef0-02bd9d6e2415", "comment": "Malware payload (Formbook)", "value": "07c546a6a311835c712d9404be182daef56611ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635946933, "uuid": "326efdd3-0bb9-426f-85fe-6b766c0eb7ea", "comment": "Malware payload (Formbook)", "value": "883e575867245ce711eb59e3704fd9a8d29716854c2858912304d3027154bc2e2e86a3bf3cd996569dcb645e276dd24a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635946933, "uuid": "c53a1f6f-d2cf-4da5-a4a3-7e419ae24bff", "value": "T17664DF201083ABF3C0C233F31377D6F6A6A65C2813A8D5FE4E56697A6FE4DF9951A041", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635946933, "uuid": "5a0c6d10-087a-4a28-aa54-836dcbc77965", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635946933, "uuid": "2060f6c4-dc7f-417a-8e73-951dc901180a", "value": "6144:U8LxBjGVGXSJjRwHeSEKBE/LSq2lpPhkgBEJvssBD6H0C:XGwCJjy+SBCTn2LPhkVJEsBD65", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635946933, "uuid": "4a3b2db9-276e-4a1c-886b-a8022a624250", "value": 331027, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635946933, "uuid": "881e88de-3b78-4e39-8827-b4ec378f1d1f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635946933, "uuid": "6d5929df-38e6-4027-b06d-8a8c01c27a86", "value": "PO Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afacd810-3ce3-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1635970914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970914, "uuid": "f790d8d7-a777-4039-af69-b8772ef27d78", "comment": "Malware payload (Quakbot)", "value": "eca8073cf661515fb1460f6d9db0d2e7", "object_relation": "md5", "Tag": [ { "name": "clinton41", "colour": "#6523C2", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970914, "uuid": "aad7d746-74a3-4124-a1ef-7c258c6632ee", "comment": "Malware payload (Quakbot)", "value": "aff999aa8b0cb088f858429aeb0f18dd81337981f807c7aa98d95d9ddae34050", "object_relation": "sha256", "Tag": [ { "name": "clinton41", "colour": "#6523C2", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970914, "uuid": "a9c910dc-3fab-4c66-835b-a4df06ec0044", "comment": "Malware payload (Quakbot)", "value": "dce0c5debf1615eef93e07eca1189b9468f36396", "object_relation": "sha1", "Tag": [ { "name": "clinton41", "colour": "#6523C2", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970914, "uuid": "2a2b97f1-b256-4b4e-9d70-e6ab9177821d", "comment": "Malware payload (Quakbot)", "value": "26637b14dd39593aa97668295cf8a10170149227fe9001b9b12cb1263c5e28eb930f340099d2c374bb9e97c878b92e57", "object_relation": "sha3-384", "Tag": [ { "name": "clinton41", "colour": "#6523C2", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970914, "uuid": "78e37ca1-e4b8-45af-9ee2-446a2a614b42", "value": "T11DC4025671D8CBABE58617389CD5CACA7722FC20DF678603314A731E5D3ABA09D03716", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970914, "uuid": "bec799bc-6898-4cc5-9f35-950789ff9b55", "value": "12288:GSJ/U8SUbfnInMMRHKoUEu/xFz1UsjOxKJRQgiFuSVLDDOF:lJcQP0mEuTzLjOuhiFuyDDOF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635970914, "uuid": "2afa0d9d-c448-4d8a-aee1-36a66f3e9bc6", "value": 595968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635970914, "uuid": "7f471610-a9ff-4b10-b29a-8c07b180d3c6", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970914, "uuid": "2dd3f71c-9791-43af-9625-15df19dbebdb", "value": "eca8073cf661515fb1460f6d9db0d2e7.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "606060f6-3c95-11ec-843c-42010a9c0014", "comment": "Malware payload (SilentBuilder)", "timestamp": 1635937280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635937280, "uuid": "80561d6d-cea6-442c-965b-e9962095a5a0", "comment": "Malware payload (SilentBuilder)", "value": "7aafde59d7ffce82a291323ccf651fa7", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635937280, "uuid": "8145651c-11dc-41f2-b94f-d8bdb2aa4893", "comment": "Malware payload (SilentBuilder)", "value": "b08a69578526f175ee88b8f87eaf7084cdb5b04d1774224e562d8bf96f9069b5", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635937280, "uuid": "3a574f49-8715-41d3-8580-6c235d814005", "comment": "Malware payload (SilentBuilder)", "value": "da195bf7e470acd8805b0c39bb9d2d9f4dd8a2a0", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635937280, "uuid": "7b7b4dd6-1804-460c-aa38-f46093ca5146", "comment": "Malware payload (SilentBuilder)", "value": "6280752386c55427f433daff5d70b9969bd30ca86763d3c53d484e7763873f4d36d9db58e4cc986013ba28bbac28f6f0", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635937280, "uuid": "4604a0ee-b0f1-4118-a4f3-280c9dd83964", "value": "T10D935A42BA58D86EF525C77148EB53A5B322EC305F6B0B872665B3203FF99E06E03547", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635937280, "uuid": "70f0a041-8458-4370-b57c-57e9da038bd4", "value": "1536:i5Kpb8rGYrMPe3q7Q0XV5xtezEsi8/dgw91vrVmxJiME2GhdD52lZPFu1AOgS+li:0Kpb8rGYrMPe3q7Q0XV5xtezEsi8/dge", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635937280, "uuid": "c28dbac7-035f-4924-8f0a-c9cdf3ffdb37", "value": 90112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635937280, "uuid": "8224ca8e-defd-4f3d-a3e2-936e0c43d1c1", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635937280, "uuid": "e7d8c843-a8ec-4c94-b840-10dc2e2b2110", "value": "miss-413028425.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc6da3c9-3cdb-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635967553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967553, "uuid": "90f93439-c157-4a67-84cc-e839d98948aa", "comment": "Malware payload", "value": "014177249d20c40a37f9d378e2610273", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967553, "uuid": "ff277948-ec99-48e5-8566-0e8ab663e49b", "comment": "Malware payload", "value": "b11e5ea6a0325debe822ace2c094244ef3107f9f830c14a59800fde0e8d765ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967553, "uuid": "d10161a7-c5c5-4434-b80b-2a4061a1dbb6", "comment": "Malware payload", "value": "e06d57c715e913c3427fc6eed32923818ebe0977", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967553, "uuid": "9f90525d-68a3-42c2-9a4f-68f26fefbac9", "comment": "Malware payload", "value": "47eb86011aae27c105bd478e58d46c63120ec01752a3b03038b7249f4f801526d25836129c1fc6b5b05c3d18b130a2f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967553, "uuid": "0ee1f39d-a963-4da2-bec0-9ad3c744a6b2", "value": "T1DC74F101B2D3D035D5975D3088B4CBB1CE7B7962247048BF33A42A6E5EB1BF089BA756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967553, "uuid": "7dbd20c4-2b74-4181-a5cc-56417ef284f2", "value": "adc309f4258aa7e488ca350060834acf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967553, "uuid": "e95072b0-59c0-4e15-97d8-86b9b8b2d2cd", "value": "6144:M0EcZboyJrLb1NM38ct7iAAMRCPYBRe0Atx3W47cqy3X8x:BvZUar1NMsKRKYPDATbcjH8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635967553, "uuid": "e9a7c05b-42d8-46c3-b9c6-a4810a82bbff", "value": 360960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635967553, "uuid": "cdf23f95-b2a2-4ec2-a970-9e5628c1ac95", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967553, "uuid": "8cb59fe6-ffd6-4c0b-96c2-31141aca5763", "value": "014177249d20c40a37f9d378e2610273.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e66e2b8a-3c93-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635936646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635936646, "uuid": "d2dd101d-c546-4b41-b358-2134bd80138b", "comment": "Malware payload (Mirai)", "value": "d54a83016578ecebda247b295ca8d2a6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635936646, "uuid": "043e4ea1-c52b-43e6-8437-76f468de546a", "comment": "Malware payload (Mirai)", "value": "b20b90dc82fb4254ebf893c377dce753e3048ccec9d77026c1e7cf1e382db51d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635936646, "uuid": "c19af43c-23e5-40a7-b92c-36ca867b5106", "comment": "Malware payload (Mirai)", "value": "8e19f832f3c8e48f1c1e0321e28698ea5b26dd3e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635936646, "uuid": "f65f1b14-403c-4f38-b2f1-c65325255e7b", "comment": "Malware payload (Mirai)", "value": "d7d5391923963d2c8ef282220177d603a0b8564536d7ea52a305ae171aa393e54016a5d0e674971b7766e238c28b5c2b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635936646, "uuid": "53ed40c4-66d8-40ae-99d8-3fd8cd9c9295", "value": "T1CCD32A86FB418B17C1D61B77BA9F414A3322DB54A3DB330689185FF43F86A9E0E63605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635936646, "uuid": "87b902ce-5a30-4868-89df-8c746a6a2c2d", "value": "3072:X5LaJFGDFty4lhLKaztXJXMIFmPJG/7WEaMM/9d7wdAB:XFazG5ty4KmJXMIFQJsWEhM/91AAB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635936646, "uuid": "21856f78-c281-407e-8b22-f3e942047b3a", "value": 137550, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635936646, "uuid": "361b87d1-0b3c-401e-a905-6306dc29cf1c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635936646, "uuid": "bdacc9f4-96db-4764-b368-8d13197b1cbc", "value": "b3astmode.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10702484-3cda-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635966781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966781, "uuid": "d74df945-9c81-4931-9069-66dec6f82553", "comment": "Malware payload (Formbook)", "value": "8601e9fbd0710b734aaa95ba56ebf397", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966781, "uuid": "7968b283-d211-4d09-a687-5db006b7bbc1", "comment": "Malware payload (Formbook)", "value": "b224f2409381b02e0f465d688fba51a84efc05092c484fc5521b6b2ac8698aa9", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966781, "uuid": "e1de6372-c88d-4718-9c2d-7e81437becf0", "comment": "Malware payload (Formbook)", "value": "d5fefeba0606f92a7223bbe51091132404670daa", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966781, "uuid": "1ea09cff-cb1b-4c45-b96f-c108724df4e1", "comment": "Malware payload (Formbook)", "value": "7a65bac6e4baf851b53b76cad5110e61fb2dad25a41cd0df0e8dfe749354e6d698ed72fd9bb75556c8f4824121b9980d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966781, "uuid": "5d9c8127-ec84-4590-9ac9-b7384573f584", "value": "T17A14021562E5C99EC1F390FA605B8AC60B89CCBAEB54D459E3CDBB83C27494173D078E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966781, "uuid": "90183874-657c-420a-973e-c1743b7a3566", "value": "3072:cnTW+QMFc0kE8GIhfDE62w9FHCUQbHJqszlowJn5FZ7vI6+hz1MVMmVfgSZHiAeW:cnTW+FFc0Gw6LCUWquowPFZ7UhzqnHN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635966781, "uuid": "cfed4220-c1e2-4220-b949-baec87783979", "value": 190456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635966781, "uuid": "2a555c6e-3ee4-4096-8480-203b65eee719", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966781, "uuid": "0594eb78-85fe-4909-a14f-9f72045ae508", "value": "Inquiry docs_00345.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7321246d-3ce2-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1635970383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970383, "uuid": "e6328526-8578-4268-821f-2c6ff57fc1a0", "comment": "Malware payload (Dridex)", "value": "b1140cdda01d03eac0e951289c1248d5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970383, "uuid": "450892aa-2c23-4c80-b24b-1da3f7fe4135", "comment": "Malware payload (Dridex)", "value": "b280c76e8465a55f574a77d505deaf65bd15f0c895b59b87d9679b2c0626cfd5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970383, "uuid": "19965bbe-2331-4802-872f-02edeeef831b", "comment": "Malware payload (Dridex)", "value": "90ba28df251c71bd52cc64366962a3f60e18b0d0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970383, "uuid": "a0aa537a-7ed5-49dd-ac0d-6a00a64db8b6", "comment": "Malware payload (Dridex)", "value": "f04f3093001a5842185a4e24a33b311eccc00e32e16d5a79a4aa238dfe43ec09c2ff6ff879711211b1ed9cd9f919fa54", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970383, "uuid": "21006cf8-3b8a-43cc-8bf2-94ac40cde743", "value": "T1C653E10F4661B48BC002BD7A9A8CD8F11C44B0FA9C419A1A38727F5347E86D7DB6F56B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970383, "uuid": "8ac985f4-73ef-4f96-9553-6f09b1098b4c", "value": "768:8CWKdPiDbzNLo6CW2Z53SAPaWbpi3ouRQNuitAR6LQej5kaBdG1P6VTzR0BPxTw:8CWIPIbZ853SAJbpFNZe1ocG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635970383, "uuid": "52540b6f-20cf-4b19-bd07-256f9be94870", "value": 62522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635970383, "uuid": "93fed08c-e16a-47e8-941a-264b2d3049d4", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970383, "uuid": "f460bbf4-ea3f-41de-bc51-b0c950db0876", "value": "Order_8287.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12d3be43-3c72-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635922118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635922118, "uuid": "c04c80b8-7fe3-446b-abab-f56c57ba3466", "comment": "Malware payload (AgentTesla)", "value": "882aa2c9f1b9df9e49f44b75d1948f32", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635922118, "uuid": "ee5fe49b-66da-425d-9678-a74f6ac8be6f", "comment": "Malware payload (AgentTesla)", "value": "b42088fef313493342033aa86aa3fdc1e4038c9499291d23d1cf9582508e8f9e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635922118, "uuid": "46fe56b7-af1f-434e-af36-12ce53e24f73", "comment": "Malware payload (AgentTesla)", "value": "a9fc96ce5b6b18cc2a8080cc28a1a0d12607a6f8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635922118, "uuid": "f62bb177-b9c8-44a7-8992-d8a575fbfa45", "comment": "Malware payload (AgentTesla)", "value": "f3fc4d7ccd55a42be2798424b2d2dcf0eaf01dde39f63cdc5a7bb0825e2d7ac1bbace169dc87f4dd9723b3bc6dc723fc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635922118, "uuid": "51e49034-ad2d-4f1b-883a-7cb33cf12927", "value": "T17DB4238E2AD56170A848303F717FC57BAFAC9E2EA126141FC6C93583604DE96C2377B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635922118, "uuid": "95522bda-4649-4a6d-bc6c-58ed3a7abae7", "value": "12288:CrP7YLN5leJSYvJMs8BCwjU9i71yFZGUcHvz8XX:2P8h7eJSYvJd8BCww9iKFyvzk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635922118, "uuid": "68ad60cb-e8dd-4db1-a443-b31c5d90b940", "value": 529576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635922118, "uuid": "800a5fd6-7669-4fb0-a4e1-8c40530743d9", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635922118, "uuid": "b8e0497a-3ed2-4840-a5c3-c316c9b9e854", "value": "doc.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd13b471-3ca0-11ec-843c-42010a9c0014", "comment": "Malware payload (Kimsuky)", "timestamp": 1635942268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942268, "uuid": "d7b55b5e-1e00-4c54-80fc-25f5b224edca", "comment": "Malware payload (Kimsuky)", "value": "bb71a26c007298e5717e5b1ff3c561dc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942268, "uuid": "25b455bd-c18e-4ab6-b307-b5200af0e49c", "comment": "Malware payload (Kimsuky)", "value": "b4e9d15e619b5bb02341e0ba4e050ba14ead05669acbb2c49cfe1e501833b779", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942268, "uuid": "c2de8fed-10f1-43ca-9775-f727c928cecf", "comment": "Malware payload (Kimsuky)", "value": "4a4328b3b7925c6634b636b9c405d358ae6cccee", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942268, "uuid": "de0d7398-0fe9-43db-982e-2314f7c111af", "comment": "Malware payload (Kimsuky)", "value": "15b7c2d158d246bcdbae7b7e76723858591b89d9541a8510a3a1777bb255ff7c3a8a192ee2eed604f88372d8689e93e2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942268, "uuid": "b85333c7-7889-4353-856e-6327c61b4048", "value": "T107B36C11B1C0C071C0AE6E3D4530E6A29F2DBD61DE69AE5F1358413D5EB02D1AE36EBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942268, "uuid": "8db17527-d18f-4971-ab23-ecb9304d46f9", "value": "8308fd527beec1685acea37090f5c599", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942268, "uuid": "9fbdeaa2-c5b5-4101-9499-cbcc1bc63cf2", "value": "3072:Fwr1+EVkPgtthhjIhnGaKzblHxqUn3Ia:Fwrw8JLhRIObz4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635942268, "uuid": "78e0d058-3d0b-4a4f-94fa-e20a3ba45bf9", "value": 115712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635942268, "uuid": "334f9e29-4a70-47a9-90d6-c61c0bbfb803", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942268, "uuid": "ab557e46-a016-4c39-b1f8-e1f30f180386", "value": "b4e9d15e619b5bb02341e0ba4e050ba14ead05669acbb2c49cfe1e501833b779", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "111d140a-3c80-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635928128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635928128, "uuid": "a59b00dc-75f6-4dd2-97d8-d5151244f2da", "comment": "Malware payload", "value": "962316ba961098dd9bbea940f549a0d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635928128, "uuid": "a848e82b-b67b-4e78-a4d6-2a49e070ee19", "comment": "Malware payload", "value": "b50f92847d59e20265fe899aca6e5e5d729ce6aeccb57cd6653b2d55ff873299", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635928128, "uuid": "b4142d6d-cd1d-4e38-9994-3cd62ddcaa74", "comment": "Malware payload", "value": "eff36480c74ec3bca38cc0fca7ee8b5ec5d59daa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635928128, "uuid": "fc6e9478-875a-45d1-afb2-5a87c7060c38", "comment": "Malware payload", "value": "62f28c93354a719188529d1db207c9c6f7078debba6c3fae218952b6704af3d8774bc0a9f679afed16e35090a6927dc3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635928128, "uuid": "baba0df6-4d6a-4efa-811c-c9f753274c61", "value": "T15584CFD256E44212D5AD4FB410723D6113B77EAE3918F6CC6D98B8EB3A73BC24120AD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635928128, "uuid": "fc8f3a9c-ccdf-46ba-b0fe-0b772224f2d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635928128, "uuid": "67ce1336-104d-4216-ae44-e88c3ac7a272", "value": "6144:4OvIl1mgaYTuoDjJxZMnOM0n3t+bhgKVNTLTjI+kzG67e8Gh/whIt:fYTl1YMdgrdfjmCCuI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635928128, "uuid": "d7f9f6ed-dfb0-4d27-9cd7-4780c430b370", "value": 371712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635928128, "uuid": "b8dbbff6-c799-4e63-9828-f390f84983b2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635928128, "uuid": "775bc77a-12cb-4168-b32e-157d4f765156", "value": "ELjvs5w4PFgE3tJ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ce1aa71-3ca0-11ec-843c-42010a9c0014", "comment": "Malware payload (Kimsuky)", "timestamp": 1635941972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941972, "uuid": "5e465539-b8d8-4037-8873-f00d33d3742d", "comment": "Malware payload (Kimsuky)", "value": "37e7d679cd4aa788ec63f27cb02962ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941972, "uuid": "2335b97d-a2c6-4d23-98f3-46e15f60fddc", "comment": "Malware payload (Kimsuky)", "value": "b55e9d65a3130f543360a9c488d35475d4789ee7a32a4e94d02f33c21a172bcb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941972, "uuid": "e87c3f13-477d-4d5e-b9cd-74b1ec538da5", "comment": "Malware payload (Kimsuky)", "value": "7d66c1f36b4b48d990461ec44d626793ade6a8d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941972, "uuid": "1286f628-59ab-42ad-86bb-974f25e19e30", "comment": "Malware payload (Kimsuky)", "value": "bde50d217c8bb3bf55c5c6fea8fb73418b578030171a57e05ffec87a6e73f0938d250d40415c4eedd181e59e8ee0b1fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941972, "uuid": "30b98e34-54f7-4109-920a-b83e561e8b79", "value": "T182648D19B3E854B9E477813C89574606E7F2781A0771EAEF13A046563F237E09A3FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941972, "uuid": "8512013c-d88e-4169-b468-36c52e545325", "value": "77b34438da1c6957e5e5dcccce760d8c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941972, "uuid": "17db6b45-7efc-45a8-ba7f-ff69d05eb202", "value": "6144:4Bds5FReQ7QW/YzrQ3jx0+PZbbduc+NSohgC8f06:4BdoFCW/EUTxRbRtoOA6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635941972, "uuid": "32025857-6cee-47b8-a763-be130bfb91cc", "value": 321024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635941972, "uuid": "abbd5c34-7739-447f-bb7d-c149c81b6482", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941972, "uuid": "b1b3182a-7bbc-43fa-a74a-fd712767072d", "value": "b55e9d65a3130f543360a9c488d35475d4789ee7a32a4e94d02f33c21a172bcb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13451a98-3cda-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635966786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966786, "uuid": "2f489b08-171e-47f8-8524-1baa005904be", "comment": "Malware payload (Formbook)", "value": "202517a639e0db630d23438688a2ca43", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966786, "uuid": "d0334fca-c2c6-4cf6-9d43-7fecb8376f46", "comment": "Malware payload (Formbook)", "value": "b565aaa26ffa4afb7d9011453f959c5e09d2bf9786463b0f4521991f840ebd54", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966786, "uuid": "376046ff-3168-4850-adc1-14757914c3b6", "comment": "Malware payload (Formbook)", "value": "e617d9d6f2cb895b94a39dd1ed9dce63ff40a97e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966786, "uuid": "7eb9e599-0404-4c63-9c7a-e7bda5f69573", "comment": "Malware payload (Formbook)", "value": "017212fe538ab3e65771799c4d9128d57eebfb7ccacd0e721e60e1ce6d1beefbf16f4794fed970f52c95db6b18f059ef", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966786, "uuid": "efddb04a-7471-47b8-95db-5a1d3573ab9d", "value": "T160141253B9EB0225E6FB4A3B9A1F0E82889ACD16713B844135D376C723F7ECD124535A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966786, "uuid": "4850a201-3c59-4a47-8a80-9b0539b5bc04", "value": "3072:Nl7NrZOXFXjmxEhQcDsfqv4B4TdZFnUWNIKoCHtOmIAlpMRCQVSkl:Nl7SXlZh7DDAB4rFnUwA2IkgCQ/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635966786, "uuid": "900be6df-5411-400b-b028-610c418ca946", "value": 206488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635966786, "uuid": "22416d42-75e2-4ea8-8dc5-f3d68dccaeb9", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966786, "uuid": "74c6eaba-2d66-450b-9a85-08518cd01e86", "value": "AL Bijjar Trading FZC Requirement.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41747b5c-3c9e-11ec-843c-42010a9c0014", "comment": "Malware payload (Kimsuky)", "timestamp": 1635941094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941094, "uuid": "b3c8d655-6285-4fe4-9a43-b2e3dd8466ac", "comment": "Malware payload (Kimsuky)", "value": "f1ab309acc0afaad3bd799be8aed3dd9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941094, "uuid": "1b7490ae-966f-4556-bc91-de92bbaf9f8c", "comment": "Malware payload (Kimsuky)", "value": "b5a072c49a57cfaa9e8081f7424df00d08815580c81eab3daf6e7f70604ceb38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941094, "uuid": "7eccc1b7-23d8-47a8-9c50-500ac7c513be", "comment": "Malware payload (Kimsuky)", "value": "8f268312a98c6cf69f2b9e6ba894b093eb9157f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941094, "uuid": "ec8ffe42-de7d-4f2b-bd78-2933fc6e09e0", "comment": "Malware payload (Kimsuky)", "value": "6f5daeb9a6a8293d008c49671b76f5022aa04e78f04135f70dc3ea530695146e6c29f815136b2da35bca123ea9d0f206", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941094, "uuid": "bec9467e-b1ca-448c-80fa-427349f20c1e", "value": "T109553391525FE7E0C7C1913AB73C2095222F80E11E871CFBC6B8D6D980BDA5958DC9BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941094, "uuid": "79d5ab3e-d355-4bc4-86e4-6de562c49838", "value": "12e45b0ae18a632bf4c60fd81b8978ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941094, "uuid": "8d14ae06-c03d-4903-adce-413927f18a9f", "value": "24576:zsuGiMvN5+s4WzhCaXBlpYkBkTq99j23FvCXY+bNpi6K/xJr0FaPVYqlNjb:zsqQn4WVCaXBlpPYr3t2pO/XrRtBNjb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635941094, "uuid": "c2ef04a4-67a3-4e4e-b96c-0d7a6988d4cd", "value": 1297920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635941094, "uuid": "bc1d65fd-f6c0-4ea6-b6d6-ab9a46305ea5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941094, "uuid": "2a6099e3-e968-46b7-8c59-0ab697bee349", "value": "b5a072c49a57cfaa9e8081f7424df00d08815580c81eab3daf6e7f70604ceb38", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c12fc12-3c5c-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635912684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635912684, "uuid": "b00cd4aa-428c-4962-978a-26e84ff76569", "comment": "Malware payload (AgentTesla)", "value": "e46b2289a12563b69eb9363a42d73adf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635912684, "uuid": "09f7a4b0-a98f-4d76-97d0-2fac791e7c5a", "comment": "Malware payload (AgentTesla)", "value": "b6f22d1fcfb9a5ace386ab8e9e9520e755b5d5660d0848519a03e7d62a1f62f1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635912684, "uuid": "f6eb62b9-11ab-45e1-88ab-eaf8f2f0fd34", "comment": "Malware payload (AgentTesla)", "value": "79f1e236d5707996e8f5d00535597788ef3f7b1d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635912684, "uuid": "7e0eaaea-144b-4e65-bcef-7ea057135e1f", "comment": "Malware payload (AgentTesla)", "value": "4879560e54730a0b79f2a9af7e09673a1c6178cddb4812f01a070671f03a6a33173c9bb4b6c02fdf005ee7c5d047c666", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635912684, "uuid": "43d65fe5-c302-474a-8ed0-424ed25cba08", "value": "T146941201BEDAFD05C0BF0F37963211A01BFABA075421D74F2989726E88A776B535172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635912684, "uuid": "4aa6a6c1-bf57-4ec0-b428-337e00fb83f4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635912684, "uuid": "8e958f19-8fdd-4688-9166-c6999597ef40", "value": "12288:vTl3aYHx+LFParHov73R11npdq+bSL/Uowi1oJ:vTxaaxGRkoD5fSjX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635912684, "uuid": "793a585e-5aab-47d2-90e5-d6c7ac480f41", "value": 424448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635912684, "uuid": "5f11c305-0ebc-4e45-91e6-964c97737e0c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635912684, "uuid": "bf0e121a-b4aa-4dd2-af10-87b7eb923c3c", "value": "Payment Slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e022df20-3c4b-11ec-843c-42010a9c0014", "comment": "Malware payload (DCRat)", "timestamp": 1635905712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905712, "uuid": "2fd7f2ae-561b-4022-8e20-9965c37d00cf", "comment": "Malware payload (DCRat)", "value": "a101ac75e83f356ed6f31bcf9faf9c7d", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905712, "uuid": "961c767e-08ff-4eb2-9dd4-27cbfff453f2", "comment": "Malware payload (DCRat)", "value": "b7ecabc2bd77c51ffb967c26e3d6dcd7dd6c106f9390b5c503f1d5fbb5db59b3", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905712, "uuid": "5d075dc3-dc49-4b28-8702-4c755ab5e6a2", "comment": "Malware payload (DCRat)", "value": "d7564c4fb9195053753e1ea6c916443e36c0eebd", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905712, "uuid": "429ab1d1-a60d-4c6b-9da0-1e530747bddd", "comment": "Malware payload (DCRat)", "value": "609727c3796c7a1de491f7dffdc7ff9461fbbf5205f9a4caf6b87693d52f93b0a6e5ad0acd8e94a28bcf0038ec422fac", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905712, "uuid": "0b454b16-2346-401b-9219-d7b80e88bd5f", "value": "T189C533565ABF0E12E3C52A72549CEB9FD5E03D0037560DA60C8A5ACCEE7346D7B04A3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905712, "uuid": "ac6990b3-0662-4f49-9951-5a30d58fd13e", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905712, "uuid": "480abbc4-63e9-4d80-b742-453a564df1df", "value": "49152:DqU6OXSi0Id8zYsfv+e9noAC6ebUQoLAkhTkuHx9pFKN6MO2+VpH:mn4yIuzJldoAU4dZC+lFETc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635905712, "uuid": "d131a278-43af-4323-af6b-8d1e09055715", "value": 2736128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635905712, "uuid": "126121ac-8d3a-49b8-b11b-37c9d3e8354b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905712, "uuid": "fd366f84-cdcd-4f32-954f-ab50bf3f9fa7", "value": "a101ac75e83f356ed6f31bcf9faf9c7d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffcd42c3-3c9a-11ec-843c-42010a9c0014", "comment": "Malware payload (CobaltStrike)", "timestamp": 1635939695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635939695, "uuid": "19bd8840-abea-4fca-9b3a-966b33e302d6", "comment": "Malware payload (CobaltStrike)", "value": "e60d934028a4156804cec92fa91c3878", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sangfor Technology Beijing Company Limited", "colour": "#10F549", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635939695, "uuid": "bbab4f79-b8fd-4aa6-ba86-153f5d3b7f23", "comment": "Malware payload (CobaltStrike)", "value": "b90cf2d0bea4f28ddd88e191be2785825baecf8d3e64f069cc35654c71afe87b", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sangfor Technology Beijing Company Limited", "colour": "#10F549", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635939695, "uuid": "741538d4-729e-41ad-af0a-6d1077784201", "comment": "Malware payload (CobaltStrike)", "value": "ec134d89e6b136331b050a40e66495ee9a5e9874", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sangfor Technology Beijing Company Limited", "colour": "#10F549", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635939695, "uuid": "b0a42186-3e2b-4785-ae0e-04f465b32c40", "comment": "Malware payload (CobaltStrike)", "value": "3d38a549e170743e6eae9e7296e72cbe76f49e17151836b814bed9a6a1131acab8db7afb6eafafa51e19646c3f56eebb", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sangfor Technology Beijing Company Limited", "colour": "#10F549", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635939695, "uuid": "5a5b724f-b11e-430f-8b45-70df391d48d5", "value": "T1F245BCE65889613EF01A783D3B2CB87356C17F562190FF52AB09A36E1936B718BC3345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635939695, "uuid": "88fbfcbc-7c27-4501-b131-8a9177a1085c", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635939695, "uuid": "39660d1d-594c-4dfa-bdb7-4a7c46b8fbdc", "value": "24576:reR5i/GnQiQ1sZkFCy1Iui85Q+HTR0LzSCJyI83UOtz:reHQj1100dyuTRQxz831t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635939695, "uuid": "be3e0963-fa11-4444-9c73-80d5d565130e", "value": 1192280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635939695, "uuid": "071c462f-e55e-4c56-8d50-2e1b6b97ac2e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635939695, "uuid": "b2826fa2-7651-4f55-9184-d8c969af131d", "value": "b90cf2d0bea4f28ddd88e191be2785825baecf8d3e64f069cc35654c71afe87b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72dfdb4c-3cd3-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1635963940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635963940, "uuid": "b2e86ec5-17ec-4bef-a006-eb9240057caf", "comment": "Malware payload (Dridex)", "value": "8c0dd477d87cd942bff645cc95254646", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635963940, "uuid": "5e40a96f-6ec8-4862-97a8-567e451ca5bd", "comment": "Malware payload (Dridex)", "value": "b91e61f5fb1182e937c9f64b3547f16f550c8debe3b38e03751aa3ac78d67a78", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635963940, "uuid": "638ce706-0fe2-4dc9-8f4a-848a95750612", "comment": "Malware payload (Dridex)", "value": "3742d0732ce6caf447f065b6e0b4d0702c0448ea", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635963940, "uuid": "a4851f4b-c9ea-4169-ac16-727f504fb8a0", "comment": "Malware payload (Dridex)", "value": "2a58c69d2b88c68b99f5f8cd3929f606a0a589c456aeba5fe867cebbeba6e94a74b7f8cd6460602f34a6057408e2eff5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635963940, "uuid": "08ae43d3-0419-43a6-8434-b4345fca12bc", "value": "T1EFA4BF04D1EA0676D52B62FE71FF0CCA47104DF9B506AC84D3435A6A5B32FEC3A7A849", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635963940, "uuid": "8fd959b1-2d01-45df-a305-16e91cb93b07", "value": "ccdf79216449388cf5a36d38a385d866", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635963940, "uuid": "6ff4b602-4380-4e1a-9d16-da041fd9238a", "value": "12288:AZKEZNxJPdthZz/MqmOce24Wqa+cKdDSFczjJgiUCeoCqoE:AZKEr/1jhz17Px", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635963940, "uuid": "ca373cb7-98f9-416c-9866-bf0933d221c5", "value": 471040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635963940, "uuid": "9b3411cb-016c-4a63-bdba-8f784adb4df0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635963940, "uuid": "b9623f3d-3017-4cfc-8539-23df3c6b4791", "value": "SecuriteInfo.com.Drixed-FJX8C0DD477D87C.2752.18360", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29453789-3c93-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635936329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635936329, "uuid": "9bdc15d6-af63-4661-bd44-7ec91cccea26", "comment": "Malware payload (AgentTesla)", "value": "4c5571a68a95dd21d8e9ba49110d63aa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635936329, "uuid": "117ec517-9397-4258-9d4f-e609aca51f00", "comment": "Malware payload (AgentTesla)", "value": "b929589c0333e7348dd48b799f7766d7ea224392e879621f8bd7e8a1ee794119", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635936329, "uuid": "767c8bc0-496b-4c67-be2f-42bac2dd9402", "comment": "Malware payload (AgentTesla)", "value": "a5ca5dd0dd88e324ab895e1dd3c990a385e3cbfa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635936329, "uuid": "35c2f080-8c65-4774-baae-dffcd232d506", "comment": "Malware payload (AgentTesla)", "value": "1898c7960c5e378095df8d5644639c2b29a6142e2c8f4b03cfb5248de1330b5e2eebad06aaab846a35a7e0654ab83e07", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635936329, "uuid": "fe78fed3-d28e-4d6d-9eba-fc3b40c0d288", "value": "T1FF45803538E8748DE9D6883044DC2C621D5AF9733D8AF15A90D36C4CD47A087AE6EE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635936329, "uuid": "3b952683-3bf7-4337-877a-41e88a5ef3b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635936329, "uuid": "90bb6e8a-e53a-43b5-92a2-02f767fae2e6", "value": "12288:oPRJrbX8Qo4Db9bRZ9bRoqJFTPNvJyNELDKWhydVq0W8hSDEJrTsXvZOddVYiwZo:oPvrbX8Q9dtDtoq1dKSydVt9/Ft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635936329, "uuid": "341069ee-5cf4-4543-9ccc-477643b4d23f", "value": 1172480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635936329, "uuid": "5be31231-34c4-449c-a641-cac8493462d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635936329, "uuid": "d5a5d38e-27fd-472b-9449-36ed94697065", "value": "SALES ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49b9492a-3ca0-11ec-843c-42010a9c0014", "comment": "Malware payload (Kimsuky)", "timestamp": 1635941967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941967, "uuid": "1b28d982-2bb4-4e44-b3d7-16f96fc1246f", "comment": "Malware payload (Kimsuky)", "value": "bbc79820ccc040a54d2327ec28875377", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941967, "uuid": "bf1fc3b3-15e2-438e-a91b-cac7390d9c45", "comment": "Malware payload (Kimsuky)", "value": "b970be67522c225f159c6873b160bf3e74520c1df544dee833fbf16cb3c9d8fe", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941967, "uuid": "864885a7-0c2c-4afe-a319-b8b761927059", "comment": "Malware payload (Kimsuky)", "value": "4aa9654b552cde5f59ddf909ad26f65c958634d2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941967, "uuid": "612a0c20-54ad-42bd-a023-8f2fcbe2b59b", "comment": "Malware payload (Kimsuky)", "value": "468d56907d0df38283361c44a468bc99cb05e1d466c67314356801421a0b8fed873ff010084d91c2b2526981fe845429", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941967, "uuid": "8aadf891-e7c1-4a94-93e7-a8f76e120cd6", "value": "T19F743A387C958133D07B827095F59AD7E85C3C227AA0D89F27D10B6A8D237D37D61A2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941967, "uuid": "887e435f-6ed9-46bc-abf4-f2f1d782417b", "value": "a2540095ab60a799034f31ddd920e060", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941967, "uuid": "eda14c1f-995f-4e7c-9f2f-83d387d9d232", "value": "6144:VWR2nvWYgGdYVIC9V4um3jIMzNFEgwmyjabDhdI9ZwAuLrZAOFhc/3:sRsWX6YJVijIMzNFEoyjab2ZBuLrZ9cf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635941967, "uuid": "abad44df-9fae-4f79-bd5b-4cb1245a9f8b", "value": 359936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635941967, "uuid": "7a63d384-f4a3-4c07-89bb-1b17431217a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941967, "uuid": "59754c8d-46a6-442c-ba6b-7b7d6bb152f1", "value": "b970be67522c225f159c6873b160bf3e74520c1df544dee833fbf16cb3c9d8fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31936d89-3c70-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1635921310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635921310, "uuid": "5ba0303c-4657-4ecb-b69d-7bfc2f49d60e", "comment": "Malware payload (Dridex)", "value": "ca2e9654a91c0f652ee5f9aa074b0276", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635921310, "uuid": "db6ec317-9f09-4187-84f2-6d05930f44e1", "comment": "Malware payload (Dridex)", "value": "b984efd19fbe99484dac032cd182e5bfbb4a81a32bba8eb9e0d0217596f75b92", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635921310, "uuid": "151709e8-627d-49eb-987f-f2d9bd4a0f02", "comment": "Malware payload (Dridex)", "value": "7a511f1fb073e2074102d3722e0422d6de2952a5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635921310, "uuid": "6e5f79cf-fb12-4e8e-80d9-fe46130abcdc", "comment": "Malware payload (Dridex)", "value": "c2c3bf98eca879eeb5901f54d6a00489716768c43af30392b3adf0a2d002d7a0c44f521c0616b4f40b38a90f0cb52369", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635921310, "uuid": "f42371a8-922c-447a-8e6f-0896448c9fae", "value": "T132B302DED5D65818C0AD9CFF81952CF26C39044A0546F72F7CAF66085A9B28F970F11A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635921310, "uuid": "f11e3fa6-d921-4907-bde9-f55adcf0071e", "value": "3072:83mFzIsj8aipSW4vHREQ4iZKUbtnZ9E0v3WBkh0P1:8bOipmvxpZfZbzho", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635921310, "uuid": "4bf87054-52b5-4aef-afc4-df208f4f3016", "value": 107939, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635921310, "uuid": "f7865f18-1120-451d-aedb-b41d13d9ba97", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635921310, "uuid": "e9291cfc-c564-4e6d-861c-4b2ffd44963b", "value": "INV 362996.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66537e8e-3cba-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1635953181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635953181, "uuid": "6b252c71-34d8-44bf-854b-224277ccf505", "comment": "Malware payload (ArkeiStealer)", "value": "aa274b420a15cdb8384906a3c45a6d22", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635953181, "uuid": "2355170a-4d37-4ebf-ad78-d2f77d7ed1f9", "comment": "Malware payload (ArkeiStealer)", "value": "b9e7d6015213b2126e602e7e796f4590cdb2a941b4e8eb30b75bc9c46dce1754", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635953181, "uuid": "2d958b89-e1e1-469b-a130-f7c6d5cb808d", "comment": "Malware payload (ArkeiStealer)", "value": "99bc08e28683f4b07f0c168facce2d529a08d0fa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635953181, "uuid": "2bc59d45-d01f-454d-b148-75f6ace730a6", "comment": "Malware payload (ArkeiStealer)", "value": "be9dd6aa8dc76129f98430b9f67c27583961fb91a245f534fb4e61ade6252563c734ab235514a05e56b8eb9c389fe5c5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635953181, "uuid": "fa82e659-494a-4cf3-98a6-6e4a4ced7e7e", "value": "T113E39C2472EEC431E4A356304974DBB11E7BB8731931099BEB60273E5EB47C08AE9767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635953181, "uuid": "057f32be-3dc8-4f53-8c81-08eeac2fe323", "value": "adc309f4258aa7e488ca350060834acf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635953181, "uuid": "5a78a734-1381-4e5a-8f19-dc61c260af3f", "value": "1536:kWl8jWeyYwl6ilZDWDlHPImK+euiFDn9l3PbG9wtrUS9+AKxnl03ZaQukBilPENy:KKY26iHwAmKzTG9mzjpaX3lPQWt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635953181, "uuid": "9ea9b376-8ce6-419b-913b-3dd53fea3e2b", "value": 148480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635953181, "uuid": "0830900d-ba26-4714-9998-71e354d8d470", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635953181, "uuid": "e23e80cc-4645-4d5e-9c75-08164dfc200b", "value": "aa274b420a15cdb8384906a3c45a6d22", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62ac221d-3cda-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635966919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966919, "uuid": "391863e0-d50b-4e58-a588-17fb4a4d5038", "comment": "Malware payload (Formbook)", "value": "fd562a4736f14d72db38d89f97c34b25", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966919, "uuid": "e5614a22-8ffb-4a6b-9f6c-80556dd4518a", "comment": "Malware payload (Formbook)", "value": "bb3a605ce1a070cb5ed0153e6677b15aa2b3187870f74b21c4373f55b9c49975", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966919, "uuid": "d1b78841-b609-4e8b-b3b8-7d8589762186", "comment": "Malware payload (Formbook)", "value": "76cff761fa41e43d3f1ce2ecb70676c10e9e716e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966919, "uuid": "c69700fd-f4e2-4811-ab4e-18888f9dfe09", "comment": "Malware payload (Formbook)", "value": "fcd977fa960f5c2fe41a5fff8850c003e51660a5d0f6bc214460e1e84b4b2f2f184f5daaa0ee58b2307122a710bd232d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966919, "uuid": "f42b2b82-6f34-4337-8fd6-f08ae35b82a4", "value": "T10B1412ADBAEF701DC3727A381F7321185928FFE26241ED556B7C341960706179B078E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966919, "uuid": "55791de4-c5ef-4c5b-8311-869d25cf18d0", "value": "3072:P51WiHhAUkOQSdZnHRmi/KmCMGPmejLzLcO7G4VA8qrKJRM42/p7lEGI1Nd3uwB4:xO27miCmCMGPnjjccGsS4M7qGI1HuwMv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635966919, "uuid": "87b09ed0-0fd2-4402-a587-ea8698ebfd61", "value": 206344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635966919, "uuid": "1e3de28f-208b-4c84-ada3-ac891aa76f0d", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966919, "uuid": "6e8efb67-b01d-4d36-910e-f78fdd4cf426", "value": "Quotation.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0330f0cd-3cd1-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1635962894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635962894, "uuid": "1f532afc-ed9f-46f3-94bb-4b69e2f29405", "comment": "Malware payload (Dridex)", "value": "38115c1f425bfe9ed9a30195503a6e30", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635962894, "uuid": "99da3f28-16c4-49a3-a20e-9f020c2601ec", "comment": "Malware payload (Dridex)", "value": "bb50b1df501e549ac68b2ec34573c7883d17e947ec5e1ab28938243c108a2fa4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635962894, "uuid": "73bc6e57-95a1-4208-a8ab-86b5e576f5bb", "comment": "Malware payload (Dridex)", "value": "1fd11b214a3f33a63a7ed8b1558af7e312d4749f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635962894, "uuid": "d564ec0c-98b3-4958-b743-51ebeecb7d2f", "comment": "Malware payload (Dridex)", "value": "7226b8ec758b830462ece1f8242c6c6a425e428945be9e09751e6b3c5e3a1a57557c03de028239b23b08f68fe12ddae1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635962894, "uuid": "ac238948-357c-4627-8451-1e52f4bc3686", "value": "T1EE830169AA48FCA2C1BB4775500CADF0B546B6A82CD1F11E349DF208A6B17D3578B32D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635962894, "uuid": "c6140322-8a76-4f0e-b244-f208a1e954f6", "value": "1536:8CW+PqrE3gpMokPF58Ik4kosQFVvSuMeQIuzg3zEZrpGJnZuNnWiBjdeJ:83bEwFkd58IXkOFVvMeQIucjSrpG3uDA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635962894, "uuid": "a98fb171-d5ce-46c4-8a0f-8063cefcda11", "value": 84221, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635962894, "uuid": "d9226c24-28bd-4896-aa83-e1b3505c3caf", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635962894, "uuid": "636712c0-ad26-4103-abed-4ae7c64a6138", "value": "Order 926916.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f015dd28-3cd9-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635966727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966727, "uuid": "4705e058-08cb-4c30-8849-ea9c5edbcd1c", "comment": "Malware payload (Loki)", "value": "442ee143b191a84589af24197fbd20c6", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966727, "uuid": "363a091a-e103-4eb4-9ef2-b087a4362da9", "comment": "Malware payload (Loki)", "value": "bb6df9abd230123d19ca3d1d02b7d5dc0cd8e750bbd10f5c9f22a84e6f1e93f9", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966727, "uuid": "0691949a-348c-4f44-875c-66707216f030", "comment": "Malware payload (Loki)", "value": "ca1f291e393cd7844c79efac7cac1ccbf772de80", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966727, "uuid": "8648745b-9ac5-45fe-9b6a-3f4dd955a2df", "comment": "Malware payload (Loki)", "value": "0b09afac267db80b512e2cbb898480017b079fb826ec0233b46637cb67dc53af2b8fce3e5fb46349c92137cb882e54d1", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966727, "uuid": "d280ed1a-a585-4536-bd53-96bdedd8d980", "value": "T1FB1412507BDAF757D0965B342725266BECBBED149EFEC684317AB32A8339C29403210D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966727, "uuid": "7f276673-294c-40be-ac96-1805de9cd423", "value": "6144:zH91s5525UrvWK/uExQjTlPOMd48ISbop8alwF:b91s55qUrvWKGE6jIgBalwF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635966727, "uuid": "ad594e5e-0ee9-4b80-ba74-6d461ae1a6e6", "value": 206152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635966727, "uuid": "4fe22136-dc8f-4ae0-bcb2-ab98c80db164", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966727, "uuid": "35c7561f-9d0b-45c8-942c-0b7679827494", "value": "scan_payment_advice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8f25112-3c73-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635922799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635922799, "uuid": "ea160302-588a-4890-8fb2-20c41b0fdc77", "comment": "Malware payload (AgentTesla)", "value": "b18db7be00e9282f9d03d17d2905e32f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635922799, "uuid": "115284c1-ace4-458d-8df2-b82f72940c45", "comment": "Malware payload (AgentTesla)", "value": "bbc5be761e8f85a78db25d2796d46a6791c840ea414451c115c581353c95386f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635922799, "uuid": "90019053-6dbd-4782-a5bb-18157f005f64", "comment": "Malware payload (AgentTesla)", "value": "769c1d0653a216a3e83b0628f883a77bf476c077", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635922799, "uuid": "a1fa61bf-dca2-4ec9-81cb-a6cabbee9fe8", "comment": "Malware payload (AgentTesla)", "value": "fd1a68332d8d9d1be11613741402737a6b3a73fd80c9719f05558ba9c46728545cf77973e141ec9adc4aeae6fc5fc726", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635922799, "uuid": "77d424bf-7302-4280-8c52-6a0253c8021c", "value": "T13BB4233E05FAE370B2ACE1F336CF0198DA2A56229CEFB14FCE9014465A8395B59F0153", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635922799, "uuid": "b3dfa48a-e578-4a4f-a11e-34f21985de73", "value": "12288:3qPlmaKjPULtNDuBnRel++G6xOpTGDBMgZ26:3qPsjPMfuBnR6++G6xYoBr26", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635922799, "uuid": "eb64f8d2-6561-41aa-88cc-cda69e401e89", "value": 521240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635922799, "uuid": "c33a7328-f964-4db7-94fe-8f8e8fc53dab", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635922799, "uuid": "ce554e1c-cd15-402c-b7e1-1ec138f433c1", "value": "New_Order_PO#960780_MT_Quote.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45837c8f-3cda-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635966870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966870, "uuid": "2ff5be20-aece-4d71-a2a2-2d4b5e12fbcd", "comment": "Malware payload (Loki)", "value": "a33ec7225efeec96fba99a76d7dd9310", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966870, "uuid": "6ae4ad06-2302-4428-bba2-766d7607d831", "comment": "Malware payload (Loki)", "value": "bc16fdd496e4440b4fd4466eea304e6df2063cd6f8f44f858006b7542fa77180", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966870, "uuid": "c6ccc0e0-e3dc-43ca-a3f0-e2e634d06610", "comment": "Malware payload (Loki)", "value": "cd05b857172fa1b35236d31745db2cf227658785", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966870, "uuid": "082345cb-018b-467b-8928-b1c3ba73566f", "comment": "Malware payload (Loki)", "value": "5f0b9deaa3b5c18f9e34e1a880cf703f219370f236c383529bc0da893bbee731ac15a4024134bcfeb8969ec2d76f284a", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966870, "uuid": "2a57f21d-1da8-40e0-8306-d339ed74fcb0", "value": "T11C1412C0F2496694F58D39384236918CE1C29C5CB6FFA39F84D73F6EF47612C862A691", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966870, "uuid": "637df213-f3ff-4506-917c-60821650d2f2", "value": "3072:l+Y18LWCSE8EkaaC9H3qQE1gbXBBlqHCEpiOmIKUbTeY8v8wiM85E4eoyqxfqud2:l+JLWCSE8EV/qt1mlqHNiOmIKU+jvDJt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635966870, "uuid": "6d9da49d-ac99-491e-95bf-f0e6c344b829", "value": 190968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635966870, "uuid": "833eafff-694a-41b9-8a4e-1f9c979af9a4", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966870, "uuid": "49c77455-eb81-422c-ae2e-b3c1713470ba", "value": "NEW ORDER.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8894af22-3cb5-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635951091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635951091, "uuid": "c26e6058-5e77-44e7-b418-c8e47e432c09", "comment": "Malware payload (AgentTesla)", "value": "9ebcd6951a610aa4b758ab7ebcce065e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635951091, "uuid": "3879f968-0c78-4e37-80f2-adbacda5082d", "comment": "Malware payload (AgentTesla)", "value": "bce60bf27fc8396c63d3eb51344a09327d4dc2954f5a3fcd79af12969d59b503", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635951091, "uuid": "cacc75c9-3b9c-4bd6-a39b-cf7850692c62", "comment": "Malware payload (AgentTesla)", "value": "2d274ee8c39e6ded003f862ff118b1d38ea7a5f4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635951091, "uuid": "efe0e40e-6ef8-4601-bd3b-7d1480494ce4", "comment": "Malware payload (AgentTesla)", "value": "88722ef6ce2b3f4e9887d033ad5938de98b9e28bf15151951adde01f7546cd7f6d476b79f25aae26f4d559069297e802", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635951091, "uuid": "f79fbcc7-0383-4d60-b077-f372417cb072", "value": "T1386402A077E85F33D93E83FE15A102104B71F25B2512F35D6D8A29DEABB6B4015A0F93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635951091, "uuid": "deca54b0-d9ce-495e-b142-687cc062225a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635951091, "uuid": "a3e33529-900f-499d-888d-a6ba89c357dc", "value": "6144:pcuxmTHZgFDJqiK7N4gJVshvUWrWz8xi/HN8WoaEC9+B0ATylTXtKN:pcrHZgFDoigVshvUWK8G5oy9VATy10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635951091, "uuid": "98d53846-6f2d-4f71-b0f3-11c637ab3d82", "value": 320000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635951091, "uuid": "8cdf58f2-ac75-4aaf-a892-ab5ad8805a9d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635951091, "uuid": "faba7c60-3e2a-421b-b087-fab360dec841", "value": "NEW ORDER 20211103_0001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6087d79e-3c59-11ec-843c-42010a9c0014", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1635911511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635911511, "uuid": "83301ecf-e45c-4939-a22b-acec3eb0b9c2", "comment": "Malware payload (AveMariaRAT)", "value": "57538f6809e7dad7ea8ffb12c00e8740", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635911511, "uuid": "22c516f0-5c00-437f-9c45-3de25d4bbf6b", "comment": "Malware payload (AveMariaRAT)", "value": "bd8a5d384969b709e0fdc1cd60dcce42d2c739098239d72a2a48830a892d54e8", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635911511, "uuid": "f36cbe72-d2ef-4efa-bfdc-c99ad40efa01", "comment": "Malware payload (AveMariaRAT)", "value": "def077c38868971c58d30a466649942e61d594a3", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635911511, "uuid": "42a37b1e-1ece-495c-b1ce-16d17738f21f", "comment": "Malware payload (AveMariaRAT)", "value": "be06e73d1a00547b0f5f70503a7429f75ba752f337e153931becff22aefb65e1f29d52ed88ec91e5f993a426a14848ca", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635911511, "uuid": "3952ce96-4584-41de-b8bf-e67fca452799", "value": "T19D74AE1673078F05E828B7B69EB7BB145710B7B15C36931762C4B52FB01F3AA3A90746", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635911511, "uuid": "ac399e9a-5d78-475a-a6df-5401b5fa98f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635911511, "uuid": "12815f16-95c7-451e-9454-a1d6766303c9", "value": "6144:1bmQGvF91yHlB6jI0tl5WFeMV/aFPIT+Hs6e1c3YAoIA0DldyTbaR2zZL5xdR+:TGv7YFoJt6FeMgIiHs1EmWR2h+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635911511, "uuid": "38c47984-7cad-4ce0-9103-2e2959c59cdf", "value": 367104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635911511, "uuid": "f56c45ac-ca9b-4603-b80b-8661d97906e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635911511, "uuid": "3bb75202-674c-4c22-9f48-473ff3642a7b", "value": "Purchase Order Ref#645324.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e57c128-3cdb-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635967341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967341, "uuid": "99678090-f576-4a5f-9882-293ca5c1def3", "comment": "Malware payload (RaccoonStealer)", "value": "b716ef0649230524ec8117ad8ea7b909", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967341, "uuid": "a2fa7ff0-09e9-4107-a517-9fb935c7371f", "comment": "Malware payload (RaccoonStealer)", "value": "be4c0e3a5025c1cb1a5a4c17321a8412f2599ea5fa6c942c2339479e74a336af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967341, "uuid": "2cb0ad5a-edca-4df4-b1bb-803a4147da61", "comment": "Malware payload (RaccoonStealer)", "value": "9fb2745944a6a323196e76063d030ce40979a404", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967341, "uuid": "53ef6fc1-4b34-43e5-be6b-fc06b4632ffb", "comment": "Malware payload (RaccoonStealer)", "value": "a9068a5174d145d06b9c7456f207fddacd06bc05724ab1e6a81235ac5fc4c1b134f7c09c23417a2bac2e9a302cba18de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967341, "uuid": "37614f60-0709-485d-8b3c-16fbb8d67f41", "value": "T1C394021572A3D432D9E35974487BC6B11B7BB863213C514F33A13B2F7F60A808A5A76E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967341, "uuid": "c6e4c7ef-a769-4d66-96e6-e392520ccc0e", "value": "adc309f4258aa7e488ca350060834acf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967341, "uuid": "b1a031aa-a412-480c-a98f-37b911a15aae", "value": "6144:eOIJUZoK2geI8BwbXs/V1zbUuXD2HAkZCGeX9OeNxZAsMIOeu0lx7rjySZC:e7yZP2ggei1fUw2HdZefxWvx0l1jFZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635967341, "uuid": "e69e3ca8-b786-442c-97a9-5ebc65cbe777", "value": 434176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635967341, "uuid": "e659c3bd-47c0-4a54-bd44-3f7864bff5c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967341, "uuid": "a885388b-65eb-46b5-b2a1-deeff189785b", "value": "b716ef0649230524ec8117ad8ea7b909.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "672ecbc1-3cf6-11ec-843c-42010a9c0014", "comment": "Malware payload (DCRat)", "timestamp": 1635978953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635978953, "uuid": "8022d777-e265-4dad-b0bf-f5560e90afb3", "comment": "Malware payload (DCRat)", "value": "191f7b31782f54fc168021567d37bd79", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635978953, "uuid": "36fc0a97-a3f6-4984-8bd8-f2022d242a56", "comment": "Malware payload (DCRat)", "value": "be6225038e906a59c3227124efa99b08d38ac9d0786501763fe4a7d2649b4846", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635978953, "uuid": "7f6e0df3-948c-4b24-8725-e187ce625c30", "comment": "Malware payload (DCRat)", "value": "76ab2e123e8cff48aadeb0ffc8493fe662d60566", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635978953, "uuid": "7ed716cd-07f9-4013-8fb4-da10b5bd4a68", "comment": "Malware payload (DCRat)", "value": "a3dbddfb4f2b17977d857f9200a900031ae2d8e8633b12f5947619ca01fc75f60b2403e66da8c68eadb03355c5eea33b", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635978953, "uuid": "c503f659-e140-45e1-9239-01bb3447d716", "value": "T1AC1528127A44CE42E629163BC5EF405447ACBD417A62DF1A7EAF339E21113A76E0E1CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635978953, "uuid": "01a03511-f414-4145-bd29-cdcc59136da9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635978953, "uuid": "ada9b549-4e27-4254-ab29-d782199c04b7", "value": "12288:uJ+pmTtOe3l7G6x5FYRZWfB0hc3iYX46nGOOKGWaCy0qn4:u4pykeV7XFqZWfBZ3zX4eGOOR0+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635978953, "uuid": "c787608b-370b-40d2-93ba-f964dcb45eb0", "value": 933888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635978953, "uuid": "448ad137-60ba-44d3-9373-58e0cbcdf634", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635978953, "uuid": "8950d7fe-5878-4902-a852-e82a958909b0", "value": "191f7b31782f54fc168021567d37bd79.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02b8e226-3ca0-11ec-843c-42010a9c0014", "comment": "Malware payload (Kimsuky)", "timestamp": 1635941847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941847, "uuid": "0a3f4d5a-ea96-4c30-8f74-1ca16175dec3", "comment": "Malware payload (Kimsuky)", "value": "83362853e86ca7463236bba0120253dd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941847, "uuid": "7ae9ce7b-7b64-4ee5-8b78-82b78e28e92e", "comment": "Malware payload (Kimsuky)", "value": "be6c7eded8829cafd84477cc1f3f0f566dac7748213005defe367c838687e666", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941847, "uuid": "b2342ced-19a6-49e4-ad0e-bfa648f005bb", "comment": "Malware payload (Kimsuky)", "value": "c25fc2ee786a48392781611b459eb8d611b5b397", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941847, "uuid": "3cd196bb-78f0-4776-9fe7-e5a22aa5f391", "comment": "Malware payload (Kimsuky)", "value": "79504896fd6cab606502bdaab58591c43cb0bdaa3b8840b588fd395a00d3d973e7d52d911d5399a4efed4fc4dc60f3ef", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941847, "uuid": "ef234d6a-f2f1-4b8a-822c-72b4dfb418e5", "value": "T1F9B53C61B504B6CFE89E27B885ABCE86591D47F927204D43A86CB4BF7D73CC12947C28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941847, "uuid": "1b4e09f6-d249-47ec-bbd2-f76e7b33b223", "value": "1729905d2ca859735a5ca7f8669c4a39", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941847, "uuid": "a5496cd5-ab01-416b-9c64-162f77d4ba01", "value": "49152:coiso0JLjMGExY+0nCn8VQyNxuCcJa9eu:cKBoGEujnCn8VQyNxuNJa9eu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635941847, "uuid": "f5524ef6-8d5d-432c-84c8-d60e3c2e6933", "value": 2335591, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635941847, "uuid": "84468ee8-a3ee-4030-8f86-3ec2a8b70baf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941847, "uuid": "f48b1d0a-4163-401d-8e73-1bca286c1a2c", "value": "be6c7eded8829cafd84477cc1f3f0f566dac7748213005defe367c838687e666", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb4b993f-3c4b-11ec-843c-42010a9c0014", "comment": "Malware payload (AZORult)", "timestamp": 1635905730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905730, "uuid": "4d7c3856-4dee-425c-932a-17b62d2cea13", "comment": "Malware payload (AZORult)", "value": "752d7b0aa11f0ac5697be55fd28cece5", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905730, "uuid": "e1138e08-c18e-4bd6-885b-cacfcede19f0", "comment": "Malware payload (AZORult)", "value": "be94cee55a56c0572ca5b0812f0fed5d73a3efa33cf2b27cb4ecfe27f1b26a8c", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905730, "uuid": "5c7bc6d5-e750-41cb-9d70-2d03405ae285", "comment": "Malware payload (AZORult)", "value": "1aeacce96e338a949b95b21bb7b095811d2f9c01", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905730, "uuid": "00667fe6-837b-466e-887d-2a5a846d6d79", "comment": "Malware payload (AZORult)", "value": "97f392a1cd4ac95136a8f076ec2f3776d0cc298c5b6e5b0da986099aa543161ec1012b3bc7560b88bf7f8a5e68ea3a77", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905730, "uuid": "3a12880a-dfd1-4b63-af77-45fb6cdbedea", "value": "T1BAB3197AF6C19272E02808BDCD46D1B6912D76302D3918B6B2DA4F8CD5F95C26E2C3C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905730, "uuid": "3ca7fe78-a04c-457e-9d36-4fc8bfc0eae2", "value": "6d1f2b41411eacafcf447fc002d8cb00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905730, "uuid": "27fc6148-ca78-48bf-b965-c7054b588e06", "value": "3072:tuOSXpMx7ZAlHsbfUkolNGti7lfqeSxM3SpyEY3E/Oxg/:Zzx7ZApszolIo7lf/ipT/O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635905730, "uuid": "4acb7b9a-3e66-404c-a243-7003ef35b36b", "value": 115200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635905730, "uuid": "c3e8faf8-566c-41f1-8a78-a11069be7a38", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905730, "uuid": "22faf67f-2147-4b37-b0ef-443477e77871", "value": "jun.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "447e07b0-3ca1-11ec-843c-42010a9c0014", "comment": "Malware payload (Kimsuky)", "timestamp": 1635942387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942387, "uuid": "48864e15-0001-49c7-9eeb-36e82621dbbf", "comment": "Malware payload (Kimsuky)", "value": "36ed014a2bb6fcb33753f0020721910d", "object_relation": "md5", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942387, "uuid": "3dab7ddf-3602-4734-9c2b-cae87a9210be", "comment": "Malware payload (Kimsuky)", "value": "bea792a9bfaa41d2769ba51b91e367090ea2eb0f5ca68e0ee33000cd1d1819cb", "object_relation": "sha256", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942387, "uuid": "0d267fe6-6443-49c8-b586-efd8c8b2ea56", "comment": "Malware payload (Kimsuky)", "value": "6914f5da0f244b0e2a0f6271f823637d0c9fe731", "object_relation": "sha1", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942387, "uuid": "c9427a63-ec69-4008-a670-6cbba3d0fd82", "comment": "Malware payload (Kimsuky)", "value": "a8a891b074ded808a489735855fe6c8ae3941e249260c981f3a29fa4e1598bac3ff4f2f20b92db5b6dfe34dca18b989f", "object_relation": "sha3-384", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942387, "uuid": "529fb2f3-1d98-45e3-b065-7b70a7dc2d94", "value": "T105C1A65A999662B904F773F3DAEF080A8EF08D0460AAA1409FD5C8545DD3D3FA3F18B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942387, "uuid": "076702fc-1053-4d86-963b-4e10143e440b", "value": "96:V0JarlkVGAl3lzgfqC2bDBAEqdeRP1on8mRZ5eWcm6V7Cmcs+rack1HeygKm+Wzu:V0Jar+oa3lgTEDKioZ83bNRp9ck9aKmq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635942387, "uuid": "65833db3-957f-4917-aea9-e06236f567d0", "value": 5774, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635942387, "uuid": "386ced51-be21-4801-8929-dccbd3d6e2ff", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942387, "uuid": "ac790867-f861-4074-9f54-8f5ff225a633", "value": "bea792a9bfaa41d2769ba51b91e367090ea2eb0f5ca68e0ee33000cd1d1819cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ae184e6-3c84-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1635930077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635930077, "uuid": "51c63c7b-fbb2-48e6-a551-e3c1de355fd1", "comment": "Malware payload (SnakeKeylogger)", "value": "e62950e0764dcfb1d2b99bb22c61e553", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635930077, "uuid": "1183515a-5aaa-43c5-b893-9ee417fffe78", "comment": "Malware payload (SnakeKeylogger)", "value": "bfc1ffe9efc6f02242aabd4028a79a89c2e317a254374ada5920565bde3eb796", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635930077, "uuid": "ec91b76c-2ffe-4542-83ad-2a9b61ae7dd0", "comment": "Malware payload (SnakeKeylogger)", "value": "d286d53add63e1cccfbbcadb24becef52273b77b", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635930077, "uuid": "9622100e-cef1-4258-a7ff-6c1b27f3a060", "comment": "Malware payload (SnakeKeylogger)", "value": "c024ad7f340e7fbd04b731906ac318dbbad33c5e88276941dc5886c4b349383068f18715aba06728cc4555cc3dd46f86", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635930077, "uuid": "f25773d4-c9b6-4664-95f2-9144d571b820", "value": "T14541AE2117F5031CE3724A3DECB7A310E6B27C52EA66CF6D0250919468AD315F9B5F2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635930077, "uuid": "b196d1ed-cdc7-4b00-b8bd-ec6a671e3420", "value": "24:8WeWOJXqnC+pKMWOQAtWC+/CWBYRtKeKrefk4o0aYrabVIJ0wm:8WWJaKIPt2rgoOraR20w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635930077, "uuid": "af55f18f-1980-47d7-b52f-557390b1fce9", "value": 2323, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635930077, "uuid": "055bfc4f-7016-4a96-9fdd-42ef969f0055", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635930077, "uuid": "2afb4ca8-829c-48ed-b882-d5e9c2b47143", "value": "001.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b852b967-3c40-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1635900920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635900920, "uuid": "b60659a8-a958-4b38-a93c-0aa66549a4ed", "comment": "Malware payload (Quakbot)", "value": "95af3df17817e307678bd7d1c6d8580c", "object_relation": "md5", "Tag": [ { "name": "clinton41", "colour": "#6523C2", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635900920, "uuid": "9623c5ea-b7d5-4c37-9329-af03911d32ce", "comment": "Malware payload (Quakbot)", "value": "c0168eaf2e409a8d1a968e388d665b213b1f7ae232c24df90ab8731b5fd1cbbd", "object_relation": "sha256", "Tag": [ { "name": "clinton41", "colour": "#6523C2", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635900920, "uuid": "f60aeaad-2537-42de-8d8a-0d9b51073eab", "comment": "Malware payload (Quakbot)", "value": "048aab3d2d8a4610d904cc28058caa15e776a427", "object_relation": "sha1", "Tag": [ { "name": "clinton41", "colour": "#6523C2", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635900920, "uuid": "7ca7dcb5-3c01-47f4-931f-e51c4512792c", "comment": "Malware payload (Quakbot)", "value": "dab8906d1e687c5177c8409cb3dcbcbc4d4271313f61b2b635b7434fb2527c58583107bc07f4c7dcfc32aee31cb81f27", "object_relation": "sha3-384", "Tag": [ { "name": "clinton41", "colour": "#6523C2", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635900920, "uuid": "85fcbeca-97f2-4b81-9899-398bbaa91b2b", "value": "T180C4025671D8CBABE58617389CD6CACA7722FC20DF678603314A731E5D3ABA09D03716", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635900920, "uuid": "e6d5e3d1-4668-41b6-a784-912359cfa4aa", "value": "12288:MSJ/U8SUbfnInMMRHKoUEu/xFz1UsjOxKJRQgiFuSVLDDOF:zJcQP0mEuTzLjOuhiFuyDDOF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635900920, "uuid": "43c68c5e-b0ba-47c8-8e2e-1c85bae826f5", "value": 595968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635900920, "uuid": "adc88bc1-21e4-44d1-b0d0-c82539a51fdf", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635900920, "uuid": "708d6e6f-e691-4afe-9cef-a295fe3ee540", "value": "form_816627441_11012021.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29a28ab9-3c84-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635929887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635929887, "uuid": "1ce6af43-6894-4a76-9a76-1f561b61a7df", "comment": "Malware payload (AgentTesla)", "value": "6e48898044c8478f1368a9bc0e021cca", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635929887, "uuid": "d18eaef9-0d95-41d2-b635-688b88510d8e", "comment": "Malware payload (AgentTesla)", "value": "c0f5c3952317a8df9410594160afca64402c33ee323a8cbc396c338ff3fbe43e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635929887, "uuid": "99cd01c0-8a8c-4cca-861c-cfb93e140419", "comment": "Malware payload (AgentTesla)", "value": "82d515a2e82c8934e0185f97ed9a18a5ef70c2f5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635929887, "uuid": "c83fc199-e8d5-45fb-b0d7-4cff7f5c90ef", "comment": "Malware payload (AgentTesla)", "value": "acb8140286c5ce750746a1dde17935098a1106ecc5d2326f987ab0282feb152932fbb1f7a632bff9ff3780adfb7ccee6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635929887, "uuid": "5be55e19-59ad-46ac-82f5-963bb35429d5", "value": "T130B4F01671AC9B45C36DB7B660A69310BBB97E3B1442E60E2DCA71CE0A373128F35D47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635929887, "uuid": "b13ab1bb-a49d-4b02-8f35-57faa7a024b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635929887, "uuid": "1786078f-e928-44fa-9990-244b5f8aab6f", "value": "12288:iOuIbw8eGSkW+ja+QOoVXY9dtttg8dK3iEO/MOvEZqMD1:Pxbw8eGSX+jEO8XkgFiEFOCD1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635929887, "uuid": "b32eb1b8-4296-4182-8b34-c30977abd256", "value": 497664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635929887, "uuid": "e5d0d185-b81b-462c-a8b0-a3f1383e7ca8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635929887, "uuid": "8e6f6b4c-8a97-4ea2-8738-9fc647fd339e", "value": "Original Shipping Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33bad1bc-3c71-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635921743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635921743, "uuid": "7444d7cb-dfb5-42cb-9e27-40cca8b3dc7f", "comment": "Malware payload (AgentTesla)", "value": "fd825d2a9c562d5dbdc5f9fb8d37ee88", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635921743, "uuid": "f10fd520-84e1-4608-8411-5d33f634d709", "comment": "Malware payload (AgentTesla)", "value": "c0fb591365b92ba8d02b59a2a11a83f566aa51a889fc553fb69d1664c4de62f8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635921743, "uuid": "2f548458-62f6-4907-8a23-4a24669e11c2", "comment": "Malware payload (AgentTesla)", "value": "1744f23eee405771d90ca18c4baa6aee9df0edc2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635921743, "uuid": "b6cdb885-5423-48b4-acb4-189ec509f70b", "comment": "Malware payload (AgentTesla)", "value": "ca8c7bfb01d3bcd8e86a225e0efb8e157ad74618c4703fbc428c942a12b420aa95a062614e3456154bf44be77a247ea3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635921743, "uuid": "99ceb40b-4882-471c-81e4-835ac8283e00", "value": "T1B3055920F35D49C9CAFC7734CF25D1B107A56C6E2A108A1924F43DFBBABC61356316AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635921743, "uuid": "a8fda0e2-0cf4-4ff8-9e74-28b1c728c7b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635921743, "uuid": "92890687-12a9-4677-9e5d-dd8f3b84b431", "value": "12288:2Y80F5Uyqixv/FGESW6oXo6D39+1JyuF7EzqZkJtLTex0:L80fUyT/F1htD39+1JyuNNZkHSx0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635921743, "uuid": "1df21a4e-c3fb-42c8-b89d-1d1a473818ed", "value": 857600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635921743, "uuid": "7e5f4a28-cfdf-4c71-b3cc-9f703286fdb6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635921743, "uuid": "ebac94b8-8d39-45ea-a589-5e385e4e41a1", "value": "OPL84ARDV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37e227cc-3cd7-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635965559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635965559, "uuid": "66926ed0-a334-4d8b-8097-06bbf19c6a0b", "comment": "Malware payload (AgentTesla)", "value": "18178f4f026059e57a8248faa74c5203", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635965559, "uuid": "28761784-d02c-4559-aa58-4db0e848c35f", "comment": "Malware payload (AgentTesla)", "value": "c102452e705004bca1df96093c5a860a063df9a3aa466a04d681b2c9c1872488", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635965559, "uuid": "52c880d2-a006-4534-b2b8-a27b35bf39bc", "comment": "Malware payload (AgentTesla)", "value": "03140adf9f384cff56f2eacecd82f8157a5b5ba6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635965559, "uuid": "ae49223a-6250-4ced-ab2f-c0ef3166999d", "comment": "Malware payload (AgentTesla)", "value": "1af5994322a0c8225922c1478bce5f6e4d72bdc7b81b778e7bcdcf3997b10b9ff17e750f56a2214b07411f3dce6b4c59", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635965559, "uuid": "d8466b88-41bf-4791-9089-afa62c180425", "value": "T19E054720B75D8989CAFC3734CF25D1B113616C6E2610CA1924F43DFBFABC6135631AAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635965559, "uuid": "506f48c1-b706-473f-8771-7889640c8347", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635965559, "uuid": "6b36619e-375a-4f5d-9170-6b19e7d633c6", "value": "12288:piNXHyO3JbRwUg3gLpSpLH/QM3Ng0/hE1qJJLTQV0:cND5KWLpSpLH/QgNE1qXUV0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635965559, "uuid": "3ecaa948-1468-4cd1-8de4-04b93c6e352e", "value": 856576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635965559, "uuid": "27375426-7264-4f0c-b803-9d9164c7a43f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635965559, "uuid": "87ca394d-e0c1-41d2-904a-e058d086506c", "value": "Shipment Invoice BL-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7ebfa6f-3ca6-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635944702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635944702, "uuid": "228f8667-e21b-4052-8e59-99e77c045fc6", "comment": "Malware payload (Loki)", "value": "ee150cb4cfc81fe4c6ca971553839775", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635944702, "uuid": "76f44dfc-5477-423e-85d5-f9be18b0da64", "comment": "Malware payload (Loki)", "value": "c10da7caa9351f34bb277a3e497904079c32fe1338ffa5c43faff0d12800d5a7", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635944702, "uuid": "73ac3d32-86f5-4404-b29f-e1fb00357246", "comment": "Malware payload (Loki)", "value": "11fca0a6c15e1e42feccde36074bc29269b626ae", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635944702, "uuid": "3b43ef37-14e2-4dfd-bc5b-22469e17fee7", "comment": "Malware payload (Loki)", "value": "7e499767c1498075a38db0a0a9d31bde60b0d23dbd7b2b1919f3b70e32ffcd8ce1cffb882d097bbd1553f7e2a9e9317e", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635944702, "uuid": "46691abb-1a22-4838-a1f0-c7162ccf83c3", "value": "T15B6423B136D3F2D3DEEDD12170531C9E9E008A1BCAB4DADBC98C81BA17295506F185DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635944702, "uuid": "bb9a4afe-555a-4398-b306-cfcb5356eeec", "value": "6144:e7UBpqTg/Yn9fea6KVPCKUDY3sJgkjBQ3biwgebBsnvYwjin:eQBpMgAn9ZJgnMcJFimwRbtwun", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635944702, "uuid": "c9e5a875-4d2b-4ebc-a014-9b535c70670b", "value": 315625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635944702, "uuid": "00fd1709-b02d-40fd-9b1a-c12de146c7ca", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635944702, "uuid": "9eda8528-37b8-40ea-8442-03f65f132c5b", "value": "NEW ORDER INQUIRY_B9020289.pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c6caf58-3cd9-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1635966345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966345, "uuid": "472e8784-d2fd-41e7-b425-640927a228a2", "comment": "Malware payload (SnakeKeylogger)", "value": "3d233a8f5ccd3d81493680e1d7f3db51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966345, "uuid": "3cd9ad84-554f-4edb-b225-a228f644c605", "comment": "Malware payload (SnakeKeylogger)", "value": "c22239d4c717803191cc6dd4d415cc7760a90a741b3a737c0644f8f381dfc287", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966345, "uuid": "99d5309b-8861-4899-a4a2-583d9465d749", "comment": "Malware payload (SnakeKeylogger)", "value": "1c9028993b03b5bb5be78fffe8f0f81c7d1819c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966345, "uuid": "8aa68247-cfd5-48c9-8fca-3defca49529e", "comment": "Malware payload (SnakeKeylogger)", "value": "1edd8cb1774ff14075dee6184a73d72554cfefd52bfd4817a9b582d7cf2dfd4e546c8aa9ae1986caf4d8de09577703fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966345, "uuid": "b80c29cd-9b11-42ad-9537-54591d213224", "value": "T167F43730B75D49C9CAFC3734CF25D1B117A16C2A2A10CA1924F43DFBBABC6175631AA9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966345, "uuid": "5588a8fb-8b15-49c0-a822-549315dc96bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966345, "uuid": "3873240c-e875-4840-a09a-7a3f019b4323", "value": "12288:G3OvdFNgUpjBcBXeI2NCGwQM4A1dyuF7EzqZJJILT2A0:sedj2XefOv4A1dyuNNZJOqA0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635966345, "uuid": "7b872f8f-995e-43f2-9541-024ee24f0fe2", "value": 774144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635966345, "uuid": "fe9b3a3a-5c5a-4641-a5e3-eb8b168e5df4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966345, "uuid": "a27ef59c-f740-48f0-84f6-0a8a46b783e7", "value": "vkbiACFVWZTLoEw.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55b6b68f-3c95-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635937262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635937262, "uuid": "65b5631e-a6d6-45bd-8889-b379dc833176", "comment": "Malware payload", "value": "7b2b320ffb84e8c070dfa08f702e9dab", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635937262, "uuid": "d52a02b3-4052-4248-a099-79b0429cd404", "comment": "Malware payload", "value": "c290a4f5c63d2155e67d025833838b7483e993c703a8489fda12142bdb900876", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635937262, "uuid": "447829b4-1bcf-4c33-aba4-92489df5e431", "comment": "Malware payload", "value": "2a5d5a0d2123f828aba19ae2d4d1872b34547858", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635937262, "uuid": "ef208606-606f-402f-8022-7b2182032270", "comment": "Malware payload", "value": "2943c1757eb05895880fafdabece58536df887377c587c15e4533069fa981b459756fdc5195218dd540c5e901e7c7adc", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635937262, "uuid": "074009f2-3ff8-4df2-a755-a7662284d000", "value": "T10033F2DF6B15EDDFBEFE8B691D95B241C7E1D32A6A4CE8427807D9072C50B080827B20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635937262, "uuid": "04f30be5-7965-4607-ac56-e3eada1743f5", "value": "1536:D/rkTuU8Hl3T5f9QbLpK9tXKt+tNfix16:/68R5Fywj66", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635937262, "uuid": "2c162f7c-54bd-470e-b376-40a2360ce5aa", "value": 50242, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635937262, "uuid": "b5f1f10d-026d-4d74-bd17-e23b87ec3760", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635937262, "uuid": "bfab85af-3b7e-4ac6-94fe-c550764e67d3", "value": "occaecatisit-2836313.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e898fa22-3cb5-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635951253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635951253, "uuid": "c87cdb28-c1da-4fc9-a9b0-adbf41b53f2a", "comment": "Malware payload (Formbook)", "value": "82d27a0d61e6aee6c95873ac4f60243f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635951253, "uuid": "bb659a87-0657-48be-b70c-8f0fe53669e7", "comment": "Malware payload (Formbook)", "value": "c2b764447c91d5ed64795ddf618838ab153fc4261ec497ea370647fcedf5e229", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635951253, "uuid": "48c23a55-1ad3-43ba-9574-f551f7457c5a", "comment": "Malware payload (Formbook)", "value": "f9b182500949290a920faeb5f6e8aca533b0dc9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635951253, "uuid": "fe5d46e8-b678-45ee-9da9-6f134452fddf", "comment": "Malware payload (Formbook)", "value": "2e3b666c1ac892fdbd9acf4745485e8b8994cf8d98389c3cfb82acaad5590c23b72d491bdb9198ee77444d3c06a533f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635951253, "uuid": "bada4950-4f11-4019-a879-b3aaaae50527", "value": "T1E954122ABAD0CCDBE54787B01F75B272F7B6810026490887475D2FF3EB3199A4D1A5A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635951253, "uuid": "022809d8-ed15-4dc9-ac1c-cca946fcae7b", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635951253, "uuid": "3095f340-e2b2-4c64-aec3-fcaaa6f9578b", "value": "6144:F8LxBsvRaxVgQMr+0g2lxDYs2zaT1wHHmBiao1Bur9XzlHIrTkXSQ7bxg:/AVgnrFBlxDjjCngkGlATkXSQ7bxg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635951253, "uuid": "99c19222-fd0e-4e38-b215-e95186ff3dd4", "value": 298583, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635951253, "uuid": "ac20443f-3851-435f-8d7a-83f1ad5edd90", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635951253, "uuid": "41270e51-fd15-482b-aa9c-aa1a3c38d901", "value": "sssss0912.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f98bae5-3c9e-11ec-843c-42010a9c0014", "comment": "Malware payload (Kimsuky)", "timestamp": 1635941091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941091, "uuid": "fe3880d5-ddef-4f3e-bbcd-0f9b95a24d75", "comment": "Malware payload (Kimsuky)", "value": "6844589e2962b3914824cc8b90a552a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941091, "uuid": "32178f3c-5231-4ec5-b1c4-d8a1795197bd", "comment": "Malware payload (Kimsuky)", "value": "c30999d579cc8b49eab869b77256ee897e3166cb9bae7b082a017a204ae233d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941091, "uuid": "befc48ef-f246-40b0-b0f0-9b96a9a9e102", "comment": "Malware payload (Kimsuky)", "value": "f6f994e4ca53dd54f90153647cc11c63384e48af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941091, "uuid": "b9ebc09a-3a04-4daa-acbb-fcc31093c67f", "comment": "Malware payload (Kimsuky)", "value": "2cf78a4a5c5a584ffdedc795f6ad1267df344c4407e6d4ba2113abee3537cf588e96620cc3c8c4d0185a753b9e38708b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941091, "uuid": "23995bda-4186-4f0d-b731-104d2a0623ab", "value": "T17EE55C56A7A801A9D8FBC27CC5574607D7B2B81693709BDF06A14A7A0F73BD12B3E700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941091, "uuid": "70afc815-730b-4af0-8027-7bf0cac96d06", "value": "ca15bd62f0fd772b1ecf064f3a587596", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941091, "uuid": "ad6d42eb-303c-4b19-beb5-e2c3db6cfd79", "value": "49152:49mMX/wylBNaccIiU2tz66Y8Oh5PiPeiMSSBsOmuzwsbPoIk:cP6S6HsSSBsZJsEI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635941091, "uuid": "6c209c2d-e567-4dca-9072-e6900d60ba9e", "value": 3310080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635941091, "uuid": "7445e313-3932-4842-953e-66b36e5f1e0c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941091, "uuid": "54a2bb63-708f-4cf4-9f5b-2c88447517f8", "value": "c30999d579cc8b49eab869b77256ee897e3166cb9bae7b082a017a204ae233d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab465357-3caf-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635948573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635948573, "uuid": "f4315014-3145-40e1-b0cb-f92ffb76449e", "comment": "Malware payload (Loki)", "value": "2aac0dbb82ed7e287b05f3828f1b6d0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635948573, "uuid": "deb2d863-5dae-4b0b-acb5-8a11865f4c3e", "comment": "Malware payload (Loki)", "value": "c30ff39fc0c7426ec53a0f1db2a7e18c492c830d8c03707fe2a07941e8d36281", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635948573, "uuid": "db266dca-820b-410d-ba42-569f59c52579", "comment": "Malware payload (Loki)", "value": "4885bdf967516339cbf2dd656d53a76ee02b1ba6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635948573, "uuid": "f059ebca-e936-4179-b22a-35e3a19088b2", "comment": "Malware payload (Loki)", "value": "6687e6983fe61b2ae36d5d8d481e86bffd0210d4119796738584b0a2d186f234ceff39376d34964cbfaa46b71f96ec6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635948573, "uuid": "f0dbcd6a-0be4-461a-aeb5-f00ad67cf02e", "value": "T124F42720B35D89C9C6FC3734CF25D1B017A16C6E2A10CA1924F43DFBBABD65366316A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635948573, "uuid": "a49101f0-3c6f-47b5-a5dc-9bcdae7791d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635948573, "uuid": "21413788-f542-47e5-af42-2917d5e1c78a", "value": "12288:rMF0Ls7PoFN2paodOLoJedO9Hd1iyuF7EzqZyJjLTGg0:wFq86NLiOLond1iyuNNZyl6g0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635948573, "uuid": "21d6170b-b4c0-4a7f-b391-d07cb206c471", "value": 733696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635948573, "uuid": "db4f3016-581e-49c4-9ef4-550de19e1296", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635948573, "uuid": "7ce6b642-70b1-45fb-8f4e-a99d185cfb1e", "value": "QR17-3333-2020-014.pd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8d7282d-3c9b-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635939979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635939979, "uuid": "61f413a0-3391-4dfc-8575-6eb5bd4295df", "comment": "Malware payload (Formbook)", "value": "959524af629633e44c9b23c4fca8249d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635939979, "uuid": "10b65a4a-149e-4b10-8a79-6478c1fb8ebd", "comment": "Malware payload (Formbook)", "value": "c324531fe09c199f13c4eea4b2f2bb1c3a6d42da8c6abe87227de1d9ae46858b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635939979, "uuid": "06b77da5-f4cb-49ed-b0be-09ee31e8f10c", "comment": "Malware payload (Formbook)", "value": "d3d7f0bfb6a04e687b4fb026bd2038b190bdb1ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635939979, "uuid": "6d829aa3-7bc9-4ff9-a0ee-893bc3776848", "comment": "Malware payload (Formbook)", "value": "3b83e31b1d7279c8acb27ee2169c5825f7eb1d51af9fd9cfbd363c051065c077947519877e4b3a7519073decc3cda1e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635939979, "uuid": "4efd07e5-63f9-4d7c-b662-692d57861a87", "value": "T12A64E0D13DC286A6CDD6F5F1807F9733A27A4F50489B4743A25DB98B0A24387A25F1CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635939979, "uuid": "4143a086-18a7-4594-9f74-4d102a988a50", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635939979, "uuid": "8c6ea3cd-34cc-4028-8d77-261ec6188de6", "value": "6144:U8LxBGJVBVqI7q1k2M04NDZKpv/J/azzrKVtjLRsvfCelMEOrL:KJVvNjr04N9y/Mr+LmvfCelR+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635939979, "uuid": "e6b56b3a-18ac-427b-896a-85cfde82bba6", "value": 332111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635939979, "uuid": "ca10c1ac-9820-42b0-84ef-adb40ed9513c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635939979, "uuid": "a0b2f6af-27fa-4b46-acd3-72d062917706", "value": "shipping Docs.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b500fe3-3ca0-11ec-843c-42010a9c0014", "comment": "Malware payload (Kimsuky)", "timestamp": 1635941916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941916, "uuid": "c24b11fe-e37d-4c56-b150-cf117268c29d", "comment": "Malware payload (Kimsuky)", "value": "18e8c7bf80de9fec1a78d584139c774e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941916, "uuid": "390e4b26-1f55-425a-b13b-16a09507900a", "comment": "Malware payload (Kimsuky)", "value": "c43475601f330a5a17a50f075696e058429656db54cdfcbdccb0fb93446f6ac9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941916, "uuid": "5ab783eb-dc7d-4a51-9fb8-2cddfe29591b", "comment": "Malware payload (Kimsuky)", "value": "9931bacfe5722c87062757d122d9802981c824b1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941916, "uuid": "42ab19cb-b766-4d57-a47b-7ae27e4ac518", "comment": "Malware payload (Kimsuky)", "value": "a7796ead36b052e97c9146985cb23daeb659ebadc9ff86b832a678c5dc67ea3ea2b4bf5833e88acd3cd0b2e7021c8b5b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941916, "uuid": "484b99af-a554-4495-af80-38add29836fb", "value": "T1F5F48D917644B1DFC4CE16BC942BCF03692D07BA93248D4BE9CC95BA7D37C816B4AD28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941916, "uuid": "0865157d-602c-4161-ba73-6370a75623e9", "value": "19ee6c20b8409399f012579b1cdfb6ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941916, "uuid": "c6ac5b33-429c-43c0-a51f-a287bc14cf68", "value": "12288:nAUunXdbn9CqErnxT/59bT6PpP2qJTm7FCPXk8NV2P8jshq5fnVt7T1bIZ:nGXdTLETP9bTER70ukEu8AhqhL7w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635941916, "uuid": "7d6a13fe-87c8-4d8b-baed-d39d5cdb7877", "value": 735095, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635941916, "uuid": "31032b49-726f-4bca-bb20-41c4193a9e8b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941916, "uuid": "7303268f-2eff-4e31-b798-dc0877247485", "value": "c43475601f330a5a17a50f075696e058429656db54cdfcbdccb0fb93446f6ac9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be4e6117-3cdc-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635967932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967932, "uuid": "530058a1-4713-43c0-afb5-b848258a3a22", "comment": "Malware payload", "value": "5fb060208eadc15d337de65293423747", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967932, "uuid": "7f37276e-6ea3-48e2-9ada-b5e4fbcb89c7", "comment": "Malware payload", "value": "c4a3016379b34840a053754aaec31a2b14db6a2557fd912dd9b762137d2056ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967932, "uuid": "8d012c93-5039-45f3-934a-f2da731b85cc", "comment": "Malware payload", "value": "ead96895b7684044f6bdeb4e267401ec8927a14e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967932, "uuid": "a6330912-aad4-43bc-8323-3fae46e0ba7e", "comment": "Malware payload", "value": "86fafe6ec5593d03f6abcef913054cf8e7ee8f4236e4e25b434c346eab918254628fe17474014c4b2e0b40fce17669fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967932, "uuid": "9546e825-fdf9-42e0-9bf6-463f28414787", "value": "T1D106336B86A3BE77D76F7B745A01A6639C367AA4D82C4400501F1D29BB3D401F6B83F8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967932, "uuid": "65f1f360-6b16-4519-8059-9b4d07feac0c", "value": "106f3d3e521ab0377bf478b03f3dd87b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967932, "uuid": "ffbb4d8e-f372-4da9-a2a4-f433f273d55a", "value": "98304:Y1KEZr4bKT6R/s9NKaygKDet/ywxeMVAp/rI47H19tObNap2z:0hZ6ts21DetnxFGpk4z3g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635967932, "uuid": "d18ed0d3-995a-41f6-9ef0-bd15a06bff95", "value": 3726848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635967932, "uuid": "fea09463-1d38-44f6-b5f0-99cc48860d13", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967932, "uuid": "eef2a3c7-c050-4967-8cec-0eb183c727d3", "value": "5fb060208eadc15d337de65293423747", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef5cb8ea-3c82-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635929360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635929360, "uuid": "8233a4d1-eb89-4c7d-bcea-49cd765b8686", "comment": "Malware payload (Loki)", "value": "f827b18c05c97d481d84bd6b159922a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635929360, "uuid": "acca2b9c-012d-4a54-b3e1-167fd9dce1c9", "comment": "Malware payload (Loki)", "value": "c535edfc3c3a0b7421903298329a5931db817c5d3cc395bbf257724b9060cb3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635929360, "uuid": "de0696da-de21-49c7-b025-e0370797e3e9", "comment": "Malware payload (Loki)", "value": "5a8f09d44d948b1b7547e78a0c4f8b6db82628cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635929360, "uuid": "9a373e87-2d70-494d-867b-ad2d2ba7b2ef", "comment": "Malware payload (Loki)", "value": "9f761c734e8a390265f7b37eff422c2bdba7beb80119f9f6d348d569eb90c4c444f1ee136986df6a3753e310e5f0cb1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635929360, "uuid": "4095e096-4ab9-4e28-b42f-cd61acf46f6c", "value": "T194548D00A6A1C035F0B256F889BAA379B53F7EA16B3451CF13E426ED5674AE1EC31347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635929360, "uuid": "0c4de870-3c05-405f-9617-0fd2823723fb", "value": "7e51d9833813c1a3fb57baba54855909", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635929360, "uuid": "68235347-a7eb-47f1-a374-d88b1404d2b1", "value": "6144:vjkTC8Dwmr4tDQmYLK4VZZEtN4QZzQIuUWbhcDD:v4+2ZEDAKgEtN4WQIuBbsD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635929360, "uuid": "ff7d59f0-4755-45e2-a864-c07c727f3b61", "value": 294912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635929360, "uuid": "0ee2a675-666a-45dd-a9ca-0a3d564b2a11", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635929360, "uuid": "42704fc2-5bce-4199-857a-a34cfe6cf7c5", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05e50859-3cd9-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1635966334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966334, "uuid": "769d3250-3740-4f90-a8d7-053c1dd1f9b9", "comment": "Malware payload (SnakeKeylogger)", "value": "d92fa8f37dd48c0f7546e29a770147eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966334, "uuid": "5937f562-98fd-4aa8-a485-6bd03effbdd8", "comment": "Malware payload (SnakeKeylogger)", "value": "c568f9c7beb77e6285320d99caf47f845d861814092da034ee799b169adeb77a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966334, "uuid": "36abc808-736d-4f22-99e4-2a6c34d9887b", "comment": "Malware payload (SnakeKeylogger)", "value": "5ec0eaa1cb99a44dec79662b83d64e787a8eaa96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966334, "uuid": "7e65c450-bb48-4149-a9eb-7bbb361e359e", "comment": "Malware payload (SnakeKeylogger)", "value": "f1536c21064555276c18b425be00eab9d6a4027044b04eed6b12586024ca4cc0a670853f7e94bd967691288e5d347c37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966334, "uuid": "8144a3f8-b9df-44a3-b290-35e5ca4139d2", "value": "T1FAF43720B75D49C8CAFC3734CF25D1B007A16C6E6A10CA5924F43DFBBABD65752306AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966334, "uuid": "3412ab91-cb7a-410f-9003-1b13937a7063", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966334, "uuid": "2cf703c8-0f75-4fda-882b-3abd2bdbbf23", "value": "12288:SAFyR171to8UpAo/HubfR31pyuF7EzqZpJoLTJg0:NIto8UioPu131pyuNNZpuNg0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635966334, "uuid": "9fcbe02b-bd0e-4b54-aa9b-c5bc969be268", "value": 752640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635966334, "uuid": "3a57f189-e10b-4ec8-8588-88034415da97", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966334, "uuid": "88d4df14-fd0f-49e9-b8de-9a45b8297eb0", "value": "PAYMENT CONFIRMATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "010e9394-3c63-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635915645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635915645, "uuid": "89e846c1-1814-4ded-85d7-f84076b4480c", "comment": "Malware payload (Formbook)", "value": "a26eed73501c6d63d9362bb01d98845a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635915645, "uuid": "e9b1e340-5d50-425e-88a6-09cf75e68613", "comment": "Malware payload (Formbook)", "value": "c658e84a4f3a6a029b4bdef61c40fb534f43a311d5ddb1810b97df0b08037561", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635915645, "uuid": "be85ce6e-2ac6-48dc-88af-d7a79d3559db", "comment": "Malware payload (Formbook)", "value": "a32ba6c1419daeac00c037c3411d2f5a69f1e477", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635915645, "uuid": "1a60c46c-6ac4-4f46-b8c7-3a5c474d528e", "comment": "Malware payload (Formbook)", "value": "660e36de2ee32d9daad26fff9ed2f3b233a231f45317ec1d5a4f95a094bef2a2803cd4b2653143802963f619f4e006c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635915645, "uuid": "d7cf6bfc-0bff-4367-aaec-c92bb4c065f3", "value": "T1B194DF263BA5D54FC9E48E397E6BC212EA7EDF1206F7060A27D43175C9B808D384717A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635915645, "uuid": "1bef38cb-1b1d-4cb5-984e-e041a1c38ecd", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635915645, "uuid": "b43e5dcf-d71e-45b5-bdc8-c3ece46eeeb4", "value": "6144:fBlL/dme9UkqenHj/M5InQ5OkhBYl0ibIWT4GLkvVYYGraUvjq:Zy3OHzM5WkhOllxelo3vjq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635915645, "uuid": "4780b458-0e80-4318-a64c-e15df6499ef5", "value": 423289, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635915645, "uuid": "b3555bb2-6117-45a2-9745-4e056237c1fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635915645, "uuid": "6f47b07a-f515-46bc-936d-ec61e0d11166", "value": "\uc81c\ud488 \uce74\ud0c8\ub85c\uadf823.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad31fc10-3cd9-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635966615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966615, "uuid": "7b6b7781-d200-4cb5-99bb-52068e96205d", "comment": "Malware payload (Loki)", "value": "e3046a7a8a083c674954c0e855bf93ed", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966615, "uuid": "a6bfcf4c-bb44-4ed5-8b75-a288059c8723", "comment": "Malware payload (Loki)", "value": "c6cfdd0c860632d52898b431286b996d5839c0d8f60af8f38fd32b02661bebfc", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966615, "uuid": "c24a6da7-ba8e-4dac-8f67-cdb343f35d8b", "comment": "Malware payload (Loki)", "value": "e86fcb06c7095796ce2a41fc1a5df5fb33a2b973", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966615, "uuid": "c1c3a438-7ab3-4c31-9f3b-1f57defb0f36", "comment": "Malware payload (Loki)", "value": "ec04e477cdfb7cb7010d20d8408b069e6a7507c38911445fa5e369ecfcc7620d9b14a7b0b6615220a2f40f1438a6442b", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966615, "uuid": "c79c2822-2594-421f-b43f-5eacb985a61d", "value": "T18B848EDCE9A189D4CBCEC5D9491D7B9920237A79CAC36C964438F3F50BD363F4A1A860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966615, "uuid": "8c6f5f0a-8170-4186-89d5-c5fc4064679d", "value": "6144:6WTEXBa0wzs8CPVLmPxr42ZUrOwtN6AyvZsGdUtRRUspAph/Al:6WUEo8CPApdMOwDoSG8Usoy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635966615, "uuid": "6e132dfc-ceb1-461d-8217-bc89f4306745", "value": 372699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635966615, "uuid": "8dc56805-1413-4506-a251-767856037c6d", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966615, "uuid": "38a5fe96-0a04-40e9-b46f-a49cdfdc7655", "value": "RFQ Products sample and photos.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "820e8686-3ca2-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635942920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942920, "uuid": "1277bd3d-5c4c-4d1d-a9c8-5c919309dbd3", "comment": "Malware payload", "value": "fbf4d7cb783064824ac5e4ba61a9f689", "object_relation": "md5", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx86", "colour": "#7C59EF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942920, "uuid": "f289b7f6-ec9b-4b3d-a4c9-669e0caa87f3", "comment": "Malware payload", "value": "c6ec5de32f48a01aaeba000bbc300539a6d388efb56f5365ebfae5d4f909b249", "object_relation": "sha256", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx86", "colour": "#7C59EF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942920, "uuid": "9ef5476c-bb33-45a5-94d4-96350ab136e6", "comment": "Malware payload", "value": "8d559ed975e6b9f2bf05458cc6e32f2e3a37cc52", "object_relation": "sha1", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx86", "colour": "#7C59EF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942920, "uuid": "13c2d989-c07e-499c-b744-6d3b59006614", "comment": "Malware payload", "value": "c999a345f0be048f555eaa18a47e6ce8817b5116d8f027ee5857a7d500a5c50d9916dd7b1fa89cec43e7d6e2523c850b", "object_relation": "sha3-384", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx86", "colour": "#7C59EF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942920, "uuid": "4ca9feaa-f8ab-41a1-8802-71bdc64fcc7e", "value": "T1555105E631A1B59E818747353F8867EB907FC114C9DA6800B98C9F69F4DDDA3258D7C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942920, "uuid": "773d01f1-2450-4a32-a5c0-051245ba60d7", "value": "48:mYR+MTHimb7uSCYUnwhfAseprsEIY6HhXb56dkHA3crn:vcGRX9tNXg7IYipFWkHScrn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635942920, "uuid": "fb9165b7-ba01-447b-9263-34ba229ec9fa", "value": 2863, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635942920, "uuid": "93536938-e062-40ad-a7b8-90f8a7c4323d", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942920, "uuid": "98f72a09-a5d7-4ec6-b47d-39f8effcaa50", "value": "XT5KtXgw.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12285b69-3ca0-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635941873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941873, "uuid": "0f48b707-7479-4da2-8fea-2136c2dc6381", "comment": "Malware payload (Loki)", "value": "32df72cc108cb5319b174c022462f47c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941873, "uuid": "28d62ed3-fa62-4ce6-8093-61ce16ddb3f5", "comment": "Malware payload (Loki)", "value": "c7148afa20fc791d7b85da154510c52dffd700939d1eacbfc1b439fbf80bd155", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941873, "uuid": "7e5d4992-0f20-4b19-a2b6-c3a316ff29a3", "comment": "Malware payload (Loki)", "value": "ff47f90cb14b0598bb5e5ca758320dd4bf7dea59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941873, "uuid": "8f4fc293-74e2-4ed2-a939-a60128976fe3", "comment": "Malware payload (Loki)", "value": "780f1583babfca8fe70ea1730d1c3cd2b19ef93d6b2fda5b88092d5697e8f57c51055899375875cc11ff897f5b69186c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941873, "uuid": "8a124162-361f-4395-bbd1-7de6796354f0", "value": "T132F42620B35D49C9C6FD3734CF25D1B007A16C6E2A10CA5924F43DFBBABC6535631AAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941873, "uuid": "2fe6d3bc-6444-4f5d-a6cd-cdc119d98fba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941873, "uuid": "b295cebc-1e0a-4d7f-8b88-b7effb09542e", "value": "6144:rM2E1gqUpZVYgsyqnptwpLZlTPMR3yu8+7EzqZ39aoqRIK7XQ+siT09Tr0:A1gBrep2d1myuF7EzqZSJDLTG30", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635941873, "uuid": "80ab2d25-c9ba-4b85-bc12-95c4bb39c8fe", "value": 728576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635941873, "uuid": "06c662ee-7a25-4ae6-85d8-38f0787fa7d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941873, "uuid": "1dfe9f55-08f2-4700-a413-d34feb4078ea", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ebe9753-3c6a-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635918863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635918863, "uuid": "d9b8eb4b-4fd6-4c10-acba-88bc3412fd98", "comment": "Malware payload (AgentTesla)", "value": "1fa4c035bf521c68147c7f9dda4f81b2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635918863, "uuid": "b1a8142f-832e-4db6-a87e-0429a780b4e7", "comment": "Malware payload (AgentTesla)", "value": "c7236c1ff5e18993e055f9486d3abb4395e36012e6bdcf5fc8a5ec47a030fb50", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635918863, "uuid": "c326e1a3-f3ad-4724-a1d4-f5a4dca5991f", "comment": "Malware payload (AgentTesla)", "value": "085e4c09ff8aaf84825f86f2a2ff356a5af8b5d0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635918863, "uuid": "405f7894-9921-40f0-8df9-0d2036c9a68f", "comment": "Malware payload (AgentTesla)", "value": "081c1d695dd8f0dce3f4118cf761400c2be7b68c72b9b40b3ec63fa100625977d4c19188e6f8d50276861c039a7ca17e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635918863, "uuid": "b8ca9d39-f0c5-4a8f-8bf6-62a55ff2b260", "value": "T17E45073534D8748DEA968E3044982C220D5DFC73BD8AF15A90D37C0DC47A49BAE6AE77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635918863, "uuid": "efb7db2e-2c65-40d1-95ec-c1454e47c3f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635918863, "uuid": "9596f45b-2a0f-47b2-a5c6-1f69e8970d54", "value": "12288:v2yOzgmk6Y9bRZ9bRoqJFTPEPy1kiAaVZtMjGLxQVdAIVQTYGIvZaqKBNUno1zL3:vfOzgmotDtoq4K1kiH/tDxQHAIi9zLH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635918863, "uuid": "58d9dc1c-f9ce-46d1-9d12-2c11cf9e80c0", "value": 1177600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635918863, "uuid": "6952c3d5-ba95-4133-9f28-78ff3f4d77e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635918863, "uuid": "fc09978a-ee53-4f11-8600-c6125e282ec8", "value": "MT103(sc)11.02.2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01f5bad1-3c4c-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635905768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905768, "uuid": "2381acf0-a7e6-4cb9-a239-1f1c7611adb0", "comment": "Malware payload (RaccoonStealer)", "value": "fb163840d87739077d49a969c59a957f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905768, "uuid": "aace6134-d9ae-4876-9458-7ef4d8ee5365", "comment": "Malware payload (RaccoonStealer)", "value": "c781199146a12c0ec7324ef13dbcf23d94dc80bcf92b17908023b429ddc3e6ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905768, "uuid": "0595d8d5-9b97-4eae-adc0-eb193ffe00b8", "comment": "Malware payload (RaccoonStealer)", "value": "8407f0d98f3d79b242f76f139c58b21fdcad799c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905768, "uuid": "0a11a558-1027-45b9-bb24-50ecf9f2fbb8", "comment": "Malware payload (RaccoonStealer)", "value": "02af6f091b776340af06b5601e8601475d844c1791c934b028e0dc26419c54a6aa2b02575ce141fc7547176b04a3b825", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905768, "uuid": "bae16c57-c6b5-44b5-88a1-317bd8c9d26b", "value": "T10DE3AE2572E2C431E5F725700978DBB11F7BBC721A34499F2B64273E4EB46C08A6A367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905768, "uuid": "a51cfbe4-fbcb-4f3d-b8f5-12a65c4e9992", "value": "adc309f4258aa7e488ca350060834acf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905768, "uuid": "eb49d4cd-a2b3-4b05-b678-30da619cde5a", "value": "3072:9KY26iHwAmKzLvawcHb7tiaXblPxEuwip1z/4:9a6yf/zLyB9tbxx9Hjz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635905768, "uuid": "ceee5416-9be8-4c99-b600-211d835b8145", "value": 147968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635905768, "uuid": "8b1e1b7c-2ae3-4050-9f10-c0c3a8554bfd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905768, "uuid": "32594356-f2ec-434e-be77-b67115b7b5fd", "value": "fb163840d87739077d49a969c59a957f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa20455e-3cd8-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1635966180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966180, "uuid": "06a750ae-b759-4b2b-bb89-90e50ffed4bd", "comment": "Malware payload (SnakeKeylogger)", "value": "1a0be1dd4745e67fdf94323f46789991", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966180, "uuid": "cf341b5e-303b-4f46-b031-1f7080318b17", "comment": "Malware payload (SnakeKeylogger)", "value": "c83148050b5ad9afb5f9c1f4cbcc2415320f448321accb658446d776e294d422", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966180, "uuid": "51e2521c-f7ee-43cc-941d-b79de639ec4b", "comment": "Malware payload (SnakeKeylogger)", "value": "aacc6f74f7f49412038a196f443926e0ef5c611e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966180, "uuid": "6eb86d79-d05a-414f-a3b1-38b6d69e7975", "comment": "Malware payload (SnakeKeylogger)", "value": "b3c2b594798836b8b68a9c328996495e73e0f0345c798ef57c8895c3d1f388d9efc2038b371b650161d87163cc0bf203", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966180, "uuid": "658c93ef-612a-48fa-9e99-a3b9efb18285", "value": "T1F9D3F71D3BF88C04E5FF8A331571912187B6F952195ACE1D0AC1F86A2ABDB908D16FD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966180, "uuid": "7810280e-aa67-4e5b-b695-0aa75bf6a163", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966180, "uuid": "a7c7cb18-d272-436d-aced-44cf1ecd61c9", "value": "1536:kr6sFY5eZUuzaZvjxsiEG3G7eJTTJwb/6y+MGPlpiOWBLYC7n0Kcl:kr68cfuzEvjxdHrTabCvXPfwBMgnbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635966180, "uuid": "b3fdf6c5-6f35-4298-9bdb-32a480e2d540", "value": 130560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635966180, "uuid": "f251a604-bc1f-4ca1-aeb6-c42d6c2c0d18", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966180, "uuid": "a917ac04-a5cf-4940-a1a4-d178e9b3a495", "value": "1a0be1dd4745e67fdf94323f46789991.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35d77abe-3c73-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635922606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635922606, "uuid": "4ff22e7d-a16b-4067-976f-19cd20a8803c", "comment": "Malware payload (AgentTesla)", "value": "51d4b8272261cb522c66a4316fc96415", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635922606, "uuid": "58e8795b-b102-4716-9278-a730357f31d8", "comment": "Malware payload (AgentTesla)", "value": "c85ee51977f100625c058f4491dcb2eaa7f5d5b4240a28163c3dc9d96c1bd54c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635922606, "uuid": "2c8c8ce0-00cd-4976-84cc-c32d4b022d01", "comment": "Malware payload (AgentTesla)", "value": "5839faa19aa09562f6f568cbfe8a62b1f0221ca7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635922606, "uuid": "ffe5869e-7362-4b78-b4f9-c68fef3383f8", "comment": "Malware payload (AgentTesla)", "value": "73a796c99a24344fbb2ef73612d57b3fdfe8d42acd1547e560e33e540150054360f2e4e7de7ae9527df56ee69924a288", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635922606, "uuid": "616443c6-4d5c-45d0-86bb-4f4369c28317", "value": "T1F0D423B6D8B7A6FD3007885E537814C966A2B0A3832008F87767744FC6167D7EEB0E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635922606, "uuid": "db4269fa-0043-4f8a-97ab-2d474887fed9", "value": "12288:wqwUrT59JGO1Vqhh3cG+25GTkn9NADf9yt8VDzMXVW:w0n59cOUh3V5ypDC2QlW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635922606, "uuid": "fb32a11a-5e21-49b7-89b3-37e1b906b555", "value": 608241, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635922606, "uuid": "56454748-2d5d-4bb2-b3e0-e25e9abacd1b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635922606, "uuid": "6715a73d-9723-41e6-8e38-9c000f53d5d5", "value": "Ship details....zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61827b5d-3cba-11ec-843c-42010a9c0014", "comment": "Malware payload (CoinMiner)", "timestamp": 1635953173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635953173, "uuid": "1bdf1e90-32e9-4266-9f37-1741f3e7a71c", "comment": "Malware payload (CoinMiner)", "value": "e8614769092b8925846c4956a6fed592", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635953173, "uuid": "4bde3e73-cfae-4a20-84e7-1738624afb7f", "comment": "Malware payload (CoinMiner)", "value": "c943ec636e634bc20a489811483496ec6ed051fd589af0aa1f4108626be6d0d8", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635953173, "uuid": "0d52a460-7492-4da1-861f-6420d3436a76", "comment": "Malware payload (CoinMiner)", "value": "3699cbf6260a7c040a29d279c3354a01e998559b", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635953173, "uuid": "652188c5-5219-43a9-9008-d49099211edf", "comment": "Malware payload (CoinMiner)", "value": "3c30671873df1b8f5e708c7b5196935ed18a1fda6b96cdcec83bdc1c4ec086d030abd7026cb841afaad0a84114feb69d", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635953173, "uuid": "46189f25-205b-4f18-8ce6-3ae94f33ac99", "value": "T1689533ABAAFC81A3E2F74B38411DAF55B43B5B1C591530E24A8B5C397C9D40D7D0A38E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635953173, "uuid": "92e63afd-cd8d-4ffa-a1e9-fa49d0d58a7d", "value": "02549ff92b49cce693542fc9afb10102", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635953173, "uuid": "97fdfdd0-8333-4fc5-99d2-6eea7b59b900", "value": "49152:76sN2Y44C02EOdMcIoZP15kPYgc3S9l1/AH5O:G+J2wcIKWPYgc3SL+H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635953173, "uuid": "a7cbc5df-ff41-4fb1-b798-129f8338101d", "value": 2042880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635953173, "uuid": "c0c0fd14-530a-406f-9588-fd448192a0aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635953173, "uuid": "22c3999a-813e-4192-84fd-eb67f48a231b", "value": "e8614769092b8925846c4956a6fed592", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f86b4292-3c85-11ec-843c-42010a9c0014", "comment": "Malware payload (AZORult)", "timestamp": 1635930663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635930663, "uuid": "7041c315-78ca-4c76-be90-b25ffcc70b3c", "comment": "Malware payload (AZORult)", "value": "35bb14a775c44e7f3d397ed46b1c55e3", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635930663, "uuid": "bd985e47-9d3b-4085-a57e-da3de2b915be", "comment": "Malware payload (AZORult)", "value": "c95aae72cd2b6a16b7b16ee3da28266040f4bb87444a5c32be921988bed0f53c", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635930663, "uuid": "1fc8baaa-563e-4dca-b119-05081820071d", "comment": "Malware payload (AZORult)", "value": "36141d8f52ca4a2aba9bca3c16a637e412794779", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635930663, "uuid": "43ec7c9d-2c4e-4823-986b-f7cb301c6573", "comment": "Malware payload (AZORult)", "value": "f2ebe79079ce85cdf66b93f6a3a86ac719cc0d77747da8ee36a1f3c9f0b604bf551fd0dc6578e63d749de1a41a647cae", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635930663, "uuid": "aaf4b7b2-69ae-4f3b-81cb-bd21dd400e6e", "value": "T186548E10A7A1C030F4F252F889BAA3A9B93F7EA16B7550CB12D517ED4A74AD1EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635930663, "uuid": "10358db1-2cf4-4a0a-8224-25df16776824", "value": "e024db68009cf7f32dd817cae1867bf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635930663, "uuid": "34f9da67-8157-440c-9181-ad87376dd4fd", "value": "6144:4RkDd6lEg3QnFkVnKx+9u6xww7Y9Hfu4aEmmTgem:4eDd+AnF0nKx6u6x77YBu4ahm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635930663, "uuid": "047cf7cc-b4b6-4d64-bd36-14d366168bfe", "value": 299520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635930663, "uuid": "5df2973c-e783-4dd9-bd0e-e6e5e7efad73", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635930663, "uuid": "4e823976-c7ce-4c74-8b02-9411e3c4453c", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff06e040-3c9f-11ec-843c-42010a9c0014", "comment": "Malware payload (Kimsuky)", "timestamp": 1635941841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941841, "uuid": "ce1c4c6a-6c7d-4b7b-9599-5928228fc1b4", "comment": "Malware payload (Kimsuky)", "value": "e19f75c72c13c3052e390e90a927cf4a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941841, "uuid": "ddf53d67-00a3-45b9-a296-95a0c03791fe", "comment": "Malware payload (Kimsuky)", "value": "c96d85630a46c876f6c4afb042b0c363334c17c7f0f4ec0c750f3e5fc2e04e46", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941841, "uuid": "2377be95-8796-45af-893b-786b6c6511ff", "comment": "Malware payload (Kimsuky)", "value": "a5cb241ed09cf11d040f2a81abb532ba05c7d9a8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941841, "uuid": "169a77e6-5be9-48f5-abd8-70f77bd03a6b", "comment": "Malware payload (Kimsuky)", "value": "c01b12d11d3d87e0d06f5e4f0963b0acf7b514cb17b6b8a6729940f8efe84770a44f7c810f8aae1fcd80090c02c611fb", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941841, "uuid": "4d4766b3-1e2a-4d4a-8698-b2074910508f", "value": "T121B54B92B90472CFD59E27B88937DE82581D47F807648913A8FDB4BEBD77CC12686C24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941841, "uuid": "7e56f48d-a7af-499c-a87c-65213e95dfdc", "value": "74c18d2564058cf2aaf7e61eda41c07b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941841, "uuid": "0ea8f699-07b7-463b-9bb5-0db1f8c2f20f", "value": "49152:cZVLxso0JLjMsMj3O8uZ3zof67O3UXXs14xRm:cMBoBj+8uFzDO3gXs146", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635941841, "uuid": "42e87917-4f64-40b0-9cea-a89c667eaf0b", "value": 2406377, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635941841, "uuid": "262de49e-cb6a-4bd3-add0-baa3031cfcd2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941841, "uuid": "174fb161-0f3c-4a26-86c5-d943bb6fa1d0", "value": "c96d85630a46c876f6c4afb042b0c363334c17c7f0f4ec0c750f3e5fc2e04e46", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "768e1ae3-3c8e-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635934311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635934311, "uuid": "9b9184b0-735c-4852-b744-c368ecf5bee3", "comment": "Malware payload", "value": "9e5cedec528d98d893713aca63bcf902", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635934311, "uuid": "ad096682-5f30-4e57-96e1-3fa42681d19f", "comment": "Malware payload", "value": "c9fd33c15c49a63150e7315f5f7a4469ce0e724bdaaa9428c8491eb2c14efe89", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635934311, "uuid": "a5057c88-3ad7-4d1b-8863-12865ec0f470", "comment": "Malware payload", "value": "9bdb2a8d2f08ae3ea70e3bcce2a33c74c01ca23c", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635934311, "uuid": "20ad611c-0fa6-4164-9d3a-8f3a14e1178b", "comment": "Malware payload", "value": "71cbe9d16dc8499cdbe0e8483dd5aaa8d5b5f0f3d1952e070c01bc951a2a3d9e0e502a5c0eba822c683d9977314217ad", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635934311, "uuid": "1f750541-db9f-454e-99be-eeb8bc1b2e76", "value": "T1EBD12A6D0538FA240464D5978E49FE1EBC425F7FE22826CF3C8E6859AB2D9D084D5EC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635934311, "uuid": "b799d8ce-6464-451f-b076-a681de95862d", "value": "192:Exm0DydWqWwmAlxcVBaag+QZl9TfQbs/dZjxy8WdsC9cCW:Exm0Dyp1mAlxcvQ+wl9Ebs/d1xy8WdsZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635934311, "uuid": "0583699f-0624-4df2-8b63-0722513ad9b4", "value": 6744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635934311, "uuid": "f424e646-0ad8-450c-abda-a269f628686e", "value": "text/html", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635934311, "uuid": "bc81f411-e975-48e3-91f1-293ca22f8c0e", "value": "excel.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba0a0b86-3cb5-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635951174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635951174, "uuid": "0a4fdf9b-e927-4901-a379-609369597cfe", "comment": "Malware payload (RedLineStealer)", "value": "9a4aecb1c20d8436a2217258ffb89ae4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635951174, "uuid": "f75e0125-2987-4736-b9b1-ac1d99353057", "comment": "Malware payload (RedLineStealer)", "value": "ca1ff9ad9c01c9632af1b18299836db3de2c0e127ac4bd4f15679dfba6457bfe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635951174, "uuid": "46459bfa-f71f-4c5f-9270-0f72f6d1f9ca", "comment": "Malware payload (RedLineStealer)", "value": "6051cb4796c726edd8975c9ae3dfb88b3b3c35ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635951174, "uuid": "e1455d4e-c98e-432e-addd-35dec8a7c83a", "comment": "Malware payload (RedLineStealer)", "value": "63fb8a64d0fc178b16b3127ecb987606fe30da750060f69213e15dd10f703e06341dc8e84f5b174baada4b25b366c074", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635951174, "uuid": "2bc4fc42-130a-4b20-b386-9498accad3b3", "value": "T14046333DA4771105F80D8A75B2A6B44F55113687677AEF27CC2F003E947CF9AAA24C72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635951174, "uuid": "135fea27-6788-48e9-a878-59c0361074c1", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635951174, "uuid": "f6d2c820-289a-451d-a017-e30dc889e455", "value": "98304:E/5EA2xNX/xX9gRXUbcCzYZoZ4HrTEgtXfg45ILdasOzbdcHUtOdJp:E/SD5JXlb5Y84LTrXT5Ixas8CHF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635951174, "uuid": "3832c0b5-a02f-448d-9634-64644284645c", "value": 5370235, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635951174, "uuid": "a1d26e85-a74c-4d90-aab7-e402802542e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635951174, "uuid": "8325af3c-11fb-4a28-8e60-ace225efeb63", "value": "Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bc1fe89-3cd3-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1635963928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635963928, "uuid": "0ce1b167-eb84-4573-ac88-3e442231db3d", "comment": "Malware payload (Dridex)", "value": "e44025fdc31cdce162ed7573b6c501f5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635963928, "uuid": "1eb71e22-a80a-4111-9f25-bc26a5771364", "comment": "Malware payload (Dridex)", "value": "ca38cbc0b86b49e80f1f6452c8444c7edff8028ac70b65bfc745dc69d7554b72", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635963928, "uuid": "6f4f351a-14f5-4176-8c17-6122e30003c7", "comment": "Malware payload (Dridex)", "value": "77ab8e747e96194fd435c604c1047848cc26b862", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635963928, "uuid": "ee8f5749-a86c-4322-80f8-ad084e2cd71c", "comment": "Malware payload (Dridex)", "value": "1ab6fb99d408fb18f9a401cc8bacd04c7b7b3e1031cd273750b4e6543ae8386bfe40d332c1c759b6c091b02117a971a3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635963928, "uuid": "a79fca85-ae9f-480d-98ea-cd279bce8a95", "value": "T1D7A4BF04C1EA0676D52B62FE75FF0CCA47104DF9B506AC84D3435A6A5B32FEC3A7A849", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635963928, "uuid": "8fcc9c73-d41e-4d82-88ce-155e1bb6782a", "value": "ccdf79216449388cf5a36d38a385d866", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635963928, "uuid": "c9d8dbd6-74d3-4381-b047-c187fd294cc7", "value": "12288:iZKEZNxJPdthZz/MqmOce24Wqa+cKdDSFczjJgiUCeoCqoE:iZKEr/1jhz17Px", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635963928, "uuid": "132ae499-b9f8-487e-9c98-1390193d152e", "value": 471040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635963928, "uuid": "f57c59f7-f1bb-4b67-9121-5de0710e72aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635963928, "uuid": "1f23de0e-997e-47de-923b-f6e4d466d850", "value": "SecuriteInfo.com.Drixed-FJXE44025FDC31C.30393.31721", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed629a80-3cd9-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635966722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966722, "uuid": "81c8035f-1a4f-444a-9b9b-27015415409b", "comment": "Malware payload (Loki)", "value": "3728180e58ec23f775cc16f438be89e0", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966722, "uuid": "3a6804d1-0f62-4015-801d-09c63aec0ab9", "comment": "Malware payload (Loki)", "value": "ca6b0cc46ba5c5bae9d608fe79d3a906786a99296df9d9416ab31d34a93f4233", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966722, "uuid": "37f7c7a2-8574-40c4-9bd8-07557356e476", "comment": "Malware payload (Loki)", "value": "7d4bc3b1e942202a2402e26bb9e9727f0f54c7d5", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966722, "uuid": "28fe6e7e-ca8f-407e-892a-a8314f6ba03f", "comment": "Malware payload (Loki)", "value": "ee4fdf33cc7fe92f8585590ac4e0466c63e5461310405151886b87072fb212e5215293391dd4ea51e84c842b4cb5dadb", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966722, "uuid": "df3e50e8-1554-4a8f-b4ef-01a3faaa0a81", "value": "T15514123D3DEDB044F6ACAF748D84C6EC97ABCD7A956DE2C63372356AC7798890201241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966722, "uuid": "e6f1fb58-4acf-4955-a8a8-7d54173f96de", "value": "6144:b6DdpWV6lVl+j1UZIN5mbagVwL6SU6Xd8UyAg51QFV2OpT+awrX:MdpBlVzS5mrwL6R6Xd8UyA6YzpT1S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635966722, "uuid": "07dcd2c3-a57f-4f80-952d-ed5f7b803f98", "value": 206504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635966722, "uuid": "5fea85d4-e8ea-4686-bce8-22e30ff1972c", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966722, "uuid": "003de854-506f-49ac-be42-ab6e6e8e3deb", "value": "Purchase order-NX-LI-15-0001.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24212379-3c84-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635929878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635929878, "uuid": "a18194a6-1d24-4502-9b20-cf6a2951d180", "comment": "Malware payload (AgentTesla)", "value": "da6371ded9597d06abb3820692548ec5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635929878, "uuid": "b803b733-b844-4e52-aef6-bf69533f25cb", "comment": "Malware payload (AgentTesla)", "value": "ca9069a5c28cad2fb852ce1b4e3f4f0de219435e08b582151cd6c91e1210b27b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635929878, "uuid": "608456f4-7d97-4e17-b583-77d6301e882f", "comment": "Malware payload (AgentTesla)", "value": "98fbb2ed38a78af21278c501a2a93d5fd8133d33", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635929878, "uuid": "8e0640b3-a0fa-43ca-a4a0-626989dc10c2", "comment": "Malware payload (AgentTesla)", "value": "25e332f5d7ecda7794131b8a748d9d3ab235de529c8e59036247db22a3446ad8552e588b5947e8caacfbac461c2d7f49", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635929878, "uuid": "acddde09-e885-4d9e-9e3d-458a586698f2", "value": "T191942340D889957E7707CF2447E33DA359C5EDD18DEF8A9823AD9E87BD3CA980C06249", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635929878, "uuid": "dc065e8b-3127-41a8-ace0-ffaf952a3cbe", "value": "12288:LEAfZWvoRgBxi54oJPVpcpYXsu0BkIW4fBuvXB+2A:LJfUvkgBipT8YX2BkMg/Bg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635929878, "uuid": "de6361dc-3d1a-4f2b-a721-e990ace6df01", "value": 428732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635929878, "uuid": "dc7e3102-9cb3-475d-86ee-e9733914e1c1", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635929878, "uuid": "df9a2f81-d868-409a-b331-d241562a966e", "value": "Original Shipping Document.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02321b82-3c7b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635925955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635925955, "uuid": "af74c232-3f01-4a9f-825f-4247da9dc099", "comment": "Malware payload", "value": "cdc51ee063cd3f4785d2b6894f5aabaf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "FreeBSD", "colour": "#75A699", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635925955, "uuid": "3ba95058-f2d6-4967-acc8-4f18a9de6b81", "comment": "Malware payload", "value": "cac027eed3a92cd1b24745fa0b182bdc76839edf276a672ab66c311ae61de3fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "FreeBSD", "colour": "#75A699", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635925955, "uuid": "5600fb42-7570-49b8-a41a-825426708dfb", "comment": "Malware payload", "value": "439c3f162ca0500b3e7a744a13912edf07b8aa47", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "FreeBSD", "colour": "#75A699", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635925955, "uuid": "85e6bfd2-b363-4234-9fbc-37f8cbd80007", "comment": "Malware payload", "value": "0751db4ee89df0be7f0a632eeb29b535c841914ea3c4d7bd96cac11f9678910d4101bd93844c92acb108f0247499aea7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "FreeBSD", "colour": "#75A699", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635925955, "uuid": "0cc4a4d4-b4de-4110-8dda-31e970016434", "value": "T14DC52922B89655E6C1FEE1304E415259BAB07E6503306FE71F80A7AA1B36BF46F7D310", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635925955, "uuid": "79ffbef5-1686-4e08-aa39-d8946114b0a8", "value": "49152:HlECvMWHzJnMrOno/sLmdlLQn+YJhd9N5D1:bvMizJnMFEf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635925955, "uuid": "4c15c7ad-0ea1-426e-8f76-6e7f4a2c8535", "value": 2514944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635925955, "uuid": "4b4c4094-7d11-4d9c-85f8-ca1d5ed773ea", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635925955, "uuid": "06c2ce51-5ab7-4e78-a3e1-9019e69d2904", "value": "cac027eed3a92cd1b24745fa0b182bdc76839edf276a672ab66c311ae61de3fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee496848-3c91-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1635935800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635935800, "uuid": "44bc802e-dd00-4549-ae66-16b8da4c2777", "comment": "Malware payload (ArkeiStealer)", "value": "7a0241cf83992433c17986f539b93c85", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635935800, "uuid": "294e9163-af09-4b6f-85e3-6a435f942636", "comment": "Malware payload (ArkeiStealer)", "value": "cc08b64a95d62a366f6de7fe1db179ab25ad1fbabc84576130cdc35668f22557", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635935800, "uuid": "f216ddad-ad4b-4991-a036-b7ac3c464943", "comment": "Malware payload (ArkeiStealer)", "value": "e4c42b6e68186670ccc38b35824cc65006e55e25", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635935800, "uuid": "240a44d9-17d8-463a-beba-3af4d125193a", "comment": "Malware payload (ArkeiStealer)", "value": "d5b639f0095aa35de8b6aedcb022ded492c78841b3d317a7721f3737aef3ca9f7e523aa29625472f6ce234f711dcc152", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635935800, "uuid": "81a76c97-498a-4ebf-9402-1f0d7c42d20f", "value": "T10E958A5A50580E1FFBF39F7FB61FB5A6C65B9C036E01CA68414A5A4608713D0E2723BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635935800, "uuid": "bdd8d20e-5aff-4525-9c82-b247ce1676d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635935800, "uuid": "97d29a28-26ca-46a0-b271-8ae74c43a28e", "value": "49152:QZyANWUMl2A96JeEnQJErlTjcCih08geWP8my3N92axW:gH0+D4CvhRP8my36axW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635935800, "uuid": "9e3821d4-8970-44a6-91fa-54e14146f07f", "value": 1913856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635935800, "uuid": "ea710b67-39c9-45ce-83ab-c3e9218bfbb5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635935800, "uuid": "5155ae64-3b6d-4233-afc5-74411a5bb8af", "value": "cc08b64a95d62a366f6de7fe1db179ab25ad1fbabc84576130cdc35668f22557", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ff68e85-3c90-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635935239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635935239, "uuid": "ac9d8e68-fb8e-46ac-8760-5deefc7db024", "comment": "Malware payload (Formbook)", "value": "2c0b4c3de2fcf51b7d7112b911a64593", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635935239, "uuid": "e063da4b-1e73-46d5-8c52-891230179c27", "comment": "Malware payload (Formbook)", "value": "cd7ed41b0bad9601b5697bf4a809d7d6972b47300684760e26cc337014975938", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635935239, "uuid": "6cfa2346-a3ee-4020-997c-b3d017a9279e", "comment": "Malware payload (Formbook)", "value": "7e614c7e634d095af2dc5cb8e98ea169f2b85498", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635935239, "uuid": "55b6c7d4-898d-44d5-a1dd-7e5dfefe5134", "comment": "Malware payload (Formbook)", "value": "30b4b73a94200ee92d16df75f302ee00c4a86f036bd3d706cad56bb702a1fb5ebd287184985e0e08a250f54909b5b197", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635935239, "uuid": "3d9bb14f-4937-4571-b74b-9930b9c6732c", "value": "T165140206F4E41CCDC856A7B02DE28B26CA399E3A1C16853E9135B17738F6CE4D47D16B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635935239, "uuid": "4f0b4afb-36f6-4a0d-b4ee-e493934c8343", "value": "3072:ymW0H0ydNObUJSibtgguR5yWBw7Zs20IEPSdw+ZCsedCX9OZarKR9v:s0BUbHibGg8a6203PSdbdeGOQeJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635935239, "uuid": "d7882de6-0bd2-4035-95ca-773e79dae816", "value": 190696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635935239, "uuid": "b0622c03-4528-4727-82f7-7bbb547ec259", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635935239, "uuid": "33799b09-ea60-4795-87b5-0c5fc657ae5c", "value": "RFQ 90865T353.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42e9382a-3cda-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635966866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966866, "uuid": "6a21f1f3-b213-4c30-9688-a9829b4150ca", "comment": "Malware payload (Formbook)", "value": "99433830e4ab9d54a431a440f57e1ab9", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966866, "uuid": "8340d71c-c321-497a-ab8b-2c52cc38284a", "comment": "Malware payload (Formbook)", "value": "cd8e870fce0c84649d1cbddfaae7d5c983a6165475f6d9b2f845c48a678dff8d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966866, "uuid": "2b82f8f1-a7b2-450a-bb2f-b6474c3b681d", "comment": "Malware payload (Formbook)", "value": "e997077f8cec8e3055dc5064e4b75db4ea4b4645", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966866, "uuid": "913ae4e4-20dc-4635-a17b-afaf1ba7e1ea", "comment": "Malware payload (Formbook)", "value": "25d98495ad84b7d488e19e796ef891b715ad667ee6b5e6a1b7bc6281e043a4f08949812dcf4955fde3cf6e272bfd744a", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966866, "uuid": "9a9bbef2-591d-417b-90b6-817b00e81410", "value": "T14F14126A63BE4303CC3F637207A7E3145B6CFE64DA389A865F4A30097174EC6529967C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966866, "uuid": "1d167827-df5a-4029-a362-362fc0081903", "value": "3072:6tFeV1kgIyl91AJ9xi5cpI9pFDSI0Wi8JYyfOAjA3GDkOH7o3NoZcKfOiiAvsh49:Vkha9vyp2pFDShna3A097o3aZc2Oiikh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635966866, "uuid": "1caffb7a-b8d9-4e51-85f7-e87a1ccf5cb4", "value": 190584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635966866, "uuid": "90f9150e-c90b-4137-94d7-06e1127329aa", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966866, "uuid": "270d31c7-f42a-4955-ac27-f5d9abbcd0d2", "value": "Ref Swift Transfer.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82bd3cf0-3cb9-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1635952800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635952800, "uuid": "a21c6c2c-418e-4c2e-9367-8b6d2306869b", "comment": "Malware payload (Dridex)", "value": "52eb48c0d399fd850e4b66ae72d242c0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635952800, "uuid": "bca83842-a17f-44fd-82d2-c5a384c936b8", "comment": "Malware payload (Dridex)", "value": "cdab25c1bc8cb9b018f4575ce3bedab6e498c71c1938cfe2f327feea05ad2897", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635952800, "uuid": "462c339c-e4e6-47c9-8c5b-1448a9b394c2", "comment": "Malware payload (Dridex)", "value": "0ab7a1ed7551ff39699ab9e17d3da26175249a4f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635952800, "uuid": "853c5314-dd17-40bc-ad58-b31ac365b4bb", "comment": "Malware payload (Dridex)", "value": "188b2b53db84f75d2d4eae189fbb25a8a36528435fa133f9f204afe020874bc4570b7ddc62baaf24766b6f58e48b14f2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635952800, "uuid": "8194563d-8606-4438-bf90-bd6f00c8f254", "value": "T1D583F20E45D930B0E7A0EE7CCF0D18F2686F23165E116A8B2465EFA8CB754875F8F50A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635952800, "uuid": "f72133fa-b58b-44ee-b207-4cb35eeca026", "value": "1536:8CWWPrX6Q3cWViBN3yKqxyeHw3vRMgF3oKy5hbGR1g3ihWXHubLxROUd:83uqmc3/q0dfaguKyi/g3iY8xsUd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635952800, "uuid": "0a99cd55-697e-44ea-b32b-4a59c5e391f0", "value": 85900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635952800, "uuid": "c1e530c8-97f3-468a-8da3-915d9871e9c7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635952800, "uuid": "7843d444-b3c7-4102-a80a-7d4c212011f5", "value": "Payment.215966.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdd92e1c-3cd9-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635966750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966750, "uuid": "d7194e79-5761-4cb1-8e5a-c958612a858c", "comment": "Malware payload", "value": "d98e05c7a0b11ac7315861a7fd19496b", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966750, "uuid": "3f8f956d-104c-4e07-97e2-88c18adc4f52", "comment": "Malware payload", "value": "cea89426488232707b73d3d0271983d4a30123aff6c4cd907ca29b02fbb815a1", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966750, "uuid": "97fac773-22fa-440a-ad40-de9d299a8256", "comment": "Malware payload", "value": "e76946ce22dd6dab1dc39b58c36e0d3eeb362fe4", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966750, "uuid": "ac5bf807-60dd-4fbe-967f-6058a9972893", "comment": "Malware payload", "value": "9eb1dd9ca711ea614c67d2cac7b3815651a4ab5058af57dbce45bc95b4c7ae0a2db624c1a502a20a660f986de61a4aae", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966750, "uuid": "c1222e6d-e8b2-4c25-8347-d4004f5866a6", "value": "T1A9141230FACF9B10D805557FD09D1EE0AB6F1C9B769EF2428883B13B4E7644489B9257", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966750, "uuid": "e4c65260-c344-4ba9-9727-20b5902b156b", "value": "6144:pYPA77MeoBoLYcf1hYDNqrw3+uWCkpoH8M5r:Si7MlBoLJkDN0Ckpocq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635966750, "uuid": "3abb6ead-b58f-45e2-8827-35709aeebe99", "value": 206616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635966750, "uuid": "d3b701ac-b389-447e-8045-f5eb1fe4d572", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966750, "uuid": "af4342fa-9ae5-48fc-952e-969d1033d575", "value": "PO5394.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd9e3fc3-3c53-11ec-843c-42010a9c0014", "comment": "Malware payload (CryptBot)", "timestamp": 1635909117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635909117, "uuid": "5e93af0d-4a20-4ee9-b985-72ac6ae10470", "comment": "Malware payload (CryptBot)", "value": "84ff033dc43c8b3694bc4e5941181826", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635909117, "uuid": "d597bf9d-b67f-49a2-8d52-903a26051c73", "comment": "Malware payload (CryptBot)", "value": "cec5275f076efc3399b39effbe0f4138905d8a85a1e8bb397e3189991efc73ee", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635909117, "uuid": "97eb8ece-a4ea-4ac6-9cea-00a9097385b9", "comment": "Malware payload (CryptBot)", "value": "b42bb1b97cebda65d5ac779ff292d7ec5e3c2962", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635909117, "uuid": "cef58da7-a508-44b1-a698-99ce392e0e96", "comment": "Malware payload (CryptBot)", "value": "6d4336be92d1c0e99c643a57df27be72a2674061b6ae03d7561ba32f5eb7c3e20cb944ffcb4d2b2eda42a70706447bd0", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635909117, "uuid": "aca1bc1f-d408-470a-8cb8-2844e0cd5ab3", "value": "T1D6F48DB15EDA9032E1EF703FE850A6E6A54EBC367F1B25F7370A867081B52D2A43D045", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635909117, "uuid": "04f99ab3-e223-4c4a-89a8-45f964124622", "value": "20765e34c494d16fd2855e3fc29a5e67", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635909117, "uuid": "bded6142-5769-4f45-ad1d-2ea47b166b67", "value": "12288:tUv/Kc6Uuv6BA5agT8hOFPOGFWImVx98pC4i2O7HZGv1oITbVXbyOHoi2CsNKXVk:tKKc5uvwJgohOFPO/597H8vpQOlk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635909117, "uuid": "63674451-250e-4c30-a1f6-7a4ed00814ce", "value": 791384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635909117, "uuid": "25609214-62ec-4cdd-9270-d3d701a899c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635909117, "uuid": "53a891e2-d69c-4aec-a65b-5c4deda0edab", "value": "File-Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8bddf21-3c4c-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635906075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635906075, "uuid": "f5451178-8bca-43ec-8d5c-41373b8b46f2", "comment": "Malware payload (Formbook)", "value": "d4d54f54edd5f009fd951e72bf0336c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635906075, "uuid": "4b780c58-12b1-47c5-84c7-61d6f6906604", "comment": "Malware payload (Formbook)", "value": "ced2f6787bd1177324b879c119e5b87a8d661e3a3768c68dbf7580517c1e585c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635906075, "uuid": "a4be98b5-6212-4a23-8625-49f31f5a74b9", "comment": "Malware payload (Formbook)", "value": "3d82e38c248f26e6a0a59180c14ca4151b735fda", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635906075, "uuid": "c5500a9e-78cd-4bbe-b45b-f607ea0565ae", "comment": "Malware payload (Formbook)", "value": "937c1d09a399b0d427dd84dd57d52d9c14e7d4e6d15dfed8c2f7c104d5020f6d721a93e1d3e8d1c0ddeedbcbd2c3e922", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635906075, "uuid": "07f3f818-4009-4d53-a210-691f6503c0fd", "value": "T12054122179D0DCB6CAB7EB304D718AF6C6B266152385B24F0FA21E72DA93BD7E305111", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635906075, "uuid": "9aff50f1-3e7a-4869-a26d-ce775577aefe", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635906075, "uuid": "959edddd-9f94-4e49-afbf-ac7116fd2f19", "value": "6144:wBlL/cX2yqFztp8F5HeGrLywvE9MH3DnJKYPZ4rl22P9NqfOEz:CeX2yqHp8HHewvHXDJKYBj6QOQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635906075, "uuid": "47f979bc-bb3e-43f8-9365-2330e96bf61c", "value": 280650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635906075, "uuid": "7d4cafb1-b2e2-46da-9961-44ed79fae314", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635906075, "uuid": "54fcf8c3-cf20-4ca1-b005-960c21ff8b09", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1908000c-3c74-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635922987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635922987, "uuid": "d583c5c5-b26c-4757-9e4f-181346b0111b", "comment": "Malware payload", "value": "9664439033c6ba3c4149fd4e38e65781", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635922987, "uuid": "69d7e0d4-6bb6-492e-a8b8-575bcb724a10", "comment": "Malware payload", "value": "cf1ae3545c787c2c1f4b9607c52bea330d6071b27e71c28b476908341dd010ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635922987, "uuid": "92700a0f-fcd5-4037-b616-762fd7abf481", "comment": "Malware payload", "value": "79d0d28830eae9309b63487af21d151742af8688", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635922987, "uuid": "d79ef6a2-5ebb-4939-8e6e-42dcb37ffd27", "comment": "Malware payload", "value": "fe404cd633eac8d2e3ed27d5202f330f5e3164eb51b9b879cadcf14b9e842a89f6590c73f4a48ae209e84990ae83dc35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635922987, "uuid": "8e2785c9-d7a5-4068-b21f-86f0aa1ecd5a", "value": "T1B9258B30B35D88C9C6FC3634CF25D1B117A16C6E2A10CA5924F43DFBBABC653663169A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635922987, "uuid": "8abe8d30-8d32-42c2-8acb-0b550f8c4e92", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635922987, "uuid": "1722b385-de49-452a-aff9-04f0412f76c7", "value": "24576:YNpyykZ2TCxLmXA4OU9VVgl1XyuNNZ9yi80:Cy/M2hiAQVmCsNZ9yi80", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635922987, "uuid": "f5e9bea7-2134-4c67-b119-f083c8b9bef9", "value": 1052672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635922987, "uuid": "307a173e-d678-4527-8796-e379749ad957", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635922987, "uuid": "c8ff346b-d8b4-4d99-a2e6-6f411bcdf2a8", "value": "XnrwpNAOQyORS62.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc386781-3ca0-11ec-843c-42010a9c0014", "comment": "Malware payload (Kimsuky)", "timestamp": 1635942159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942159, "uuid": "8d46b6e1-6127-4ced-a00e-2b0aed1bc6fe", "comment": "Malware payload (Kimsuky)", "value": "d5ad5ffde477e3bc154a17b4d74f401b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942159, "uuid": "cc00ff1f-7f99-46ae-ba87-2b8a98e4f2c9", "comment": "Malware payload (Kimsuky)", "value": "cf699520db73bfa7abaddec2c0d2e11d399b0cdeecabd7097fd2c0498949025f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942159, "uuid": "b6c14f0b-f81e-44a1-9903-b2b3d68b37fd", "comment": "Malware payload (Kimsuky)", "value": "e002c58283f4e233788f42b6d6209b4828328b77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942159, "uuid": "8c73415e-07db-42d1-8a90-6fbc0460a417", "comment": "Malware payload (Kimsuky)", "value": "c472c148bc80a6e1ea955a214975a8a82ff14db86f3af78a5bf1fff1c29384f1d17b5775d24149926b895a2e4c4ca9b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942159, "uuid": "99a32a33-11a8-42f5-b426-22403955d785", "value": "T1DBD3139ECC068B9ADD241B38AC1BBCE5B3C93428E16485F57E98451397B87B4F73421E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942159, "uuid": "1e21d4a5-d069-4a7a-8bf0-499c62510bcf", "value": "6859c1fbd5011b39e2b3c5ccd6eda491", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942159, "uuid": "1bce8de4-2e9a-4b9b-bb49-5937f7f1a7c5", "value": "3072:Qza5EcLA5i0MzB/NIZF/yf0bRY39MXJ42Chs:QzaxA5im1+0aMZ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635942159, "uuid": "1f32ef7f-d089-4fa6-9d71-3beb3debb126", "value": 141312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635942159, "uuid": "fbec7646-2687-4852-807d-f038e67aad8a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942159, "uuid": "d39ed9aa-8ad0-4a70-a357-de135779dbb8", "value": "cf699520db73bfa7abaddec2c0d2e11d399b0cdeecabd7097fd2c0498949025f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f2f04ee-3c4c-11ec-843c-42010a9c0014", "comment": "Malware payload (QuasarRAT)", "timestamp": 1635905952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905952, "uuid": "0e32105d-9fb5-487d-98a4-4fa216fe9e75", "comment": "Malware payload (QuasarRAT)", "value": "8f0f115b34448e21ca751ad0ca7a5f73", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905952, "uuid": "0b5c8f88-8ed1-4d6d-b196-1b29e575de93", "comment": "Malware payload (QuasarRAT)", "value": "d067d750a89592c633ee59986ad9f6b217635e5f352b289c7dca9f703e1ae94e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905952, "uuid": "5014a8a1-6c0c-4758-821c-86b6f2b98b85", "comment": "Malware payload (QuasarRAT)", "value": "39e3f1dd43c4695bd298fb4c6d5e0f9d36985e85", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905952, "uuid": "79b14e8b-480d-4964-b74b-756e12e89d21", "comment": "Malware payload (QuasarRAT)", "value": "bf5f63bed94f94d46e5e4478e38c652f5c21f08d9db4cfb4db894d23a22b819de59abe62f6da8b0f955f3aabd27ffaa7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905952, "uuid": "d2579ff2-7abe-4836-b6fa-14c215255d3e", "value": "T10B923B2173A48630E6FA0BF7D467E94047F0DE169842C65E6099334B3D3379ACB66693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905952, "uuid": "fcf0ee81-b199-487d-bbd5-167351bd5555", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905952, "uuid": "4c3a9327-8030-4dc3-9a79-3df4a2316214", "value": "384:2gc41WMC6D1akUiCK6MOaLqex4bBtGbKats/EEXdz6gKHJL/SWSBWrWG:zo95ad8ibjts8EXdJQLH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635905952, "uuid": "7a94bec0-5afb-4a9d-b305-6921f800427c", "value": 19968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635905952, "uuid": "edcd1344-5be9-49d1-bcc5-2b3736aa62c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905952, "uuid": "e1701949-7b0d-4980-b479-f8063bfe9479", "value": "8f0f115b34448e21ca751ad0ca7a5f73", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e46f625a-3c4f-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1635907437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635907437, "uuid": "6dd5e73a-5cdd-4ad0-81e3-943ee25c610e", "comment": "Malware payload (RemcosRAT)", "value": "4a27f9893fc39cd4211567ea7f8f5d46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635907437, "uuid": "991cd359-5f9f-4a47-aa3a-2ebbdf5beaa0", "comment": "Malware payload (RemcosRAT)", "value": "d101ad8636eaaa138705ae761820dd37abcf36711ee797239bbde4ee23962a44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635907437, "uuid": "5d076d3b-2ea4-43bc-b57e-b82731bb8377", "comment": "Malware payload (RemcosRAT)", "value": "2f57e2bcf1e375364ee2a3d43caeacde12ef08ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635907437, "uuid": "2f70b037-70e0-4d7e-8b24-10397de6de35", "comment": "Malware payload (RemcosRAT)", "value": "d3433c55f5dea7363f930a073f5d275f274a4c22b389c1774d86868649d786a79b876979c5ee48cba05ff70a1806d2b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635907437, "uuid": "c2b319ff-6f89-4aca-8aa6-22d09d315c95", "value": "T11AA4125EF9D4D975CA0626F05D36CD59A37A6E0C2C12A70B3354BF3F29B92B69C0E201", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635907437, "uuid": "d784bba9-fd02-46b9-a381-655b0436e4a2", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635907437, "uuid": "812362af-2ba6-4798-80ff-a45b8f468137", "value": "6144:vBlL/JgAItWPNkyG9S55lHS39Fue58Wj2B7zIENqakO65sm:JgIkySS5q39TSWjqPNqakO65L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635907437, "uuid": "a2cb94ae-e932-455d-87ae-f168427a81f5", "value": 470513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635907437, "uuid": "7551ff92-ccef-4fdf-8ff4-dfcb697cafe8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635907437, "uuid": "6941898b-f3f5-476f-a1ee-c15fd228e0c7", "value": "RJH5678909870432123406787654305670.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d97a1f89-3c76-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635924169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635924169, "uuid": "e451b0f4-595b-4aea-b033-29d1c1959c4b", "comment": "Malware payload (AgentTesla)", "value": "bb301b5aa4b66f333c06104d6491981b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635924169, "uuid": "108b2ed4-e6b2-4217-b634-ce6639b67882", "comment": "Malware payload (AgentTesla)", "value": "d114a3d2567f30e93a84ce6fc4a1bdede09d0c5e9468666f64a2eac73daf162d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635924169, "uuid": "23fc114c-23b1-4287-92ce-4ba502cefbcf", "comment": "Malware payload (AgentTesla)", "value": "6165251f9202233bba42cb4a3a688332bc0287da", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635924169, "uuid": "329ac3bc-f1ba-41f2-b166-9fc544c0c66e", "comment": "Malware payload (AgentTesla)", "value": "a38a4a12fac65e159f3574ca7c902b433d9ad638e13ae82d819da81c360dae813d5a0aed6550530f97d28247766e8839", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635924169, "uuid": "72f79a48-8ca9-4bb5-87a2-4d11f8090567", "value": "T128D23A607759093BCF6A5A33B0558211F73C9346F81FDB1A38EA585E8DD33461B823AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635924169, "uuid": "9fd0eb2d-c8f1-4591-b584-c3bac885e75f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635924169, "uuid": "08421bc8-a932-41bc-968c-ad8589127faa", "value": "384:1dF61xrHSDBHSpSQSaS3SrOrOxs1Lj9rSVTo+TQfQtqfN7Opd4qjTvJQQFlh1k:RnDdWSQSaS3SyA9NqQ4fN7kvvJQ+lhi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635924169, "uuid": "5f0e017e-dbfe-4015-8a18-2395ba2b7145", "value": 29112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635924169, "uuid": "5cb0519c-c04a-4c3a-9e86-1e438334b799", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635924169, "uuid": "f33d7afe-6f94-44ad-b1af-a96f505f4888", "value": "Quotation#2390.pdf...exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80ce44c1-3cc5-11ec-843c-42010a9c0014", "comment": "Malware payload (BitRAT)", "timestamp": 1635957950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635957950, "uuid": "0e32cb46-f753-4d8a-bc7c-b174d1b13cb1", "comment": "Malware payload (BitRAT)", "value": "584af1ae5ff58c7c9e4616e3f39084c0", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635957950, "uuid": "a37ebed0-6dad-49e7-b0f4-cea9451d46bf", "comment": "Malware payload (BitRAT)", "value": "d23a04d059177e65e8386f3973307c7238976cd454e86f03bad03bdf4c284cbe", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635957950, "uuid": "ae011f62-830a-457f-8d44-35f89b8e5120", "comment": "Malware payload (BitRAT)", "value": "4bc766c4be6276ee6d3a62ac299ef4956d4f81b4", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635957950, "uuid": "27dd09b2-5a37-496b-9315-2c3bb99f7ee2", "comment": "Malware payload (BitRAT)", "value": "a6c086f207976fa982cf90421a8ac921715e0e0d4d81e312b29ac19e858c14803acdf61c152f6b651c81c60741be70f6", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635957950, "uuid": "8f2b8d90-a8ee-40e6-af79-b7f3836cfd3b", "value": "T195746B1733176116E828ABB5DFF3AB310720EEF699764317A2D5392D503F3E62A80716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635957950, "uuid": "1bbd1f1c-fdca-4cdc-804f-465af9fcefc2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635957950, "uuid": "ff30cda8-0505-43c3-a5f1-14fb6646903e", "value": "6144:4bxD+NDWVqNSUnQR9CvopXT7rAOi94xsEcUttfd7XuC9CAauhhutQ6xxVL:/DSGQewri94qHGd9uOa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635957950, "uuid": "3c7b1ce4-3e0b-4979-97d0-30332fab47fe", "value": 358400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635957950, "uuid": "08e039a8-7f2e-4f04-a754-4f48d0ef4213", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635957950, "uuid": "fb32bbd0-5626-477f-8ccd-a1dc67281c9a", "value": "584af1ae5ff58c7c9e4616e3f39084c0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a5e2d14-3c95-11ec-843c-42010a9c0014", "comment": "Malware payload (SilentBuilder)", "timestamp": 1635937270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635937270, "uuid": "581163bb-cd94-4d4b-bed1-67bd8ab2460e", "comment": "Malware payload (SilentBuilder)", "value": "ba29d969ec3358f096e1b93c4dd83d29", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635937270, "uuid": "13222498-b7f4-44a5-a236-bc7b1070a8fa", "comment": "Malware payload (SilentBuilder)", "value": "d2bafd4cfbb632ff85d848810ea17e852cf6958ccc424913978ec3f16b9e1f95", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635937270, "uuid": "016e36a4-67b1-4f96-85d2-69d3daf1d145", "comment": "Malware payload (SilentBuilder)", "value": "71c62dfbb9fdd4c5e6ebf0826c32034a6f9ad1de", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635937270, "uuid": "9d1a761b-ff67-49f2-b00a-8e569d07e676", "comment": "Malware payload (SilentBuilder)", "value": "635198f8cddfa5d700f1cf80e5220546a9eb25ab635f14321a76e34fd16464a364c7d5a63bc916735957b9a0b104bd71", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635937270, "uuid": "a058ccae-f33e-48ab-890b-70e442f78f4d", "value": "T134934A42BA58D86EF525C77148EB53A5B322EC305F6B0B872665B3203FF99E06E03547", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635937270, "uuid": "d5fac091-2c32-4688-9d2f-1969e519c0ac", "value": "1536:i5Kpb8rGYrMPe3q7Q0XV5xtezEsi8/dgr91vrVmxJiME2GhdD52lZPFu1AOge+10:0Kpb8rGYrMPe3q7Q0XV5xtezEsi8/dg7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635937270, "uuid": "3befbad7-8e4a-49c4-bca5-e6e55a86217d", "value": 90112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635937270, "uuid": "4e289a10-1b2d-4d07-86f1-98a02bccbf39", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635937270, "uuid": "8275d086-68e8-46d0-adf9-ee9e7bc0d5fe", "value": "rows-2106103454.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31741099-3cb2-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635949657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635949657, "uuid": "e684c70a-4305-4f59-ba00-6068ac1666b5", "comment": "Malware payload (Formbook)", "value": "d27cc0f142bbe44c02829cf0d4c38115", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635949657, "uuid": "8480bb4f-41b8-40fb-b419-32bdb2b589e0", "comment": "Malware payload (Formbook)", "value": "d3121eec40b8848df53eb8877a07c27b8f0b1c78c2f35af67460105cbc9b8803", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635949657, "uuid": "04354b22-2255-4af6-ba91-ccd0ee3bd305", "comment": "Malware payload (Formbook)", "value": "4b59a3e3ea4e59eda3f06cd08c88d9157c7f3a73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635949657, "uuid": "76302487-78d2-4765-a84d-ad7e4db1103b", "comment": "Malware payload (Formbook)", "value": "4fee57558fc23c5cb18d1c7cf915311083f41273ba4c5390b5d09fb85e3ce03e86146951d8afc63c16aebce9ddf01fdd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635949657, "uuid": "45e9dc1f-aaec-41e0-b5f6-b5c931798638", "value": "T1E3D44A096205C143E3143AB0D4696FF05350AF7CF503DB6FAD453E5BFAB2B980D629AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635949657, "uuid": "88616fc1-5cb2-4656-9571-8b12fd417650", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635949657, "uuid": "a3c6308f-b74a-4e4b-b671-55b25d56492f", "value": "12288:q1vIbw8eGUMo14OrW0ylltyL7d8gHKz9McI1jzfxTb1qOtGr:Owbw8eGUR1BrI7oKz/Cj9Tb1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635949657, "uuid": "1a39a772-3302-4d22-8f23-c98ae81a600e", "value": 626176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635949657, "uuid": "0678f42c-e5c0-43a4-872c-6e65e8d1b241", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635949657, "uuid": "a95791fc-d626-4a3f-9ae2-135ef40f668b", "value": "Purchase Order - 10,000 MT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37020028-3cdf-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1635968993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635968993, "uuid": "2ea6b99c-c517-4ccd-b06c-8f3e1f8a1cbc", "comment": "Malware payload (Dridex)", "value": "e18891dd591393ff5d3d07117747a184", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635968993, "uuid": "54c8b3ef-e54f-42e3-a137-14f7c45af044", "comment": "Malware payload (Dridex)", "value": "d3cde2540e2479a1ee5bca3942e34fd9983b4757f2a8006c8c4eb8e4157fea01", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635968993, "uuid": "4c864acc-8370-4cd2-9948-1107a075db7b", "comment": "Malware payload (Dridex)", "value": "f60c552a6207e6499def5159bb2adc9846ee5a22", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635968993, "uuid": "ca134ab6-8485-48d2-bd2e-23758bffcf63", "comment": "Malware payload (Dridex)", "value": "a8a21d714af39ba0e45ab829d8d4820676cb9c668fd4aa66164374946ab8a23dad581293b1ae61e996d8b614ce04b659", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635968993, "uuid": "aa90652f-2183-4dfb-bbc2-ec66a10c8226", "value": "T1B1B3020AE5D97C1DC1F6DCFAC68C14F1443D624AA24A7B6B342E352143AA0CFFB5D226", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635968993, "uuid": "46f25ab5-8492-4229-bb4b-9faa7eb3bed9", "value": "3072:83yXFzIsj8aipSW4vHREQ4iZKUbAa1WzOLqKvG8T/zyjA:87OipmvxpZ2A9/H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635968993, "uuid": "093de4a0-5423-40fb-a771-c49e3c2852eb", "value": 114600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635968993, "uuid": "fb94bb49-519e-4171-92e9-b6b809881680", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635968993, "uuid": "894c5a90-5ed3-4900-adc3-bc93d4047872", "value": "Invoice-8527.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4088c9c1-3cb3-11ec-843c-42010a9c0014", "comment": "Malware payload (SilentBuilder)", "timestamp": 1635950112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635950112, "uuid": "f4b124c1-2388-42ce-b9e2-de6fffb2f00d", "comment": "Malware payload (SilentBuilder)", "value": "26623df40bda7112918ed3d011aeb344", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635950112, "uuid": "b23a8a99-0e74-4028-9d05-bc401f805915", "comment": "Malware payload (SilentBuilder)", "value": "d4344061c4a95e9a84ef57e55cf2501a0ba1df913def56d743c5cbe671cfd898", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635950112, "uuid": "a5aa8fdf-0efa-4ab7-96e9-a430510f5abd", "comment": "Malware payload (SilentBuilder)", "value": "2740ab866fc3d0779dfcab5cd348c54d962a3e04", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635950112, "uuid": "9a0cfebf-c8a3-4320-886e-75dd221f8ab6", "comment": "Malware payload (SilentBuilder)", "value": "af2f3d22a2f7774b1ef1370275addb8828d47f8793a9766eeafdc0308b68254e932e40b25e9e8c90ffa739e76cc5f0e9", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635950112, "uuid": "1033fbcd-9437-435d-80d3-da7acdd63a07", "value": "T1BD935A42B659D86EF525C77048EB53A5A322EC305F6B0B872666B3303FF99A06E03547", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635950112, "uuid": "91079089-9123-4ac7-babc-21b294f0b8be", "value": "1536:i5Kpb8rGYrMPe3q7Q0XV5xtezEsi8/dgR91vrVmxJiME2GhdD52lZPFu1AOgI+lW:0Kpb8rGYrMPe3q7Q0XV5xtezEsi8/dgB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635950112, "uuid": "bf11ce57-14b4-47a7-8e31-e3c68232144f", "value": 90112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635950112, "uuid": "7b3c2c0c-5052-4f18-a5ae-f7f349c5d7a5", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635950112, "uuid": "91a687db-37ae-4bef-b499-015405dedc23", "value": "grade-1783656593.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5d6ede4-3cd4-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635964509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635964509, "uuid": "ae3d0a2a-9b13-4c35-8def-4eeb6a201bae", "comment": "Malware payload (AgentTesla)", "value": "31d5db734af743f04f0f98f8cb8dd1ca", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635964509, "uuid": "dd09d764-422b-4102-a747-e27fb0b9d55b", "comment": "Malware payload (AgentTesla)", "value": "d4d3666870a76b2fd8f015f6b8e05eb1d060eb97bce16fe1f66176a7c4a4db36", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635964509, "uuid": "2865a3b9-186d-4e2b-badd-74abbaa98c9b", "comment": "Malware payload (AgentTesla)", "value": "8c046866b2f61572d48bcfd66a7466f83f0d9e92", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635964509, "uuid": "640a5a5c-4f4f-4154-85ea-4d34de721897", "comment": "Malware payload (AgentTesla)", "value": "b5ceae58cfc7cf3baff8682d529781ddc80756bd0c35ec97d8e4394b0103e5e50ec954b09bc4b2915a876b025168fcfb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635964509, "uuid": "7b6588b7-baac-44c0-a5e6-4fad5c011749", "value": "T1F74595303495F44CF9D579F1449A1CF12E6DBC333D89F15A60A2780A846A1C3AE6BE6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635964509, "uuid": "1232534b-2d92-4bd9-9bb4-2a5c5e580d4e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635964509, "uuid": "471039ed-4913-4488-891f-18fc6cd2744a", "value": "12288:Jlq9qH3R79bRZ9bRoqJFTPzDuYx9sbRp3dAANewlfFgNoS9We3Ui2KigC1x:rq9qrtDtoqhxEp3qsfFoo1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635964509, "uuid": "4acf712e-8f48-4b96-964e-422b785c4021", "value": 1174016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635964509, "uuid": "2a5f5463-34dc-49f5-9b07-8aab7fafc129", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635964509, "uuid": "e02f7556-ca67-4e28-8861-e88147d1014c", "value": "SOA 5 NOV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fb0d39a-3ce2-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635970270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970270, "uuid": "78b82969-73c3-46ee-9d06-75eb9b62aba1", "comment": "Malware payload (RaccoonStealer)", "value": "7e0942e119d17ce6d7fbe7c76354349f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970270, "uuid": "bf168d36-555d-4170-bf02-24d6b4360ae6", "comment": "Malware payload (RaccoonStealer)", "value": "d6001655c8a81f14b419dd0db6ef64767a36da0ad2c34920e01ade9d007ac76d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970270, "uuid": "8f54e309-d727-4346-98a6-77076080bc48", "comment": "Malware payload (RaccoonStealer)", "value": "e6653fea2621ed1dbe65889fb4b963a87200d60e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970270, "uuid": "c9c2e3ba-deae-4dde-b04e-6b21b277fc53", "comment": "Malware payload (RaccoonStealer)", "value": "605719a676675395816545694a719622069c42aff222471e9df17b4b026bd48aaa611c5f9f23d43ac8f28853944711e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970270, "uuid": "92f265b5-b5c4-4eb3-af56-0a5dd55b47b9", "value": "T177C4E010BBA1C035F5F652F84AB69368A92F3EB15B7854CF12D826E90634AE1FC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970270, "uuid": "72a549a9-2d6e-49cb-a7cf-3df0498d7755", "value": "c672e75b8a5cc514b6d1aaa38159c5a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970270, "uuid": "810e16de-e0b1-4442-9ba4-0678aaba7533", "value": "12288:EDPaNTcL+xONz/myCJIYfeAZ369s6afe5TVSDo5:WSlSOYKyQRtZ363Ax0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635970270, "uuid": "44026575-a35e-459b-bbbf-6b8c68974797", "value": 556032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635970270, "uuid": "d006c280-adc4-44ca-9a2b-7385fb6f23c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970270, "uuid": "ea2918d5-8950-4208-aa9f-5e0a892b2f16", "value": "7e0942e119d17ce6d7fbe7c76354349f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70fe0dec-3cd3-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1635963937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635963937, "uuid": "ed1e0d83-c443-4087-9b71-fa82c26b108f", "comment": "Malware payload (Dridex)", "value": "4fe881d6f4f13d6509aafdfb80c66d32", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635963937, "uuid": "39ccdc5e-a154-4346-b9ce-244c981807c8", "comment": "Malware payload (Dridex)", "value": "d607d6c631953de31ea39c70318ddb109457b8833227459ecd74913cfdb78760", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635963937, "uuid": "984bd296-0b86-4dfe-8659-3da3de1df549", "comment": "Malware payload (Dridex)", "value": "8585299cd96288560a37c8d9995e6407e05f63f7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635963937, "uuid": "c54beb8a-e9db-4eef-8fbb-34e479522d52", "comment": "Malware payload (Dridex)", "value": "140b5d6e7b0396c0f157fe6588f01bda0a8f49be51c7498d3c00caeee72f09783ba750ab5e8678613d798ba4c2351089", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635963937, "uuid": "7c871b53-6f97-4041-b60b-03aea05a0b0a", "value": "T14EA4BF04D1EA0676D52B62FE71FF0CCA47104DF9B506AC84D3435A5A5B32FEC3A7A849", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635963937, "uuid": "a2961b5c-aad6-4b1f-bdf3-06e44064e2d3", "value": "ccdf79216449388cf5a36d38a385d866", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635963937, "uuid": "3f802651-1817-42da-8bc0-3790ed348f19", "value": "12288:+ZKEZNxJPdthZz/MqmOce24Wqa+cKdDSFczjJgiUCeoCqoE:+ZKEr/1jhz17Px", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635963937, "uuid": "adffb318-494c-4d25-a2a9-3bc984fc54ef", "value": 471040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635963937, "uuid": "1602c343-ecb1-4e59-97eb-85983bf67f77", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635963937, "uuid": "975cc406-c61c-4920-9a96-ee42dd462812", "value": "SecuriteInfo.com.Drixed-FJX4FE881D6F4F1.29646.31403", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2324b2e7-3ca0-11ec-843c-42010a9c0014", "comment": "Malware payload (Kimsuky)", "timestamp": 1635941902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941902, "uuid": "8af95509-bd37-4643-a35f-e48d328f35af", "comment": "Malware payload (Kimsuky)", "value": "66b73fba4e47b3184edd75b0ce9cf928", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941902, "uuid": "cc1df5b4-27d3-4c4d-b072-115073fb087c", "comment": "Malware payload (Kimsuky)", "value": "d62bf83fb5a7b148f326908051b149b77663149d47426ce749e944f7abf5d304", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941902, "uuid": "211fde4f-794d-48b6-b736-afef59129e24", "comment": "Malware payload (Kimsuky)", "value": "340b6b0370730a8344bc880c786a4e10fcd961a7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941902, "uuid": "b312dabf-a6d6-4915-bd2d-0f77200c01f7", "comment": "Malware payload (Kimsuky)", "value": "47f2c3da8ceba96c0b73aad7ddf813a48ab698d30cdb086769439989493f144cf03a5aa5bfdd5d8c522dbf1c9525ac0b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941902, "uuid": "0dfd9299-fa2c-4e33-9acb-7cf4d58122b6", "value": "T174059C3335430262E1EA0D3B551BBCD536B706664607BCFA97CD5CE812A58A0B626FF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941902, "uuid": "4f090a73-1bfc-4468-a7e8-5ee4ebae2587", "value": "516869ce1f79459114fb32d73af9b0ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941902, "uuid": "cb7b0688-4d7c-40b7-819d-573c7f63419a", "value": "24576:blA3vGCt6AJWJZQqpa2Vuj2JcKvtDHen+BQ5:blsGEW7a2VHcKv9HI+BQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635941902, "uuid": "22e96256-335a-438f-a2ee-aa82d32aa510", "value": 804352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635941902, "uuid": "ccd46785-bf8d-4f38-80c8-f88bf8876557", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941902, "uuid": "b69ef7ea-bbf7-4c2d-8788-dbd1b05c8e83", "value": "d62bf83fb5a7b148f326908051b149b77663149d47426ce749e944f7abf5d304", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33756f17-3ce3-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635970706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970706, "uuid": "c09c1bea-aa31-44aa-8303-fe0a8163ef3f", "comment": "Malware payload (Formbook)", "value": "61d62155465f85f8fc4d44a89e7ae831", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970706, "uuid": "259d9e80-d896-4e43-9860-ef8103aee79e", "comment": "Malware payload (Formbook)", "value": "d6742c917817f02e01ba40c61606b3707f373bb8d1f525b75b72b1802cd9b290", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970706, "uuid": "090e67c4-ee40-407c-bb16-3896631480d5", "comment": "Malware payload (Formbook)", "value": "10e1e0c049b58ff662f960a3e5270bfb97c9868b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970706, "uuid": "cc5b1b43-f320-4b7a-9462-ee7de224d945", "comment": "Malware payload (Formbook)", "value": "3864655ce1a6e071144176174a4cffb8102ce63bbf1ea1b9fad17e89a179e6ede251b10877a25c59b2005a869c1c4a66", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970706, "uuid": "8d0e83ae-8aaf-49cf-8b51-5757b5b55765", "value": "T188156C65F1809532D41A3FF8CE879BFD14D5BF93692064166FA83F06CE35BA9342A423", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970706, "uuid": "27c4d377-6f28-4c61-a08d-9737d2d081dd", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970706, "uuid": "ac9c415b-12e1-44a4-9479-a48137fa1767", "value": "12288:+BZN9xp6/Yo9sSbJ+RLbKvOS9cr9BE6ZyxDcC6CoueUCd:s/C/N+1KWS49xy8d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635970706, "uuid": "1167c96b-529b-4755-a3d2-152d39ac17d9", "value": 928768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635970706, "uuid": "23ccf472-029c-4ea7-b423-8f9e64999020", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970706, "uuid": "c7746d61-3961-4e7b-9f25-fd6dcaf757e4", "value": "61d62155465f85f8fc4d44a89e7ae831.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c7f0db1-3c84-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635930080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635930080, "uuid": "eda5dfc2-74f8-4168-a563-8a5593be691a", "comment": "Malware payload (AgentTesla)", "value": "7d9786eb72b7a3ac397cf39e9cf0062d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635930080, "uuid": "3778bb58-4d88-4f32-8c15-886ef18bdb99", "comment": "Malware payload (AgentTesla)", "value": "d6c10d006be302264e44f2e1e9e2a33c9c715effab48518d66d4b928c9a30326", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635930080, "uuid": "1837f3d0-8d32-42c6-92ed-13acd61692c6", "comment": "Malware payload (AgentTesla)", "value": "bc59d62f68c4f6b32fe4eb195e2da7c3a48efe74", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635930080, "uuid": "a7ba84a9-aeaa-41b6-80a5-472f4c1318a5", "comment": "Malware payload (AgentTesla)", "value": "53a0d1599fd69e7f3620d80be392a796bf77628d07e8008b8966c710349373673d8e34901ce9786fd10b8f6b7db92b8d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635930080, "uuid": "ee3b0460-a946-440d-80aa-4d690c51ffe2", "value": "T1C6A46D9012945416DA8CA77AC5D7534DF57C2C4A07A61FC2AE18BF7F9BB2483F60A38C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635930080, "uuid": "503451d5-1e02-4824-a2be-e6963b508115", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635930080, "uuid": "e54c8ab0-ae1e-499b-8e9c-2a85e78ccc94", "value": "12288:1dGQyuN3PW4ZAocVHBEK22Ix3WjTurNI4wbrl:TGQhN3e4Z4NKHZxGPurNOPl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635930080, "uuid": "8aa82c19-cd2b-45d9-9ea9-46541ece815f", "value": 479719, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635930080, "uuid": "7d136279-0d39-4216-affb-3379170a15e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635930080, "uuid": "039db71b-6268-40b3-a11e-a983e72c0317", "value": "Documents Invoice No XP2102000250.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ba0e70d-3ca1-11ec-843c-42010a9c0014", "comment": "Malware payload (Kimsuky)", "timestamp": 1635942399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942399, "uuid": "47a14007-2fb9-4490-849b-09969e05ae57", "comment": "Malware payload (Kimsuky)", "value": "51ab8bf7bd7e4a828a6a843076f19df5", "object_relation": "md5", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942399, "uuid": "3c43adde-ec9d-4e35-9942-886516758ebf", "comment": "Malware payload (Kimsuky)", "value": "d6cf41e3cc2c79530a3c0a9b61c84bf02650c3898c1e1c076c956afdb88ffbdc", "object_relation": "sha256", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942399, "uuid": "b61c9a83-c8f1-478a-b96c-dd158dd94516", "comment": "Malware payload (Kimsuky)", "value": "95d3399aceea37bfa7ef89839f7a4ae966409698", "object_relation": "sha1", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942399, "uuid": "2128c432-1638-4d80-9ca7-95446126513c", "comment": "Malware payload (Kimsuky)", "value": "e5a3dae70fe7cbb4954c87fd4cf1ca12a959205b08665112587fdc81686a06f69f5f9cbd7f13c3dca4d459c2df0478f7", "object_relation": "sha3-384", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942399, "uuid": "befc9a1f-587e-4e33-bdb6-cc64c42ecaa3", "value": "T11FA1E8137813D28CD399B6A7997964C45C9C921A627C2CE8F78EC0CDF524C2802FD3E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942399, "uuid": "18d7e9ac-cf50-427c-868e-a3539219021d", "value": "96:8zosk/mU+u1ViXyzQX1f0gUe3X87J3aLQ4UtX4QLoBf/ETQjOfjjepUc/:kossmxuj0yzCWIn8oZUx7DMAjCpUc/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635942399, "uuid": "8f5ff2d6-f8d6-48a5-b586-779696ef5515", "value": 4797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635942399, "uuid": "a646d2e3-8b70-4b31-a543-78262195e9b6", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942399, "uuid": "f66b2836-825b-4b30-a177-116818d81b15", "value": "d6cf41e3cc2c79530a3c0a9b61c84bf02650c3898c1e1c076c956afdb88ffbdc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f531fd9-3c8d-11ec-843c-42010a9c0014", "comment": "Malware payload (CobaltStrike)", "timestamp": 1635933923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635933923, "uuid": "6d48e179-d93a-4125-90af-a27be94e6b8a", "comment": "Malware payload (CobaltStrike)", "value": "291b85167ee7094190bd4096cdaac970", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635933923, "uuid": "e2d8c218-5022-4a9e-9bb4-a12b579f0fc9", "comment": "Malware payload (CobaltStrike)", "value": "d6e58e5ec14fccd74c1e95606807f505334b1776d644d617fb534fde024eddeb", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635933923, "uuid": "1a012a32-a7e8-4d30-a568-b52a88961878", "comment": "Malware payload (CobaltStrike)", "value": "d5cbf0367278a4363ab4f4ccb11afdd8d6c863c3", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635933923, "uuid": "b5f1efd5-8993-4b77-bfab-ff37d8027454", "comment": "Malware payload (CobaltStrike)", "value": "d112999402b15a080d69bc9cfea22bf2aa1050ed6764aa1845037a253ee941d85ab9d5dc39220b2a80890ed62b368af4", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635933923, "uuid": "ea650e3f-31c1-4e33-8d5a-1e45a6b698a8", "value": "T17EF47DD9164C2DE7F1C77AFC9D78BBBAE1EAB8621E31E14D76B109C359152434E02A03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635933923, "uuid": "f87324c5-0073-4bd5-bdb9-e33298be1fb4", "value": "d50243dfbeabedf07883d8121437f106", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635933923, "uuid": "8e1bed24-4a04-4b2e-a69e-e32089770a4f", "value": "12288:tgQyujFDOhi6dP0EzBuj2I3E1uv5WnWm9QWdTTvFiSGoxFEVy/dAvD0+K9Qy8Z4X:3jFKk6aOBuj2I6uv5yWm9QWdThLGdycm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635933923, "uuid": "b16b050b-b94a-46bd-9b33-7cc6b624b4b1", "value": 780800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635933923, "uuid": "9f068a64-ac11-4386-8e3b-7d7514d6de47", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635933923, "uuid": "1088b8ed-de4d-4e16-9252-a308748093af", "value": "Cisco_EDR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff059e01-3cd8-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1635966323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966323, "uuid": "024198f0-8523-46e9-85f1-d8ab990aa1f9", "comment": "Malware payload (AsyncRAT)", "value": "1c9cf1c4aa4afd20a3452ad2e8713751", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966323, "uuid": "824debcb-969b-4c81-be59-c71247c894f9", "comment": "Malware payload (AsyncRAT)", "value": "d78d4f4148d22ba034f5c27ac7b60f6e063a90ff9245dd0237575eb4e2e23f76", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966323, "uuid": "5eab260d-26f1-46d7-865e-5ae2b83cf789", "comment": "Malware payload (AsyncRAT)", "value": "060594c4ab4e15fc06f73d62cc33b15e80a4371d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966323, "uuid": "1bf0cbdb-cb91-4ca6-a227-c83601f2e2b2", "comment": "Malware payload (AsyncRAT)", "value": "0fe451b3f957bbeb8f73f1b89f8b65272268babe25136861c1887639bfa0f1af0c2db25988fbc4833e634e977c3def28", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966323, "uuid": "6feb39aa-cce1-4344-b333-9c7f353e6bda", "value": "T1B364DF52315D8B21C76DB3F560AA8350BBB87D3A1443EA4E2DCAB1CA19773418F70E87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966323, "uuid": "f8964e3c-f5e9-4be5-8d4a-11d789a4acb5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966323, "uuid": "440a71f1-3af0-4760-b08b-b36255d96b3c", "value": "6144:SUWD7MbwN2s7GQi5ctEihP0i8bz2Ckt4BPxrQP24A8lTr:S3Ibw8eGvG+Uci8bz2Ckt4BJeh1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635966323, "uuid": "9cdad7de-0153-4d3a-a381-d7674727b386", "value": 321536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635966323, "uuid": "6b831f4d-ff84-48dd-93ef-0f99409a0b27", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966323, "uuid": "967bf16e-e975-4af4-ba16-105640d6f5fa", "value": "Ziraat Bankas\u0131 Swift Mesaj\u0131.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a88f0d4e-3cd9-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635966607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966607, "uuid": "c63b443b-d60a-4f8e-895e-835aa5e5c3cf", "comment": "Malware payload (Formbook)", "value": "1fd81bc4f13faccafebf1f96476f7d81", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966607, "uuid": "3e711026-072c-468b-8ec4-f642b2fdf817", "comment": "Malware payload (Formbook)", "value": "d791338813f0c79c877710f0e82e62bb211d80ea2113b2b7cd1e875be98be1e0", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966607, "uuid": "9c239bc6-6b4e-4c44-ab8c-e53c044655db", "comment": "Malware payload (Formbook)", "value": "83eb93f98b88d0edbbdc6de6e20ad758d4855638", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966607, "uuid": "1e4e98b7-773c-43c7-8d14-11a1d98b3ad0", "comment": "Malware payload (Formbook)", "value": "0178006f67e4ecae2292fe9b54a6053aa625c0cf45e4309d1d7d2e891340665d6d022312bca4f5876bd54618f23d46c2", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966607, "uuid": "01eb12ce-b5d5-4fe7-ad73-d900462c5d31", "value": "T10AB483ACD09747EC8FCDB7B46A191E891208B76DE385F5533638A7B12B93C7A9007874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966607, "uuid": "2bbc2a24-6fa9-4fa7-ae06-e44cac2bbc46", "value": "6144:MPebvel/wN0CI/4nDV9F0uue9mkQhSxEowfmEkUsDwapYQsO30dE1LEf:dekFIcp4uQ+EkUHy5sO3l1Lw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635966607, "uuid": "117793e2-b86a-4d4b-8ad8-bb04b5207691", "value": 512717, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635966607, "uuid": "ceb7c6cb-8238-4d42-8daa-c33f46273f5d", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966607, "uuid": "6cb43069-289e-494f-93c9-b5117830f634", "value": "RFQ-CSCPLCON-A2021009 -Provision Of EPCC For Field Surface Facilities FSF Electrical Distribution Sy", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24d29533-3cb6-11ec-843c-42010a9c0014", "comment": "Malware payload (Hancitor)", "timestamp": 1635951354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635951354, "uuid": "d7595013-32aa-49aa-92d9-32624fd2d6c8", "comment": "Malware payload (Hancitor)", "value": "522d9c5981133e496fb4d21ee2dc54a2", "object_relation": "md5", "Tag": [ { "name": "dap", "colour": "#099253", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635951354, "uuid": "244ee01e-da80-48f7-b632-013c7bb0069f", "comment": "Malware payload (Hancitor)", "value": "d83fbc9534957dd464cbc7cd2797d3041bd0d1a72b213b1ab7bccaec34359dbb", "object_relation": "sha256", "Tag": [ { "name": "dap", "colour": "#099253", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635951354, "uuid": "1fa3efe2-e78e-439e-b88c-5efdc3e2e986", "comment": "Malware payload (Hancitor)", "value": "2c0f7b0ba7c561cd65f02872fcaacef14663923b", "object_relation": "sha1", "Tag": [ { "name": "dap", "colour": "#099253", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635951354, "uuid": "d2b47399-ff35-4ccc-9450-bc28621344c0", "comment": "Malware payload (Hancitor)", "value": "6a6804e50a8f8568fdfe79c494ff6b3b570a11d620dee5cae02cc5cab87253efd8f7cc957c5f63ef0fe37664138e4b34", "object_relation": "sha3-384", "Tag": [ { "name": "dap", "colour": "#099253", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635951354, "uuid": "a2b0704c-c710-41d4-bbc3-9e6e8edf58cf", "value": "T191E48E23F2F14437C1B21A3D9D7B63A9942A7E112E38984A77EC0D4C4F3965176393AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635951354, "uuid": "94303c00-7b12-4af4-aae4-56616ef65db9", "value": "038999fae33a664ff6aec0e8add47ca3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635951354, "uuid": "ab0efe07-9b29-4ac7-8376-ed94f8847a4e", "value": "12288:czPwDLk/vf7IAqaB22JiUJ3JfahgrHCQ2jPLzNmpKI2ouKI40dB1:+PI20IREC3ig2bjNmp9HuKQT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635951354, "uuid": "114ecc34-b31b-4576-959f-3f6432272b0d", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635951354, "uuid": "c6c9cd41-e047-4022-95ff-803c29fc4023", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635951354, "uuid": "7b3aa1bb-61af-4f44-bcef-519f6c11e691", "value": "gelfor.dap", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a06d2b7-3ca0-11ec-843c-42010a9c0014", "comment": "Malware payload (Kimsuky)", "timestamp": 1635942074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942074, "uuid": "ebf52dcf-3065-471d-a7e8-accf92f78c9c", "comment": "Malware payload (Kimsuky)", "value": "11d3b490638d0376afe3540df88a6476", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942074, "uuid": "0bb04317-af0f-4ee0-8ced-dce23a1f6fc9", "comment": "Malware payload (Kimsuky)", "value": "d89f7805e56cd9ca92fad64fe15ab226e4c780b14a76f4e887d6dd62375064a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942074, "uuid": "5fe0cb26-275a-4cd5-b951-05d54d2a7f36", "comment": "Malware payload (Kimsuky)", "value": "74aa3559e86d1af4c4b10d0465dd3f4ffcae911e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942074, "uuid": "ada58d01-23ee-4e90-8f19-0842c3d681fb", "comment": "Malware payload (Kimsuky)", "value": "48584d1efd5cf3a11d481e87496af02a482957b3f552ca31866fa55e3839d0f901615669485795b7129cfc0aea5aea29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942074, "uuid": "85bede40-15a7-417b-b864-e3e9d56bcf04", "value": "T195647C59B3A844B9E477813DCD574906E7F2781A0771DAEF03A0425A2F237E19A3FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942074, "uuid": "457d45a5-1851-476f-a54b-4d58f798595d", "value": "77b34438da1c6957e5e5dcccce760d8c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942074, "uuid": "16f8fa02-c70f-4e9c-9fa8-0bceebc41964", "value": "6144:KBdslFReQ7QW/YzrQ3jx0+PZbbductNSohQrS3:KBd8FCW/EUTxRbR6op", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635942074, "uuid": "591afc8f-1149-420c-b4e6-8660e1750fef", "value": 309760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635942074, "uuid": "79a855e5-99ab-4013-b494-1d5de056c3d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942074, "uuid": "273f3bb1-405b-40a9-9df5-a75cd56ddada", "value": "d89f7805e56cd9ca92fad64fe15ab226e4c780b14a76f4e887d6dd62375064a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92d36397-3c54-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635909447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635909447, "uuid": "fc03ef41-807a-480d-b6b1-05385fb8d537", "comment": "Malware payload (AgentTesla)", "value": "05013b62f915399480252fbbf32da5ac", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635909447, "uuid": "a6cdec78-1379-46dd-8f38-60b46f436afd", "comment": "Malware payload (AgentTesla)", "value": "d8c0360b23f1ef94be766c832ef87d0906cf60a5329302e212ea787d30b570c2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635909447, "uuid": "bcce447c-1e09-44e6-bc42-a4b98dd5526e", "comment": "Malware payload (AgentTesla)", "value": "ab10f3a35f136a1000cc94ebaf1e643c014b63bf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635909447, "uuid": "565793bf-89f2-4394-9647-b23c4b1f0cd6", "comment": "Malware payload (AgentTesla)", "value": "92b574c3de0fb6da2533c65db8f7652c3a8ada74f26cc292eac21ad8630ac03589034877c392af0eb4dda5373cb299c1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635909447, "uuid": "e3c255c0-c1d6-4e5b-847d-cb40fdc66b5d", "value": "T1F6055930F75D89C9CAFC3634CF25D1B017A16C5E2A108A5924F43DFBBABD61362316A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635909447, "uuid": "17d7f851-8cca-4503-9d25-683751a423e3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635909447, "uuid": "4b083eef-e6ae-4049-adfd-c59b1b3e6fbd", "value": "24576:4+84YMomGENwgW1qIHLP1jyuNNZEnSi0:r8x8G/gYJWsNZEnSi0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635909447, "uuid": "68d305ad-dc8e-415e-b73c-ea195ec2e0bc", "value": 868864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635909447, "uuid": "c207c2bf-5557-43e2-a620-99447298bd04", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635909447, "uuid": "9468a44c-8f76-41d0-8618-a4e2f2173633", "value": "SecuriteInfo.com.MSIL.Packed.19.8143.21388", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e49c3342-3c9e-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635941367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941367, "uuid": "177aefac-ccd2-47f4-a028-bd1285f874d1", "comment": "Malware payload", "value": "8f593bfb9f1bb61465c7af698c1bdb10", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941367, "uuid": "31537ffc-92db-42bd-b883-5d8630e7c979", "comment": "Malware payload", "value": "d926962cce5824d6f0264a2edc9b65fa793da39262fabf483b388db05f5963c0", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941367, "uuid": "6e9e53a6-a986-47b4-b640-f051ed2b34d2", "comment": "Malware payload", "value": "c78c4cc17467ae593d1aae3c5dc1888c35d86282", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941367, "uuid": "6a3d7f61-e2c5-4785-a32d-e2a4977e4c99", "comment": "Malware payload", "value": "1331204bd6624a7ac80b0b80bdc4f5349d771c8cd94552092a6321e7adbc42ea615bf3c1f42244d1303bd692c81ff71b", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941367, "uuid": "de106d15-c592-4782-a179-55c25fbe4932", "value": "T19F95339DE74530DEC2C620959DACD7A03EB8C9F648C03239F841A5E69DA4EF5D011BFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941367, "uuid": "aa223a92-22cd-4678-af15-e59408b86f1f", "value": "24576:tjEAVuhOK0fvjEAVuhOK0fUjEAVuhOK0f/G78CDJI54INormoXSRScDO1VpYNcxC:dUx0fUx0YUx0XOCWmASRjuVpYNcVYvN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635941367, "uuid": "10e69d51-c4eb-4546-8b0c-d233d12b6b38", "value": 1930775, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635941367, "uuid": "585e1c2c-e720-4254-8ee0-5735fa44616b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941367, "uuid": "b0b3846a-65e6-4184-a47f-0b2d4cc0b4b0", "value": "invoice_payment.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9d3dd18-3ccf-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635962368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635962368, "uuid": "0f3e89fe-8f1f-401b-9e48-9018415417dc", "comment": "Malware payload", "value": "1052a744e5016616dae680adc6f7c8d3", "object_relation": "md5", "Tag": [ { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635962368, "uuid": "2142a31f-6e89-4de0-b609-2f12d763d486", "comment": "Malware payload", "value": "d9fe9c268dabc421ee0cd7eb120d655552b34c05e482f213c19d76628eb37337", "object_relation": "sha256", "Tag": [ { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635962368, "uuid": "e3300ee1-c591-4d60-90dc-66c60083f559", "comment": "Malware payload", "value": "532125fa8ca69cbdc36da1b41aad2e53c87b3775", "object_relation": "sha1", "Tag": [ { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635962368, "uuid": "6a885ad1-ae0a-4296-8cfe-14eccd03af4d", "comment": "Malware payload", "value": "e27666e2c8ddae90b47693bf7cffcd9cde91ee1638972782b1e0e370e9c52076b7d329e90cd0337d5c5ba6403f91cb0d", "object_relation": "sha3-384", "Tag": [ { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635962368, "uuid": "65b576dd-61e0-463a-8da2-b657d99dabca", "value": "T11783026DD7D674A3C1B74BBC9044ACE1701B96186942F28B2CCEB600C8E47DB67DE66C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635962368, "uuid": "b9fa2a4e-ab3b-4d51-bd57-8584288224d0", "value": "1536:8CW8PqrE3gpMokPF58Ik4kosQFVvSuM2Zko5zv61b+97o6vks:83VEwFkd58IXkOFVvMwR6147ss", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635962368, "uuid": "f520dddc-8d12-4e82-b210-ca533069cfc4", "value": 86356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635962368, "uuid": "790b1602-7173-4cb3-8ad4-571f90d04fec", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635962368, "uuid": "a2c1d64f-30e0-49e2-bf7a-729c17c9ae80", "value": "INV 8923.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c285eec-3c7d-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635926965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635926965, "uuid": "0fd57b6a-62de-480d-b152-ce8d5a39c841", "comment": "Malware payload (Loki)", "value": "5d0df4521c0d5b14d171a4cecbddba17", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "r04", "colour": "#B270B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635926965, "uuid": "bbee7e9f-3e84-47e0-bc38-c6926ff76e79", "comment": "Malware payload (Loki)", "value": "da148f6db526748e05071adf443fcd45c175e4fd379d50cf4eb80dc2e452f771", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "r04", "colour": "#B270B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635926965, "uuid": "e9e2606a-6dcf-4521-b17c-aa6d04d59518", "comment": "Malware payload (Loki)", "value": "993b179b135b5d94fef176f750a532949d5f74ad", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "r04", "colour": "#B270B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635926965, "uuid": "271d12a9-6809-499a-8c99-e8183913fc80", "comment": "Malware payload (Loki)", "value": "65dab3bdde5be903029f29ddd6b600e6f1eac2b26e04ea080ded967521005ffe512190cd20e6a5573b1953a41c844469", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "r04", "colour": "#B270B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635926965, "uuid": "295378fd-5542-4d67-be03-da953ce8d39b", "value": "T1CD5423DD29B4C6551A45C07A368FFD853C0A2D25A6E8BB0EAF47027E14CAC72A70E5F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635926965, "uuid": "8305b900-466c-4404-95ad-8f20fd5428d2", "value": "6144:79AOb6rwn9fDX5RwFmAv5+jxZyJrT2ZmClqeX6oe0506qMIz63TXKYj:J36rwn9LX5el4x+aZmwq0es06ZjF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635926965, "uuid": "9327f74e-c2c3-4836-a856-2e8ba3beb452", "value": 302376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635926965, "uuid": "19f902a4-24f6-465a-a2d3-5228e5827910", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635926965, "uuid": "e3d451fc-3c38-4ac6-b8e9-5ac9bee1da12", "value": "Shipping Documents Original BL, Invoice & Packing List.r04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "601c27fd-3c7d-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635926972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635926972, "uuid": "e0391913-3ae3-4487-b4aa-4ce3d9434592", "comment": "Malware payload (Loki)", "value": "6e0bb73594b086723efa4a35143cb67f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635926972, "uuid": "dfcebf29-0f99-4ec4-863d-0a893e63ca84", "comment": "Malware payload (Loki)", "value": "da1499eb6320f63efa523325b256a875cf7801181115f0ca38a50cdc211cc45b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635926972, "uuid": "97fd8526-cfcc-437f-9f19-47345de5f75f", "comment": "Malware payload (Loki)", "value": "9f443421449b39921ff781c6baf999def8dc118a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635926972, "uuid": "54d2eeba-1d28-42dc-a1f3-57c4277157df", "comment": "Malware payload (Loki)", "value": "98e8a04b9d4ef9914b60a5ce73cf772e5cbd10e2f0d7a27cf5d1fa53e77e4af196eca0aa0aae5c3432d59ff9a42f446e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635926972, "uuid": "4e6829e8-524a-4e13-950e-bdd1ce1cc6cf", "value": "T14684EF46316C8B55C76DB7F560AA9354BBB96E3E1452E25E2DCA71CE0A773008F30E83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635926972, "uuid": "6e572482-8e4b-4055-9918-803f3d95ec8c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635926972, "uuid": "072ca0a0-518c-4869-8a33-cc579885c945", "value": "6144:2OWD7MbwN2s7GQhY+6nFkJ4Kt7npSXyedYCC2UR67YTaupHcFm4ez8V+4iqaBHln:2ZIbw8eGyP4KlnpWgaaVHcCz8Eqa51", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635926972, "uuid": "5a69462f-349d-4cfe-9032-8c99f1d4da54", "value": 372224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635926972, "uuid": "5900764f-1a37-4ac8-9792-3bbb87b03061", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635926972, "uuid": "4c2e5fbf-9ef7-46b1-8341-73cc0ba56d21", "value": "Shipping Documents Original BL, Invoice & Packing List.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd400dc5-3c8c-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635933597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635933597, "uuid": "7cb8cfd3-1eca-453b-94fc-ff4dff85e751", "comment": "Malware payload (AgentTesla)", "value": "a757f31eb25226a57291c601eb83ec34", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635933597, "uuid": "181c2e62-b687-488f-a526-fa102260542f", "comment": "Malware payload (AgentTesla)", "value": "da525ab5845d7f8f07c7068a720f6ff7fd3bb2309522b9cd8892cd7594b86a57", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635933597, "uuid": "c97dcbbc-a9b9-44e7-ad34-45d60bf09ee8", "comment": "Malware payload (AgentTesla)", "value": "ca15a822de4352827b698363e45fb2b1b0d9a491", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635933597, "uuid": "9ee9df07-86bc-498d-b47a-c43f1e9bc074", "comment": "Malware payload (AgentTesla)", "value": "6e53d3128805dd1e09e80f3a70902242d4562ab1d789bd22d98ff92abaacbb1e9adfdd65a2e279b6085720c0ee6ed597", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635933597, "uuid": "8a26dd4a-6f31-40d2-9ac3-08b719187d1b", "value": "T1C4B4F186316D9B22C76D77F160E29321BBB17C3A5912D94E1ECA78CA19737024F72E03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635933597, "uuid": "89618476-a23d-40f7-8d52-5c58a0998c5e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635933597, "uuid": "7cf7cb76-e644-4cad-94bb-caff67b7c626", "value": "6144:xz8D7MbwN2s7GeBGFjuTSGN69uTXip9fRxQRaA8/nK2JJkneApIF2doY130BRjdM:xyIbw8eGLA2X+i9fRYafR2odcZ64eO1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635933597, "uuid": "26288469-1dce-4702-b71d-e773a2f3589a", "value": 510976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635933597, "uuid": "35d031d3-e0ab-4d4b-93e0-a7131e7ead02", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635933597, "uuid": "a63c9513-a7b7-4856-8e82-2211aad3e29e", "value": "BANK DETAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a21ae17-3c5c-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1635912735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635912735, "uuid": "38f583b7-9465-41e7-a27d-d183d6318c04", "comment": "Malware payload (Dridex)", "value": "9126906faf1b8b6e90847733b3ea8fcf", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635912735, "uuid": "336648f0-a6a1-4f9a-92ef-6d200bb203e4", "comment": "Malware payload (Dridex)", "value": "daaa26868a4687af5008f0115bfaad5747876d9d4d42b0bdea0c2ea25e309058", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635912735, "uuid": "62d64222-b74b-49cd-a438-f0eae9872647", "comment": "Malware payload (Dridex)", "value": "40e4db5a8efa2a6b287fea1bd90c5edbe53724b8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635912735, "uuid": "c829db58-91b0-4eab-bc95-43780c16d282", "comment": "Malware payload (Dridex)", "value": "ef5983aea562fa67e62603aeb320a039e74e97a009580c3be2dbd759c5c493a66bc25af40ea9c8b66ccad6bf006f956d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635912735, "uuid": "4c8c539b-147a-4321-944e-1487f0c308d8", "value": "T156A4AE94FAEE40B8E5187A74C4DB19A56E821E24C4AB1615F4587F0E4E338F3970FA73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635912735, "uuid": "231d4c29-8463-4d31-8323-cf688c6d507a", "value": "c6e29838e1e1c81859cd162bf701404b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635912735, "uuid": "af1b8adb-585f-4f3d-b27c-25537712905e", "value": "12288:LGw8ObmVk9gbUngly9sp+ROx8ufNX/7vuZU/4BLl2i0:LrxC+mggkqIwG4X/7vuZ44Zl2i0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635912735, "uuid": "ed825956-bfe4-4220-a751-5791a17eb76d", "value": 462848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635912735, "uuid": "bde64377-d29f-48de-a98e-43c8b9392bce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635912735, "uuid": "38d2bbea-1a01-4e53-bf02-ed2139a142a3", "value": "SecuriteInfo.com.Suspicious.Win32.Save.a.17855.2324", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c967058-3c5c-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1635912739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635912739, "uuid": "6d44db93-4067-4958-912b-657890ac5afd", "comment": "Malware payload (Dridex)", "value": "bba9199261419837a116bd185e2fa4c4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635912739, "uuid": "a4c4fe1a-06f2-4ec5-9dfc-464cbade0886", "comment": "Malware payload (Dridex)", "value": "db72cf43c181d91f5c277a312dab38623c9c345f2993201443b6641f775ed17e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635912739, "uuid": "fbe2d16a-a03d-4fa0-a49f-174cac83c19e", "comment": "Malware payload (Dridex)", "value": "9e60b1ff890dbaa2872f9b99316d1ef9415adc1b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635912739, "uuid": "50aff479-05bc-43a6-b5dc-de311c4d8904", "comment": "Malware payload (Dridex)", "value": "4b6afdd8196b9b771d4dd84dd7dcf9838b9df7e00f704d87d55299c2dfb52451f1205b8e64047881d90efaeab055b944", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635912739, "uuid": "9e82acd0-5a97-48cc-b537-80d49e0746a9", "value": "T1BBA4AE94FAEE40B8E5187A74C4DB19A56E821E24C4AB1615F4587F0E4E338F3970FA73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635912739, "uuid": "ff009cc9-a031-4646-b64b-6383c9fade84", "value": "c6e29838e1e1c81859cd162bf701404b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635912739, "uuid": "4064f7b4-b13e-4a31-92e5-44e1f0ebb3f9", "value": "12288:NaGw8ObmVk9gbUngly9sp+ROx8ufNX/7vuZU/4BLl2iK:NarxC+mggkqIwG4X/7vuZ44Zl2iK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635912739, "uuid": "0a2db026-934e-4bda-bd60-a126548cc883", "value": 462848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635912739, "uuid": "a1bb9f73-b607-499e-be73-10def40ddad5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635912739, "uuid": "0fae06be-ac76-4c1c-a044-a2e2e1e503e0", "value": "SecuriteInfo.com.Suspicious.Win32.Save.a.1387.28890", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c60117b-3ca0-11ec-843c-42010a9c0014", "comment": "Malware payload (Kimsuky)", "timestamp": 1635941891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941891, "uuid": "18192b2c-96e0-4696-97b9-25dc8e789234", "comment": "Malware payload (Kimsuky)", "value": "c019e4bd1d192e08c56135a501a828fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941891, "uuid": "acc14311-0b90-495f-9c6b-233c57885795", "comment": "Malware payload (Kimsuky)", "value": "db88dc539bccce8c30e3ba6897171989c9a340f23075c614f3c5a73ae0160db1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941891, "uuid": "0ab8c061-7758-429a-96bd-423df7829afe", "comment": "Malware payload (Kimsuky)", "value": "9627869159bda2174f75ed5ae41b487f91b0320e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941891, "uuid": "5442a9f3-a11e-43e2-af97-393e79cc2f34", "comment": "Malware payload (Kimsuky)", "value": "7f94d6560811b3e2bf494b6d5919744318848eca68e35ee982f885552f3e5d3efeef36c82776f4b39027eb9369e471d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941891, "uuid": "76a841f9-b6cb-4c2f-b4b2-cbeadbfd838d", "value": "T1B5356CFB20D523BEC177D17A8283AD5FE66F753A1625D9EF429802120C12E817F69F18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941891, "uuid": "3d4326f4-c6d9-4ff9-bba2-363243df3785", "value": "5ef8469bc3953b7272f3e742cac8cbd1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941891, "uuid": "520f62f7-4dc5-4c12-af6a-b242add52d45", "value": "12288:K8ZkKlgrN3uHWZr41gIouuApAhnrUQZXV01RIjSzLs8giskvuh7kVSwY:9ZkBc2ZrtIv9CwLHXFvXVNY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635941891, "uuid": "7ab2bbc8-24e2-46d5-84c1-f4c957115b8d", "value": 1117130, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635941891, "uuid": "e69dd6ce-132f-4674-82e8-4aa5f524af3b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941891, "uuid": "c378c4de-a026-4ada-a15b-83665ac70341", "value": "db88dc539bccce8c30e3ba6897171989c9a340f23075c614f3c5a73ae0160db1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ae45339-3ca1-11ec-843c-42010a9c0014", "comment": "Malware payload (Kimsuky)", "timestamp": 1635942371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942371, "uuid": "70a461ae-af64-4799-b870-0a2a810d01c0", "comment": "Malware payload (Kimsuky)", "value": "6e4b2f707b05fff585fc60a57a430b2b", "object_relation": "md5", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942371, "uuid": "412cc35a-a19a-4151-87bd-2817b8fd5c96", "comment": "Malware payload (Kimsuky)", "value": "dbda86606e223a7463d91098a7f0b23b8e2cc27fdc41b69a7534611ab73c5ac6", "object_relation": "sha256", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942371, "uuid": "f88a515a-a1e8-4af4-9591-0c0d8b1f6304", "comment": "Malware payload (Kimsuky)", "value": "f00616ddf8c4ec27a60172ffe6145f74547447c6", "object_relation": "sha1", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942371, "uuid": "ddb710e7-1015-4998-ab90-4121eee62aa6", "comment": "Malware payload (Kimsuky)", "value": "0f51559af122fd92744c1e93024dcefb2da856dd132c8b1a04dbd279b7dd14ad979b6e4d5d6255a0520feb03d3d5ca74", "object_relation": "sha3-384", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942371, "uuid": "8d83d8ad-942d-4232-a40e-0ef87757e15a", "value": "T1A6137004B692DE5BD6941D320DDAD6FE7738BC029E45832B3088777F3D7EA988D02685", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942371, "uuid": "f70c1ad0-4a1d-4f4c-9e41-ed3d7f05e1bf", "value": "768:RSRab4ACBGjL2ane7iTVg+BR2rllzPgUfmQx4q1DZhi:cACBGjL2anIkengUfmG4WC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635942371, "uuid": "9152533d-d54c-4776-80eb-ae06a2e5de72", "value": 42496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635942371, "uuid": "ec7d0f23-981c-4eba-809b-28dec3d784ed", "value": "application/CDFV2", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942371, "uuid": "06e38f4d-c57e-4b52-8ae9-ece27d431253", "value": "dbda86606e223a7463d91098a7f0b23b8e2cc27fdc41b69a7534611ab73c5ac6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65da6139-3cc4-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635957476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635957476, "uuid": "78f2db61-b751-4a53-8e77-320b9a7b9d3c", "comment": "Malware payload", "value": "b114af93835ca62fcca0519f28096723", "object_relation": "md5", "Tag": [ { "name": "CRMP", "colour": "#AF02CC", "exportable": true, "hide_tag": false }, { "name": "Dragsteal", "colour": "#A5F30A", "exportable": true, "hide_tag": false }, { "name": "SAMP", "colour": "#C06F87", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635957476, "uuid": "5c614ae1-e22f-4fc7-b633-fc7da27f33f8", "comment": "Malware payload", "value": "dc7274ff726791c52c01cf6bc62b3cd349ef2611e0a794ed772407e7be01044a", "object_relation": "sha256", "Tag": [ { "name": "CRMP", "colour": "#AF02CC", "exportable": true, "hide_tag": false }, { "name": "Dragsteal", "colour": "#A5F30A", "exportable": true, "hide_tag": false }, { "name": "SAMP", "colour": "#C06F87", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635957476, "uuid": "ac12201e-c53f-4b5a-8cfb-3ce4fe36f5be", "comment": "Malware payload", "value": "d83f1109b138015114aef91d872fe8193bbf349b", "object_relation": "sha1", "Tag": [ { "name": "CRMP", "colour": "#AF02CC", "exportable": true, "hide_tag": false }, { "name": "Dragsteal", "colour": "#A5F30A", "exportable": true, "hide_tag": false }, { "name": "SAMP", "colour": "#C06F87", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635957476, "uuid": "5419e898-f5d3-4185-b873-53eb3962ec03", "comment": "Malware payload", "value": "4413313097ecb355b1cdbc76acec907a47df870c2f8334768bc20f59e6ab24ab50356fc041046844cd9d2f6967bace1d", "object_relation": "sha3-384", "Tag": [ { "name": "CRMP", "colour": "#AF02CC", "exportable": true, "hide_tag": false }, { "name": "Dragsteal", "colour": "#A5F30A", "exportable": true, "hide_tag": false }, { "name": "SAMP", "colour": "#C06F87", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635957476, "uuid": "36028872-5acd-4121-a88a-e0e45beeb0b0", "value": "T112724C81F50A4AF3D7A80475B42547324A6DEF703FA420E7BBE70A68356A1D3B439B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635957476, "uuid": "00e2f715-52fa-4ccb-8ea1-d79e45cb2490", "value": "192:lpXqVKdFSZBAi3brDpy2kdg56zdSHNYYlLdYcLfKdNGViR08Jf1MDZdigMjkbhpP:bX2KnSdXpy23wAOYldiReVggbhpEqX5Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635957476, "uuid": "d556e98c-c490-42c1-8e6b-f0cc5ac3d3d2", "value": 17068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635957476, "uuid": "8034d255-84b5-45f0-8bbd-c6c16f9fd4db", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635957476, "uuid": "67f367a5-51ad-4cfc-820e-40a90b3f0c6e", "value": "renderfix.cs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dae8dd7-3cd8-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1635966159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966159, "uuid": "4b284c50-f55c-4818-8b07-c3e9e192d76c", "comment": "Malware payload (SnakeKeylogger)", "value": "0fe54b2c63c6f5b30b4e3cbae232757e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966159, "uuid": "0069a9a3-27f6-4a06-898a-ad3b2b290276", "comment": "Malware payload (SnakeKeylogger)", "value": "ddd414a1ebb3176dd7d5e612afff1a0c9ddddc21c3be42cc6b137659266e1061", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966159, "uuid": "197157c7-afa8-4665-a578-5ff097a28bc1", "comment": "Malware payload (SnakeKeylogger)", "value": "a17d20734e9bc5ffc007779d51806b6ee6e3ab84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966159, "uuid": "39a5ada7-f8ac-470e-bf91-05daa69de114", "comment": "Malware payload (SnakeKeylogger)", "value": "7986106cd992b3e6bd978c4c9f0c9a607980a0f144e1e12a1a1a5272224f7b2b48e8c67e48d4e92457a5e641c31a03a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966159, "uuid": "3260aac9-f365-4582-9a77-bb61b20aef9d", "value": "T18DA4DFC57FB05A02DD189BBD826D4F0546373E756BE1E20ED94178E3ABB37891802E27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966159, "uuid": "a2e58b3e-7973-4e3b-8591-489562694090", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966159, "uuid": "d392e559-9a4b-4ccb-8537-fa8ebdab48b6", "value": "12288:Vf7KAzoYGUcSc8oKaKfr6ijL1ONmeeKW:VxRoh8r6ijL1peeZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635966159, "uuid": "05d92c76-24fd-4cf5-bafa-9dbd45d619f5", "value": 475136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635966159, "uuid": "03d4bd32-e689-466a-9e07-fe405a2b73e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966159, "uuid": "878af8e4-1551-4028-b6fe-e46c71992307", "value": "JgMPkapvII39TwZ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09e5958d-3ca0-11ec-843c-42010a9c0014", "comment": "Malware payload (Kimsuky)", "timestamp": 1635941860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941860, "uuid": "1f78c9c3-943e-4f79-969c-38c76fed7767", "comment": "Malware payload (Kimsuky)", "value": "2c143271dc4e8da1d3f94bb15df49ab3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941860, "uuid": "92e0e85f-5cdf-4d21-83c0-e57a440b98bc", "comment": "Malware payload (Kimsuky)", "value": "dddc57299857e6ecb2b80cbab2ae6f1978e89c4bfe664c7607129b0fc8db8b1f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941860, "uuid": "12e24e86-373c-4722-8d8a-fa6262bc5838", "comment": "Malware payload (Kimsuky)", "value": "f437544e14ac6389806fdee8a4ea335b3d7dfe2f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941860, "uuid": "6d4f77a7-e089-492b-b2ef-c98e654d9830", "comment": "Malware payload (Kimsuky)", "value": "51b5eeec5967a5cb59d764136e3a6f533356f8e6a36f8167f9593dfdd5d2e69b3a3ed9ffc06b8c7c4dd29496f846365b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941860, "uuid": "eff789b0-651d-4112-90d9-4024e4f3b8bd", "value": "T1885507A2750B7ACFD48E27789653CF42FA6D47FE47350D02E86974BA7E63C811286C24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941860, "uuid": "20c6cee0-d24b-453f-b300-6e37a4cf167c", "value": "aab7cc4136ecab3783f1a388b2c0dec8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941860, "uuid": "8d6c3d81-7fcb-4024-93ad-6a0154a5dec1", "value": "24576:aEwI02vJ4ww/0uzjQ9oAn0MgsY/1clm90LZTNbWP8vDMogJHVlfzzDfk8:axI02vbuHQWPMgsh8B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635941860, "uuid": "0b9c25f0-43a1-411e-bb0b-06ce9093ddda", "value": 1306563, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635941860, "uuid": "2e6ebe5e-7ff7-426b-82c6-8534a97a879f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941860, "uuid": "140ccbcd-35d2-4f76-8950-8a756f52c4d2", "value": "dddc57299857e6ecb2b80cbab2ae6f1978e89c4bfe664c7607129b0fc8db8b1f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e44c97c-3c83-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1635929465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635929465, "uuid": "5dfba232-e431-4b4e-9bc1-b70a303b0771", "comment": "Malware payload (RemcosRAT)", "value": "4788eb381aa544bc67389752310a644a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635929465, "uuid": "cf96b25f-73ed-4765-ae39-f43c1078210f", "comment": "Malware payload (RemcosRAT)", "value": "dde43498a0fa2ea948176fb8ff8a46ba80269cb4e5850e846387b12332d8c7b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635929465, "uuid": "7554fb27-2dba-4721-9efe-c633a0738e01", "comment": "Malware payload (RemcosRAT)", "value": "f432e32a7a56a47783e3e587c1544b820d1224de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635929465, "uuid": "bf2bef4e-6db8-4769-bfb0-3c972c36da4f", "comment": "Malware payload (RemcosRAT)", "value": "2b36d7f9f57423140104a7336e310dd95c8854ce48205e349146fdf7a906c12f5782d2b2ef1809f31ea32d0b9838913f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635929465, "uuid": "f7a45d74-06bd-44d3-88dd-dbe0c6364b02", "value": "T11AF40181782E8B60C31DB7F564AA8310B7B86E3E5402E64E2EDAB5CE05777118F70E47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635929465, "uuid": "ecc347f4-e913-4c53-b5bf-de00e1910110", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635929465, "uuid": "2cd4e37b-6d20-4cec-9222-38400a1f9224", "value": "12288:0SIbw8eGmOAJ3sVCqITEgkWVHegSjfjQNLL6wy8iNEkmUTpYgfsI8evvzpOpMJzZ:0Vbw8eGPAhlYgkSHedjjQLGwINEkrVBV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635929465, "uuid": "df5b0b66-e34b-4621-90e1-6b6a8d9fc554", "value": 753152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635929465, "uuid": "9db24ade-a28d-4b00-936b-743112fb04c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635929465, "uuid": "26c34e15-bd4d-4b35-9d56-0800c6669825", "value": "Invoice #20211102.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd5d5052-3c9f-11ec-843c-42010a9c0014", "comment": "Malware payload (Kimsuky)", "timestamp": 1635941731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941731, "uuid": "26610ee7-c61a-4671-96c8-49c2a702e389", "comment": "Malware payload (Kimsuky)", "value": "8f5a219dfd5bed9db8a6fc423f5fdb4b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941731, "uuid": "d3c65380-64a2-4165-80f4-e593acf9eaab", "comment": "Malware payload (Kimsuky)", "value": "ddf5f01df6faf829d9fe711d9f8a5b279f7a1b99835164fa8fb1f89cb74738cb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941731, "uuid": "302e1efe-7ce7-4ea0-8dee-6a96053a469e", "comment": "Malware payload (Kimsuky)", "value": "69c57702e85491ec5392fffc0e695bd4ea67b577", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941731, "uuid": "ac57c5c1-2d53-4f15-b038-732c8ab887c9", "comment": "Malware payload (Kimsuky)", "value": "b79900bb8b4c0feb82fcaa04e44f09bc362778674b7c28d64c2683ed3e07aa047dd19b80b0f5af3225423c54a265bc5f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941731, "uuid": "abe3eef5-8308-4102-81a5-8d201456dea4", "value": "T1CCC52BA2B905B1CBE4DF17B89967CE81681D07F80720494399EDF4BF7D67CC02A96C29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941731, "uuid": "c6c312e3-9d7f-4856-b469-4187eac50a85", "value": "869c528228af8b0b0bb001808e96ee3b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941731, "uuid": "7fe902f1-8119-4e04-932e-3ca51a33582e", "value": "24576:i4HExNUAHIsT8JaIoLjMgycTD+1iAxyEX2SHUlXKJgJ9Fnx1flhnb05/oI4AEpt4:Tvso0JLjMoD+EeXYcg9bAYwwU9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635941731, "uuid": "569e3fa7-c09a-4c2e-9a19-7b9f4deb7464", "value": 2687814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635941731, "uuid": "803601ec-8283-45b7-890a-dc8f6834d28a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941731, "uuid": "1cb9f914-1bfc-4016-bc5d-07ec4d2c8c97", "value": "ddf5f01df6faf829d9fe711d9f8a5b279f7a1b99835164fa8fb1f89cb74738cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0957408-3cdb-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1635967506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967506, "uuid": "e91737bb-1e49-471b-b96a-1eece57790a7", "comment": "Malware payload (NanoCore)", "value": "049c473864507c6ed0e446d85c2390a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967506, "uuid": "391619aa-3323-4335-89b0-79991c7ff052", "comment": "Malware payload (NanoCore)", "value": "de85e766c15d1b3910453571db1cf2a12edd88e53432ea87ed8c388263baf140", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967506, "uuid": "8f5a5825-9691-47b4-8525-0e7f496c5c86", "comment": "Malware payload (NanoCore)", "value": "5061a34937c416bb99c7dcc7bd8ce1e001d41ba6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967506, "uuid": "a2aea179-a8b9-4724-b7d6-ab2fdad81461", "comment": "Malware payload (NanoCore)", "value": "618e215808665878f86264de6da33d6a7cd131a8dc395ff15c4afa60f2d38950a59858b67009702feab911e00c20728f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967506, "uuid": "1cd501b7-a805-4db4-adf3-38046a24ac08", "value": "T138A4F086323E5B15CB2D77F1A0A693507BB17C3A1852EA5E5ECA71CA09737414F32E83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967506, "uuid": "4c249399-713e-4f6d-9984-5cadfa85131d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967506, "uuid": "dbf905eb-a241-4311-8366-a22b9a4d57e8", "value": "12288:iCIbw8eGseNourNLRAUuCYAYsPAbsUZ1roTA5bHwjFwBK1:ilbw8eG5Px1nYAYsksS1roTA5uwBK1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635967506, "uuid": "69317d29-ca70-4733-bb71-9d684df0155e", "value": 489472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635967506, "uuid": "07f84f9f-f3c1-4a3c-87b0-54986dd45c38", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967506, "uuid": "b4ee5288-98d3-4679-96a0-a780decfd896", "value": "049c473864507c6ed0e446d85c2390a2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25f74ff0-3c75-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635923438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635923438, "uuid": "62ea8bdd-e7ae-41ed-a0bf-e83ed32dd824", "comment": "Malware payload (RedLineStealer)", "value": "0221ec63758e51916b6aca8aad5d2847", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635923438, "uuid": "f4c70d68-d693-4657-833e-2fad7ea7b735", "comment": "Malware payload (RedLineStealer)", "value": "dea7bd97c08781d8cb2a2fd40493c9976002b370f64ed0c89532bc6d560de314", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635923438, "uuid": "c6c36afe-23c4-4298-86b6-50cf5d252622", "comment": "Malware payload (RedLineStealer)", "value": "6df8ad51c9b677bcab5507a1d7ec470d520c6024", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635923438, "uuid": "b933d34b-0499-4cea-aaab-276d558b7b12", "comment": "Malware payload (RedLineStealer)", "value": "ba815479010c686577df4c69453bd8c4a633f6b8c648d7be167bb25788a919c9c5d4bd5ff64eeef53f6fe8ef04003fc3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635923438, "uuid": "42c29012-1710-4dfe-8d5c-487f84235e73", "value": "T1C8942528687FC01985E3EEA52DDCA8FBD99A55E3640C703701B4633B8B52B84DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635923438, "uuid": "1423a6f7-3a0a-400a-bb79-7fc54a8ad08e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635923438, "uuid": "0ad1498d-1d7f-4ebb-86fc-49593911bf5d", "value": "12288:2y8klT97ix5FJsmjht/pt98lua4dR1HKWqf8hKt3hfOEtiaj6PDY+XZGbmmQ:psjhDOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635923438, "uuid": "506ec14d-0c1d-4350-a5b0-bc5757b1df42", "value": 446976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635923438, "uuid": "43fb976c-5c5c-47f6-98e4-193938106a2b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635923438, "uuid": "be8c0177-b31e-46f3-ac7f-a5911acc31e0", "value": "DEA7BD97C08781D8CB2A2FD40493C9976002B370F64ED.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "086b396d-3cdb-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635967197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967197, "uuid": "e1bc6fe3-1f98-4c84-ad25-e26f4a773097", "comment": "Malware payload", "value": "1b0567aec48fecb29e3c14bc0fc11442", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967197, "uuid": "58ed7a7f-f9ca-4cc0-acc2-aea04c0643e3", "comment": "Malware payload", "value": "def3f7c0e60da7b3196927148ab1d65f02926213a2be74a5a578251e91f8efe8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967197, "uuid": "3c26430e-e1e8-4322-8c12-ec8f483520f9", "comment": "Malware payload", "value": "4eaa89dd4c0d431451e0584d8be5fa7032ad30f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967197, "uuid": "aa7ee44d-9029-4868-adf5-75392fcd87b6", "comment": "Malware payload", "value": "5fdc750de039268f6394d723437a984b29d7d4c28171adcdde157a9e4929a9f416abaf37f6997e633b63557a09aa95de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967197, "uuid": "cd9e52c6-8e3f-4be9-ab38-10d438e2a611", "value": "T16BA4D010A7A1C035F1B253F84AB693A9B53F7AA06B3850CF12D466EE5734AE0ED30717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967197, "uuid": "f2f6644d-38c3-4531-9500-37e95727cea9", "value": "7e51d9833813c1a3fb57baba54855909", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967197, "uuid": "df45a3ca-2287-4bc4-b79c-b7c5891b0076", "value": "12288:DgLVv7TvYIjgSSDq4hE8aY6cUdlru64aLOHEHO:kLVzTvYIjgSSDq4q8aY3UvDO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635967197, "uuid": "60ab5365-b969-405f-954b-564261173372", "value": 479232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635967197, "uuid": "8af80d43-49c3-40ac-a2e9-b6106175ea38", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967197, "uuid": "1404ba9a-745d-48ef-ba6d-02d1278ba05c", "value": "1b0567aec48fecb29e3c14bc0fc11442.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac612c1e-3c78-11ec-843c-42010a9c0014", "comment": "Malware payload (LimeRAT)", "timestamp": 1635924952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635924952, "uuid": "4d4df163-54ab-47f3-8dae-67fb61af80fe", "comment": "Malware payload (LimeRAT)", "value": "2e45c3146bebd87ccef96e054374ea11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635924952, "uuid": "4fad0a5a-b5e6-45f5-ac56-da2567d34db5", "comment": "Malware payload (LimeRAT)", "value": "df6fa5b55c8196df0a53575cd26f5a7e53146899d41ab1a1a3acdb320f185d1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635924952, "uuid": "df32d651-064d-4646-b785-a4771a2b4b74", "comment": "Malware payload (LimeRAT)", "value": "f2be6622242c311beb54f984c2fd85b865c2431c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635924952, "uuid": "764b702e-3d25-42d8-93ca-0ec0d9996cd1", "comment": "Malware payload (LimeRAT)", "value": "e3eb55fcbee0b43b5d6acb08483a1dbb7f507a5ff1d538e249874d987254df32aa2ff38f502ab87c89e36b3365ae3286", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635924952, "uuid": "d93db352-4571-44a5-b99a-cb97213b715e", "value": "T1B5E49D3836F78910E1BD997180E6A61543FAE4076933E36F1DC652D50F22B81CD8BE9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635924952, "uuid": "2d3129f0-4b83-43e1-8eb9-031a6acdf493", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635924952, "uuid": "13d4e40a-fa0e-410f-b170-db2ab44573c2", "value": "12288:hReV5q41y0yHUUF1/A/ZMvGTsv+wD1IRJ+ZN1JBCGoaK8Ownq1o8:Wjq510U3/SOvPGkZ13oazU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635924952, "uuid": "cc2fab74-67f1-4a41-b4d9-e03ed211f18f", "value": 660480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635924952, "uuid": "260cc332-8d74-4a13-9c5c-9e1425761236", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635924952, "uuid": "e6418f69-2006-4862-9b43-5566eeb9d021", "value": "2e45c3146bebd87ccef96e054374ea11.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5ca0a75-3c93-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635936645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635936645, "uuid": "521371b6-61dd-4d39-ae84-c65f0e81a229", "comment": "Malware payload (Mirai)", "value": "9571142eeccfafe4fc8f8ced3a83cfb2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635936645, "uuid": "99afda1c-8f57-42b0-bd7b-cbc6590c7f8a", "comment": "Malware payload (Mirai)", "value": "df8f726729429fdbfe5d94b3427c10e601eaf82e54d07e6daaf2b20d0500f494", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635936645, "uuid": "64f994ae-e7fb-4395-a8d8-9090f677cb2b", "comment": "Malware payload (Mirai)", "value": "6ef0a78f0b2d8657a6f594b0df6838176124de1a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635936645, "uuid": "6b647af1-5fba-45b0-8dab-7e16230323e2", "comment": "Malware payload (Mirai)", "value": "405027aa9cbaf3570ba8f63728be06ed3b7566815cd2d74a6d5b3631c39f71c64ecd491bc466b315bf642d0aa0bb9d6f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635936645, "uuid": "1f6a4d83-d014-4c6c-b567-7d3a0791c814", "value": "T14E433BC4A493F8F6E811083C317AAF72AE77E17B74349EAAD7D56433E905A02D20674D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635936645, "uuid": "01f737f1-447a-4aeb-bcfb-2038b7cfce85", "value": "1536:rWS+tyNXbzwiX/I+4cSWF/cOhL3MzsdD7O:T+yNlX/V4cSWF/cWcgN7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635936645, "uuid": "0388b5fb-da93-49af-a052-c4827444fdab", "value": 58352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635936645, "uuid": "4205d72f-7f71-4813-80f3-50058512c37c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635936645, "uuid": "8695127a-b00b-46eb-a872-44bc2536d5ca", "value": "b3astmode.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8e1f547-3cdf-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1635969185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635969185, "uuid": "780d598b-7697-455f-b9d8-048b4de7fd50", "comment": "Malware payload (Dridex)", "value": "5d1c6c264f92282f1290dd0230fc89d5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635969185, "uuid": "fa370ac4-c7b6-49b1-9635-5eba8efb032f", "comment": "Malware payload (Dridex)", "value": "df9826201eea584e4e212f281f6f20677bb8cfebd9eb4e47bcc381b1edba698b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635969185, "uuid": "30a529a2-761f-417e-ae33-c7a908e9059a", "comment": "Malware payload (Dridex)", "value": "4805775f9a20c3e033d5a94ec860a0ec085ae43d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635969185, "uuid": "a62c6d82-d024-45a1-814a-001d731684dd", "comment": "Malware payload (Dridex)", "value": "7ae623357298426e94d044180b219219033bab3b348a1eb74e913dcb41ffd32870ffb77300fd32ff9c6a8b4126940f96", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635969185, "uuid": "eb586979-0f64-4691-83d0-062a089c4537", "value": "T16193025AE585B414C1BA58FFC64E1CF29936060D0C87FA2F79AC13691AA40CFEB5F11E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635969185, "uuid": "dbfaebfa-33fc-47ad-902b-3966a3594ebc", "value": "1536:8CWzPFFxgFzx5YVqHS2YzayhpSW4vHR05Q4r5UZKUbNiLjR4XkyCzYD/Km/b4s2B:832FzIsj8aipSW4vHREQ4iZKUbNiLj7j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635969185, "uuid": "f58e0191-da8a-4277-834a-109090df000e", "value": 96357, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635969185, "uuid": "3acecb96-fb28-4def-b188-8316eecef625", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635969185, "uuid": "cfcba9e4-e2ab-48ed-a049-e946995ffe0b", "value": "Invoice_2730.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "575a67ac-3caf-11ec-843c-42010a9c0014", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1635948432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635948432, "uuid": "74c0d33f-2fc1-4d45-a4e7-c9dd60b4a8bb", "comment": "Malware payload (AveMariaRAT)", "value": "c9ffcc95e05fbb7fec01f74e10b97a9a", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635948432, "uuid": "da0e0df5-088e-4fc1-be12-2a0e498a55d5", "comment": "Malware payload (AveMariaRAT)", "value": "e08aed32432f631416a9fac897b14fd25a31d49c756483389392a3c7b9714220", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635948432, "uuid": "ce5452d5-aa8e-4d0d-8c6f-98facbc0cba2", "comment": "Malware payload (AveMariaRAT)", "value": "77a26979b7555adeef7628d9e97e1cbaa0f8aa08", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635948432, "uuid": "caaf1316-e5aa-4205-9f41-6859e1056463", "comment": "Malware payload (AveMariaRAT)", "value": "1f84617d45ac1c80d606c65abb71f8a343e855cc435700de33d0868ce03d72b85efd8d72ad045d2b91a7f741dd7f5719", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635948432, "uuid": "5ea16b2d-d913-4057-b27c-2961a55ce1c4", "value": "T1ADC45B52785C8211E5777378E77DC41003626C9FA611DA8C2B5CFEB7B6F5A832E0E81A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635948432, "uuid": "45eb7d0a-2f6d-467f-8b90-3407738d2d80", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635948432, "uuid": "9d1347d9-3a3f-4f52-bc3c-a36f04c4c42f", "value": "12288:J9+RHV/E06BK9TXSySInLJolX0VJweTl:J9+RCezFSmLwCweT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635948432, "uuid": "44071d09-4324-4aab-ad67-f06ee4ad8c6e", "value": 544768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635948432, "uuid": "94cdbf41-7534-4111-afd6-112f112ad8b3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635948432, "uuid": "416661b9-4828-4cb3-9eec-19873e779503", "value": "New Offer to Thalassa Imports nv-sa._200317.xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3f9ea95-3cd9-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635966707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966707, "uuid": "000d1744-9daf-4aba-837f-38f388f0f924", "comment": "Malware payload (Loki)", "value": "0155d11a6130dc32691e27b0900ecbc5", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966707, "uuid": "3be0c1a5-354d-4cde-843a-20bac2937ad1", "comment": "Malware payload (Loki)", "value": "e14bd4b3b694e67b8d333f6c9e7097e60f86aaea95877eb23be6161c247484a0", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966707, "uuid": "5d4f7b5d-d69f-4a82-9f69-a93d208e5c5e", "comment": "Malware payload (Loki)", "value": "0c655d125185ceb5dda9e4a1654298c682d84246", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966707, "uuid": "e9c65154-98e0-4ccd-9268-eea9aaf4fbd3", "comment": "Malware payload (Loki)", "value": "72a056fb40e55746868f9954aeb5cd091af7bd873210f829306c39cb847d78962bb80e022dfcc185d4d39beb0dd9bb8e", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966707, "uuid": "52355888-1449-4dfb-9502-6be016fcf2d2", "value": "T164141280361303D9E5F7FA35266A6FA65F0BEE4637AADD7620E1B4FC077092126F8411", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966707, "uuid": "cbe7b847-2c89-40cd-85c5-06851a950f06", "value": "3072:CeG2URX9dZpopV2j8clMmY8hLPO1EZN4ZzCzJkSTbhtzAbMglTQaMVHQK3i3UBXL:CZbSZclRPCEZN4inHzq52DFBXm9q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635966707, "uuid": "0bcfcd8b-eee6-4f36-ae7d-d51f33c3ed2e", "value": 206440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635966707, "uuid": "eae17764-b6dd-4c0a-9cce-d15b41648804", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966707, "uuid": "f0a192fd-2e78-48fa-9c03-61c5c680e3a9", "value": "GSS-SLF-HK.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfa4577c-3cac-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635947345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635947345, "uuid": "d5be7647-3519-4bf6-8474-6b3042f6233d", "comment": "Malware payload (Loki)", "value": "b34969e07fc94a106aa8a7f6936cc3d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635947345, "uuid": "04b45220-02f9-4e6a-b1b6-2e7b5ca2199d", "comment": "Malware payload (Loki)", "value": "e163f4f44cfe7c95efe3ff13b7471187fcd1d870fc1346e0c574e57a61ed3985", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635947345, "uuid": "daab7e7e-7bc4-4665-ab2c-b4d4488e5f49", "comment": "Malware payload (Loki)", "value": "803ce21b1eb659bc61870014105fb3513eaf5704", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635947345, "uuid": "ebc8f00c-5201-4b7e-8c77-e03b42e62d51", "comment": "Malware payload (Loki)", "value": "b7e4375d0ebaf09d89a4e2f5da3ac4614255800578ece9fd8332763123a2917affd9653ee51fc9a4c185fdf878a58200", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635947345, "uuid": "94ac5409-1eb4-407f-99bc-2634ab2c4d7e", "value": "T1BB746B4673174B0AE428BFB6DFB77B210720F7B25872971B92D5B92E501E6E639C1302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635947345, "uuid": "6c26ea95-485a-41ac-94c8-0fd77fcc13e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635947345, "uuid": "aebe6be6-41e7-4cbb-92f8-3da1c0fb80fc", "value": "6144:yRbcAdlJ8DrED9YmhS4ZNQd/0qV/rfHW/hPtoXuOcsC5uztV2:yqY8DIpBhdDQd/0azHAoeOcqY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635947345, "uuid": "a765d80f-26dc-4f2f-804a-68208066c503", "value": 351744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635947345, "uuid": "656050d6-dc92-4316-9d0d-123c3ce0b060", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635947345, "uuid": "e152ea06-e193-46f3-a46f-7b683f17618a", "value": "COMMERCIAL INVOICE BILL OF LADING ETC DOCS. jpg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73230990-3c82-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635929151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635929151, "uuid": "02449b24-60cc-4e4d-95db-61aac1761d85", "comment": "Malware payload (Loki)", "value": "9930a1fde27d1e35b5c4c5be831059e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635929151, "uuid": "38c381fd-2f4b-4c88-8047-51bd7144f5c6", "comment": "Malware payload (Loki)", "value": "e1ab7cd1f07e7ad282859e1921cbb763d46d450f8e8cd65bad26b5a66308e750", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635929151, "uuid": "5b845e50-5664-4c75-95cc-1481ac2c13dc", "comment": "Malware payload (Loki)", "value": "97bd2362890627355397552bd6babe26103c3de3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635929151, "uuid": "52cd8493-b557-4281-bdab-775e8244ca8c", "comment": "Malware payload (Loki)", "value": "de4102c0e7a0a92848e81a4d14369b99dce1315311aeb2a78c1a4f8cf6d1d6b932623ef8608dd97454a08ddba5232572", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635929151, "uuid": "4b33f96b-51de-43e5-ab6c-1ff87b4ef62c", "value": "T195A31A42B2A5C030F7B74DB2BB73A5B7857E7C332D22C44E9352459A18215E1EB7AB13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635929151, "uuid": "97124355-8d0d-4bf7-abaa-bfc4829dd434", "value": "0239fd611af3d0e9b0c46c5837c80e09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635929151, "uuid": "beacac70-3d6b-42fb-be33-74c0e43f4bf1", "value": "1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635929151, "uuid": "eeb5d6e9-870f-431f-ac9d-07c42b6af225", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635929151, "uuid": "ec7f2332-08aa-4078-b453-eb1fd533ca9e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635929151, "uuid": "e0bedaf5-039a-4884-845f-4e9601cf8151", "value": "9930a1fde27d1e35b5c4c5be831059e4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac80f750-3cd9-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635966614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966614, "uuid": "61ad6616-3145-4b86-8187-e3d9ed32829f", "comment": "Malware payload (Formbook)", "value": "0932ca4178bdbaa6f66f9229a87fda8d", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966614, "uuid": "4d4aa462-a6f1-4db3-bf20-50016ba58be4", "comment": "Malware payload (Formbook)", "value": "e1bb1bcac492f414b5c80348b6194462bbf3c6fa03f8b8597842f13d6fd6489f", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966614, "uuid": "6e656d75-0cee-4239-a93a-e4cbe88ac1ae", "comment": "Malware payload (Formbook)", "value": "51edadb95a4b5891e9faa0b5a7dde66270626d15", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966614, "uuid": "bdba88b3-0ca2-4082-96f5-a2f44d6bf015", "comment": "Malware payload (Formbook)", "value": "53765443e7609258ca65eba0c35fca8da4e03a8099379dcc99085f189f583da4847076c19dd6d403c54b1a0b8520ec8f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966614, "uuid": "613a10cd-a144-4094-9292-2697cf06d6d4", "value": "T177141225FE2AE085FD0AF37C4869377687D5FC548C4769167A42F3B3BBF88851880856", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966614, "uuid": "fc283bda-ac85-463d-af70-57b24312f306", "value": "3072:7GMl6sZMtvAz1cNsH0VoDXG+gttg19cvL5/3SUEu1PEbgSK0kP:77lyoz0k0VAXMtY+5PSU1aMS8P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635966614, "uuid": "4258cb60-9769-4dbe-89fb-62bff715b106", "value": 206456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635966614, "uuid": "767ca098-1f15-4430-ab73-0d03bc0a2e79", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966614, "uuid": "f0742136-b281-4599-9025-8b82eafb2d96", "value": "Shipment DOC.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7fd0ee6-3cd8-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1635966177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966177, "uuid": "49a8c755-9bc7-4153-8d94-04136a9f3959", "comment": "Malware payload (SnakeKeylogger)", "value": "fa29967e561c4506c3f0cc4ad0517146", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966177, "uuid": "1e3abd51-13b6-42ba-aa1a-049a7c729f86", "comment": "Malware payload (SnakeKeylogger)", "value": "e1e0dd7528cdad1feded2089b46a8c2d0b15884fac58d0b98dcb57575f50a241", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966177, "uuid": "de8b7504-a2c9-4b72-81ba-a2568e427040", "comment": "Malware payload (SnakeKeylogger)", "value": "458446fcf565bc331f900728a358561872fd052b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966177, "uuid": "069fd228-2a7d-4409-a1a7-cf568b3a9060", "comment": "Malware payload (SnakeKeylogger)", "value": "16270c19d3f83794eec328dabd25e331144a5f56c022a7172e5cfe16d13aa666b891457ce12a10a060805cd0e9c73324", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966177, "uuid": "764db20f-da0f-4eed-8950-48f431791122", "value": "T1F194E006362D8B21C72D77F564A69340BBB96E3A2442E60E2DCE71CE19773118F71E93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966177, "uuid": "fd9b653e-e30d-4d68-a338-7bb2c3e70fa4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966177, "uuid": "3f5cdf54-af81-4e38-910f-1ed733d9f7eb", "value": "12288:PJP+NIbw8eGnDrmg4NQ11ezjGLcHtEfS7pocy31:MWbw8eGnDyg2QjezjGLy+fS7pocy31", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635966177, "uuid": "5a5b4b35-03d8-4b4c-b3bb-f20c76985fcc", "value": 415744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635966177, "uuid": "3ec233ad-ed2e-435c-a54a-ad647769e2d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966177, "uuid": "700ba2d4-4f91-41a0-acb9-4f86fbcfc10a", "value": "AWB 5032675620.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9975a1c6-3cf1-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1635976890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635976890, "uuid": "5d52b39d-66e7-4ac3-b08d-bf4bf9e6d71e", "comment": "Malware payload (NanoCore)", "value": "a9cecdb5866f560e95080e50cffb1a73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635976890, "uuid": "125db1ed-b9ba-4a30-baf2-40a8c6fa007f", "comment": "Malware payload (NanoCore)", "value": "e1e0fc9e88d7704d12f66305f895c3780e56890a75e1484079f5fc136571ebc5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635976890, "uuid": "f809d342-84d5-4e6d-aa7e-8372331af676", "comment": "Malware payload (NanoCore)", "value": "2ddd446d91d8472e8639fd2e05117a12fd6424d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635976890, "uuid": "cfbbf56c-9679-423d-b28e-2a08b7c33158", "comment": "Malware payload (NanoCore)", "value": "adb9e93d818f9fc63370092a76b69d4bc58341c414e746372a12ca27e550d74d8a336a430e59c071d0a4baa695c3bc8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635976890, "uuid": "aa6921b6-df8f-4018-b82c-4b9a44b0c584", "value": "T1808412043FD8BC10D6BE4F37652271505E7AB95BD893E71F19C8408895AABC21B93B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635976890, "uuid": "106a2356-e515-4869-ae0a-64240ac0c45d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635976890, "uuid": "18829ea9-d8eb-4577-aa45-a9889a63d806", "value": "6144:pfw2t8TuoDjbb7Ub2kGUmW+qtKU586juRrurIuyqr5QpL5vRcuS68n16JdHf:p0TlL7M2kGzW+qt9yRrurcqAfS16Jdf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635976890, "uuid": "95c70aa6-bc89-43b1-b295-fd5e4cecc280", "value": 403456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635976890, "uuid": "a549a95e-ca77-4a0c-be17-68eaed302206", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635976890, "uuid": "4faf75d5-71e6-4463-a6b0-e2851b210353", "value": "a9cecdb5866f560e95080e50cffb1a73.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1eec6d5-3cda-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635967160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967160, "uuid": "881fed6e-1266-4bc7-bf33-b7196319bea6", "comment": "Malware payload (Formbook)", "value": "9cdc6fca894d41cc415e6810793212a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967160, "uuid": "fb965367-b1f6-4faa-8949-b0fe060a02e8", "comment": "Malware payload (Formbook)", "value": "e1f8c7d02c06ad8a4d9a2e46a9c9d73e8cb95c854ca4c0558ae8c83e11f8c63b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967160, "uuid": "537c85a0-69f1-42ed-add1-87d2def627d4", "comment": "Malware payload (Formbook)", "value": "1282eeb0c654071d1a5a25235c27d4be8b9b4aa0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967160, "uuid": "c42accb4-8f21-4761-8fa3-aab904ddf9fb", "comment": "Malware payload (Formbook)", "value": "8b1f83498e53095cbc9dadad3e45ec75f6626ffd6112cab81b1d57925a0e0c8f287a48a10294f0ef52d4ae0e69902def", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967160, "uuid": "200826f8-d27a-40cd-b9cd-906f0e327c5c", "value": "T159D43881200ABB25C6192BB17799C1095F776C7AA9C2C10F39D57DFA76BD20CCB2352B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967160, "uuid": "f1aac319-cc31-42c9-b386-a2a6ae478d72", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967160, "uuid": "ea409cbc-709e-4e67-b1cf-6119adf9af1a", "value": "6144:2IWD7MbwN2s7GQ3R6V01tYYl6HGptBoeqB46fNEuFJaighKRn8AHUExKoFT3YwdA:2zIbw8eGA0YlSMuzaipRt0Czhf1xw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635967160, "uuid": "60826b67-17fc-4c86-8da3-526e80713f90", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635967160, "uuid": "e28090c6-4051-4b94-b09d-5d34c27307f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967160, "uuid": "6948ce5f-5d63-4729-bedc-2851133d2b0f", "value": "9cdc6fca894d41cc415e6810793212a7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d9c67d1-3c48-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635904204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635904204, "uuid": "91f75894-a078-4ba6-ab69-bbf6d5d002ee", "comment": "Malware payload (Mirai)", "value": "fb726c3b967f6532ecfeaf30cac0efb7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635904204, "uuid": "59edfd28-efe8-4e47-890d-8db8b1bf99e8", "comment": "Malware payload (Mirai)", "value": "e230fc50341c9336b4c6d44d90034d3ee4305cc98871a2bed6b5339b5e99082d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635904204, "uuid": "cbe97dae-94ea-4d4d-92f5-763b98c29b7e", "comment": "Malware payload (Mirai)", "value": "b4b37a195040d00e76b2a258b0186ea075bf9ae7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635904204, "uuid": "b2b5ad8b-e060-4180-a0d9-82e4e0c2e214", "comment": "Malware payload (Mirai)", "value": "77a6a820cf11f52bfd463a1f667975746cf278d45fb2ab7f206063743dc23e31b91fbf94873a5250dfa8de5ecc0d9ff5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635904204, "uuid": "aeb1d2f7-50fb-4678-8e45-f8720d410654", "value": "T169B2E185D6EF17C3D292C336E0BC565DA2B61AC00747450A2109765EA29760E8BFB3A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635904204, "uuid": "7c5b9544-a2cf-428b-9202-bb8e9b0c3ee9", "value": "768:6/QOC0Yhn6ROHWF09cwNPFCnNBxcLWhch:6/nihneF1wKNBaqih", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635904204, "uuid": "83d94877-e021-482e-bc73-df7a1ad48415", "value": 24728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635904204, "uuid": "a79f705f-7bd7-41f8-aa97-c4afc6d0d8bd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635904204, "uuid": "eb9a3eaa-9e28-497e-926d-268195cdc637", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "166683a5-3c4e-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635906662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635906662, "uuid": "c108a96b-afdd-4596-84d7-3de400571406", "comment": "Malware payload (Formbook)", "value": "57f7628c1b4461c2c4efd20e6fbbc424", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635906662, "uuid": "85c65bd2-1ecb-4ea1-b43a-ab62df568ab8", "comment": "Malware payload (Formbook)", "value": "e268d4fe38c649b81c4b1b556011a7b51f7bcf70c589b679586261f892c56d98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635906662, "uuid": "4f11b796-64f8-4a9d-adaa-c0fd3b30be0b", "comment": "Malware payload (Formbook)", "value": "a6bc5e82ed78d8ca3c2d545c44ebe260712128ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635906662, "uuid": "1553c264-054b-4ddd-92c5-49cd21c442fb", "comment": "Malware payload (Formbook)", "value": "2be8cd17b746da118cc7cc383b36c71f2c0b64b3ae9f66184e47b1815c901e09f1cf53a8d4e96aacc759c587b2f7b7a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635906662, "uuid": "3912e33b-0857-437d-9fe3-ba1ad64aaa0b", "value": "T1ABB4D0C2BBE48912D26A1F3060312C2056737EAE7D18F68F6D9878A735B77C25160BD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635906662, "uuid": "6455058a-6de4-471a-a5db-a87e10abd011", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635906662, "uuid": "cf21d171-096c-4bbe-a69d-bd9f975ce53e", "value": "6144:aBdFuTpRX4C+gaATuoDj8MLXkdNgKWIIkbA/2K8MV4BHYitsAFDgp9sleujVD1Ji:MXupJ0ATl4MLzAb+2K8MV4Bxt5hgyeu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635906662, "uuid": "9cfa95b6-7385-4c50-bdb5-8b53ddd8e13f", "value": 517120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635906662, "uuid": "f736cea1-76ea-412a-896d-6724d87d24d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635906662, "uuid": "f937fccb-c9e3-42ca-aeb3-beb0f0751693", "value": "SHIPPING20211102000.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a052d99-3ce3-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635970878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970878, "uuid": "5455086e-d163-40c5-aeb7-26a163277417", "comment": "Malware payload", "value": "c601a9e2b98b8e0146ca4b435bb42a0e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "filecoder", "colour": "#9867AA", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "Polaris", "colour": "#B94CA8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970878, "uuid": "cce1851c-b003-48ed-9af2-8332ff18e592", "comment": "Malware payload", "value": "e29aa629bf492a087a17fa7ec0edb6be4b84c5c8b0798857939d8824fa91dbf9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "filecoder", "colour": "#9867AA", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "Polaris", "colour": "#B94CA8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970878, "uuid": "72c7acf6-e81a-4693-a293-884659cb834d", "comment": "Malware payload", "value": "d2bb053f990313a8fc30216025c4eeffbbaafb87", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "filecoder", "colour": "#9867AA", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "Polaris", "colour": "#B94CA8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970878, "uuid": "d6e4ac77-b40c-42b5-9afd-7e0b82e5c7e4", "comment": "Malware payload", "value": "1352ac62d75269ff7fee9dc1d59e3bf2acc2721cb32e8592cc0bd84eafa12a18de0c6a095140fd55afd29eefd6de494e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "filecoder", "colour": "#9867AA", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "Polaris", "colour": "#B94CA8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970878, "uuid": "e659f513-c549-42f0-9f4a-7f891dabbe17", "value": "T184263A47F95152E9C0AED130CA668362BA707888473523E32F51FBB92B76FD46E79310", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970878, "uuid": "5c1be554-e44e-4ca0-86d8-de56d23c3bba", "value": "49152:Yl22CyBnkIT97vamrb/TsvO90dL3BmAFd4A64nsfJ4YJ9h8GdFbOatQKhZlCJbAg:MCATyk82t55SGfYEE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635970878, "uuid": "210c2553-7234-43f2-9256-cc1a4581985d", "value": 4569272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635970878, "uuid": "ae509ae6-977d-4b77-8314-45dec5ec0423", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970878, "uuid": "0180923a-e5d3-4e57-a1ea-d8f45cb74d61", "value": "LinuxFilecoder.Polaris.sample", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32cb9e2a-3c9e-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1635941069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941069, "uuid": "11425917-46b0-46b5-84ca-feff9a1d7ae1", "comment": "Malware payload (NanoCore)", "value": "384ebc78e72f2353ee283556d96740ce", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941069, "uuid": "e878cf6e-4054-42be-a5a7-9d3d2bd18ba9", "comment": "Malware payload (NanoCore)", "value": "e3cb3cff1880165667bde2c426821b3fc6090bbd681cddf40f458fc459d6ba77", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941069, "uuid": "2dc0bb39-8c68-499a-863d-183a51a28488", "comment": "Malware payload (NanoCore)", "value": "76e9c0e0ea55d4474f7f63d7f1370643ab9b07b1", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941069, "uuid": "e42b67e7-3dc7-4b6b-b57f-f92ce2cd91de", "comment": "Malware payload (NanoCore)", "value": "ca0e8794581c7a4f84b9e67bde5688e2a5aaf6d3c957a508f9544e9751e59b906e66d363ed259c8ad60490c5e9c75d56", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941069, "uuid": "1d4be68a-20b0-421c-a690-61ea7afc2f21", "value": "T1589556F0AD01D4C1F5BE5B6AF2FD3A48A1343217EBC94A4A00E7E5551EF6A11B90ECC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941069, "uuid": "1f9e9374-dd65-417f-92c8-5ab8942aac2c", "value": "12288:YLW8j4oMeiZBncu3wGo66QXdo/yPIhqNtjDmo637QLkLgyCpi+aFQF2i6h:YLW8j4odZuxNjXdoKr/uoS7Q4lCp6s2x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635941069, "uuid": "50cd7cc1-e00f-40ee-9cda-864aadedb2c3", "value": 1926591, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635941069, "uuid": "e822ed5d-19e5-4782-8a3e-ef5f589f7e3d", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941069, "uuid": "0da1f064-7bc3-4b60-a5fb-88fd033e02c9", "value": "Purchase order_122.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03205a29-3c9b-11ec-843c-42010a9c0014", "comment": "Malware payload (CobaltStrike)", "timestamp": 1635939701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635939701, "uuid": "5816d0ce-5080-45c2-a828-34bae38ca5d7", "comment": "Malware payload (CobaltStrike)", "value": "20f8cccc01450c1ce41c38e0fe203e8a", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "Sangfor Technology Beijing Company Limited", "colour": "#10F549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635939701, "uuid": "0dc2a965-8152-450c-847a-340608da0489", "comment": "Malware payload (CobaltStrike)", "value": "e3ec79122d3735696743bb9da4f309d76e121d0ac44202b56c11fe191080c456", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "Sangfor Technology Beijing Company Limited", "colour": "#10F549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635939701, "uuid": "83a93304-3599-4673-8128-588132fe2b2e", "comment": "Malware payload (CobaltStrike)", "value": "df4773586b37fa78fb8d166fee4d3d190865a836", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "Sangfor Technology Beijing Company Limited", "colour": "#10F549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635939701, "uuid": "2447b288-4737-4c87-9ca1-c3c6c58b0352", "comment": "Malware payload (CobaltStrike)", "value": "78384945344be3f7824cd39f763a3c10914ef4eecdff249d5737e83fe526dd6d00e5d96fb5a5791428dbb7f89be9e02d", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "Sangfor Technology Beijing Company Limited", "colour": "#10F549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635939701, "uuid": "973ea529-1fef-4073-992d-4e79ffbffbb4", "value": "T1D80633D54203A765C14DC43D655DC3ACB6F67423234BAFEE1B76A093CA1AA1223BF234", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635939701, "uuid": "a3bd8fb4-8212-4a3d-8be2-b81d91872bda", "value": "9bff8da1d90c0229d0d07bc65980358e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635939701, "uuid": "239dbec4-5d5c-4cfb-8f07-882fd055ad2e", "value": "49152:WRzZeNIAjR6KH6uJ1hQzfKjiJZl6IzgqhB8Dq1xmeWlD6ub+Yjaw21zdFsRESDTD:GeNLd6K/3QzyiBvmG1GD6snLoCQdXcMo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635939701, "uuid": "d81d9a5f-d22e-44a0-87c0-280c3cf8079e", "value": 3709128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635939701, "uuid": "65a60c48-9d1d-42b7-b460-126c48d8b098", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635939701, "uuid": "22fdec20-577b-4071-ac00-d38e075ae4c5", "value": "e3ec79122d3735696743bb9da4f309d76e121d0ac44202b56c11fe191080c456", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59741bda-3c51-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635908063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635908063, "uuid": "9631d1a6-9718-4a39-8ca9-1ff4b814f42a", "comment": "Malware payload (Loki)", "value": "2d0d810bf55bcc11a28689e8ed2e5728", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635908063, "uuid": "ce423b4b-3463-4e19-ba80-865ff28a0e1a", "comment": "Malware payload (Loki)", "value": "e410c079cadbe1e3aaa9157b82ed157248cd1a3858d1cda374774a0d6243a255", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635908063, "uuid": "aad54b2b-c05e-4d0a-9a5d-0a5fa1d5c061", "comment": "Malware payload (Loki)", "value": "3ad6105a8962035a90d2bc42fbce76e4013b90aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635908063, "uuid": "34143e84-daed-4cd2-9acb-7a6e25f45f4e", "comment": "Malware payload (Loki)", "value": "5951f58d96d5c1019255ad06ac61aee7c516d31a2947605fae92bace5a1c1a8776b631cb2d85bde6c8eec245bddc4431", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635908063, "uuid": "36054f77-7986-4a7b-96ea-00fdbda7cf1c", "value": "T1CF648D9673074A06E66CBBB5DF777B150320BB765533930796C0B92E602E3AA3AD1703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635908063, "uuid": "176d97bf-959a-4e0d-87db-fc216a72922a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635908063, "uuid": "6d61efcf-b3db-4171-84b6-70d12f20219a", "value": "6144:FblkOfYmlDhgmNmhfHmoMSlX0nj3TE3aLQWT0VhDH8Ls5Izc:tffFwGo7o0MQWTp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635908063, "uuid": "10cb21d5-61de-4c33-9615-c86af214e5b9", "value": 330240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635908063, "uuid": "46f23a30-a0f0-4c30-b4a3-623cb24192f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635908063, "uuid": "8868a2e2-66a3-47be-a4bc-d57b874bc7b4", "value": "SHIPPING DOCUMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1f19183-3cd8-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1635966247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966247, "uuid": "626561e5-1201-439b-8583-b308bcaee4a4", "comment": "Malware payload (SnakeKeylogger)", "value": "22f5fe5d21fac793bd26dde88235a75b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966247, "uuid": "244dd6f8-982c-498d-a3b5-3e93821cf63e", "comment": "Malware payload (SnakeKeylogger)", "value": "e43ce83c90e3037445bca1cedd6224a3881e995e7cbce5944d89f2249ae393be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966247, "uuid": "8033fbd4-8ae6-495b-b6d8-ad6fa05b7c16", "comment": "Malware payload (SnakeKeylogger)", "value": "e56d6f246b897e0aa647c1e9d570512ab8affe2f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966247, "uuid": "0f275f86-f5eb-4d12-be98-b80a0bf4bea5", "comment": "Malware payload (SnakeKeylogger)", "value": "c0d7d847b14a73d130b4991fcedc75feb9d84c3d17cbdb49e90d518262aabb7710f39954f7872d2f614ebaa64dd3021f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966247, "uuid": "1da49365-dff9-49c7-b9a5-a6ea94243f83", "value": "T18FF43830F75D89C9C6FC3734CF25D1B017616C6A2A108A5924F43DFBBABC61366316AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966247, "uuid": "0e517b27-8c80-481b-ac0d-3fef89ba6b39", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966247, "uuid": "0382eb9c-e8f7-4169-a09c-02fe57531dfc", "value": "12288:105kscDyoYDDW6rQa4JjbCZ1XyuF7EzqZpJoLT2g0:CEDJuW6MXK1XyuNNZpuqg0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635966247, "uuid": "38870b42-941f-482c-80b5-a16235315120", "value": 768512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635966247, "uuid": "1a966781-3494-4bb0-a126-5805905b6807", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966247, "uuid": "48e9785e-b2b5-4e71-b414-958488cce06e", "value": "5456743789.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd40b394-3c7a-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635925947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635925947, "uuid": "dfac4043-11dc-422a-b83e-61ff0e77969a", "comment": "Malware payload", "value": "210b1ad6c911ed0735269ee298604914", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "FreeBSD", "colour": "#75A699", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635925947, "uuid": "5a431871-2e2a-414f-8b31-186fe0bc135b", "comment": "Malware payload", "value": "e514be3e997895c7e3ece03549c8cb6b5700fe8f814948ed201ca59daa8733fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "FreeBSD", "colour": "#75A699", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635925947, "uuid": "1fa2a72e-113c-40f5-bb24-d9f4d01aebce", "comment": "Malware payload", "value": "05b62da1c431b6647ef5517bc8699a4560dec14b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "FreeBSD", "colour": "#75A699", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635925947, "uuid": "ca24b513-88c5-4961-b428-21052e9350c5", "comment": "Malware payload", "value": "201475b1abe71ea39e4728434b8bc7a22c8800f91171e7d35fc27cf4dc1cbd83620aea887c8ccc70dc4f87a016f2bf08", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "FreeBSD", "colour": "#75A699", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635925947, "uuid": "8b5ba7e1-2209-453f-ac43-a73a6c674c9b", "value": "T1C7A5F746F8A664E5C1FEE1304E12519AB9A0786907303BF71F84A7990335BF4AFBE315", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635925947, "uuid": "d6dd18ab-8465-4685-91d6-c2adc7230a16", "value": "49152:oBWlwme8nhvmR52bzPOA1nsRTuIQflLQn+MJv:YmeQhvmS/R1ns1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635925947, "uuid": "99f8a015-fbe1-439f-b2a5-7d7c06767bdc", "value": 2068842, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635925947, "uuid": "1e669ca4-3dd5-48d7-862d-3e278883941e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635925947, "uuid": "375d41a2-abba-4b3a-83c5-ea8c652fedcf", "value": "e514be3e997895c7e3ece03549c8cb6b5700fe8f814948ed201ca59daa8733fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d87c59ad-3ce1-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635970123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970123, "uuid": "e1148a67-503b-4c0a-b223-39f3f443faee", "comment": "Malware payload (RedLineStealer)", "value": "eb9657bc8d08db9b2e9e282e59034ab1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970123, "uuid": "386090e8-cd25-4441-a80e-346f3c8d5e21", "comment": "Malware payload (RedLineStealer)", "value": "e68a623d7c06f7ecdc50508058dbb28bba9806fd507413168090d454ebfb366d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970123, "uuid": "f41e7a0d-2e4f-47fc-b080-78767dacb53a", "comment": "Malware payload (RedLineStealer)", "value": "04f4c13c56e4e79ed2391fd0efe3f92d1f135569", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970123, "uuid": "4390980c-5fa9-494d-bddd-781e2c51b7b6", "comment": "Malware payload (RedLineStealer)", "value": "7903a461320a96ff7c9c923ae8b65a4efb87e6e0821f920324001f81c45991bf9455f4addd88972f67f9ab45f35e8952", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970123, "uuid": "4d6e46df-47fb-4878-b634-505fde6087ca", "value": "T1C794BF10E6A1C035F5B252F84AB693A9B93F7EA1A73451CF22D416EE5734AE1EC31307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970123, "uuid": "f80800e1-abb6-4e2e-b7df-954311189c32", "value": "7e51d9833813c1a3fb57baba54855909", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970123, "uuid": "74855488-4d77-4b81-9b9a-70fde414b2b6", "value": "6144:EWkaOLIGPMDT3LNgfjWW6tPbHh/B4iWJBJeFaI5EDzlZkoT0ekW:E9p7kDT9tHh/aiWJveFaI5EVZkowe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635970123, "uuid": "1114cd08-a814-466a-be36-0dc0ac19fab3", "value": 408064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635970123, "uuid": "316c5fef-4a71-46d0-9e8d-fc47010e6bb0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970123, "uuid": "a7569e98-af35-41c2-b59b-228499168bc7", "value": "eb9657bc8d08db9b2e9e282e59034ab1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bf49957-3cda-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635966881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966881, "uuid": "7db8327e-68f8-4750-9f51-aeca41ddb27c", "comment": "Malware payload (Formbook)", "value": "4ed0940e6e53d246dae50a1a7dda5f68", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966881, "uuid": "865087a0-1185-42b2-a1b4-2cb4d9756182", "comment": "Malware payload (Formbook)", "value": "e6b973beff845a214101c3f4714d32f15112b86a9fbfbd301914063f2e4e5677", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966881, "uuid": "8c22c815-b65c-4934-b4a2-04762a7bf6be", "comment": "Malware payload (Formbook)", "value": "4439f0cdb3937226cb4015ec4c2df54a36c29f65", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966881, "uuid": "1b45dc1d-9ab5-4636-adaf-a4e23dbc9554", "comment": "Malware payload (Formbook)", "value": "a52340c4f762777be38b43ee83c6f036b1d26fef16b6af74229b8729bc83726e46c7844f0f0593528c1ed72926eb3365", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966881, "uuid": "1e70358a-e9fc-4d22-9f5d-7bd4be9e986a", "value": "T1291412E3709F9B89D236D9B0162885DCDCC1DFAF8B0BE2A9ADC4729F4735C648410B19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966881, "uuid": "8dd6f16d-56ab-4e0f-a9ce-7b71baf8b81a", "value": "6144:nC/2FDutDZHMntvO5KbRXESKwHRtIhnTvf71GvGOIxM:nC/2FDutVHUPV0SK8SRfRGvGO8M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635966881, "uuid": "c6796d34-e812-413d-8995-72989d4b3014", "value": 206472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635966881, "uuid": "b7e0d0da-6939-4304-9493-ea7e61e1aae3", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966881, "uuid": "94ea3805-681f-49b0-a5c7-25f373f8a89e", "value": "RIOSAT_DOC.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a474b43-3cc1-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1635956275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635956275, "uuid": "559c00bd-a273-4794-895d-2e33e65d91c6", "comment": "Malware payload (Dridex)", "value": "9a3d6fd334ac95b02d40d05827fbe92d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635956275, "uuid": "0f5e02d8-256a-47ed-b2cb-35601f07a137", "comment": "Malware payload (Dridex)", "value": "e6df75d5f855d7cd27989931c0ac97bd59cbb155f97e5c9575785c278f3c76f5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635956275, "uuid": "6c727687-1cea-4f3c-84e2-8adc2cd94674", "comment": "Malware payload (Dridex)", "value": "fcbfbdd6230a2f32e89cdd538514dea73219086b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635956275, "uuid": "f646ee6d-2e38-40d4-bbce-0627c92b6ce2", "comment": "Malware payload (Dridex)", "value": "f47a0f118999bd0a04e687691979ea2cdbb0cd4deef027bbc86d2b16c5b2e676c01d3ffc2cdfa9a7e1bc0140f2b6a94f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635956275, "uuid": "d873fdb0-c325-47d5-b3af-43c584dd7386", "value": "T13053E09B66647407C014ED758B488CF12C19B0F8DC06C60A2C694F8B52EE2D7EFEE64B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635956275, "uuid": "ea148b39-b948-4ce5-b8e6-3140c72178ee", "value": "1536:8CW9PIbZ853SAJbpU+AdP6PIFZP6g2P6TUFjuRB:83ybC9n46PGP6g2CT+uRB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635956275, "uuid": "2d5789ee-8c8e-4b53-a2a1-6d1b2987109e", "value": 61821, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635956275, "uuid": "97373667-0694-4112-867c-8d0133bd51ce", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635956275, "uuid": "c657f4ec-1542-4a1f-b9dc-3e86b4c96bce", "value": "Order_51298.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0f63184-3c8c-11ec-843c-42010a9c0014", "comment": "Malware payload (GlobeImposter)", "timestamp": 1635933630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635933630, "uuid": "94e92a97-182c-4c40-9532-981fcb90812c", "comment": "Malware payload (GlobeImposter)", "value": "821883525833df75c30d68584716f6fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GlobeImposter", "colour": "#499572", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635933630, "uuid": "bf437fb4-9ed0-4a71-b2fc-080739f048a7", "comment": "Malware payload (GlobeImposter)", "value": "e6fae4d52ed5450e44b6c16ce80abf4e63cdc25d3e4fc4f55c220cc1b740c2f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GlobeImposter", "colour": "#499572", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635933630, "uuid": "33e659c3-58a3-4515-a137-500d8c06b2af", "comment": "Malware payload (GlobeImposter)", "value": "59f8739daa99175ae2a20e38048b1a5d3c5f039a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GlobeImposter", "colour": "#499572", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635933630, "uuid": "a1974d7d-6ec3-461b-8d52-9758dff70591", "comment": "Malware payload (GlobeImposter)", "value": "6594d36b6959f1e374ebfa320ed0457c15a6918e274bfd4a6fa5c423bac3b6f4209c5fc9c86fa2a0e9d223fce1335efd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GlobeImposter", "colour": "#499572", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635933630, "uuid": "615c1a40-7bdc-4ac6-8578-087ef5e4fef1", "value": "T12B437D83B98346F1F7E3027D4A6B3B0EA7A1F72C0065DA67C7A50C46DE2025366396E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635933630, "uuid": "9b996b12-608c-4ef5-b4f2-6d42f7833fa7", "value": "ba2ce247fa49357770ce28f139e2f1ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635933630, "uuid": "8b76e228-36d9-4b2b-8e36-5c8cc38698ff", "value": "768:wGvvuye1kVtGBk6P/v7nWlHznbkVwrEKD9yDwxVSHrowNI2tG6o/t84B5WpCD+9q:JreytM3alnawrRIwxVSHMweio3dD63o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635933630, "uuid": "c84ad3b2-d289-47ce-9d1e-fae52ee172da", "value": 56832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635933630, "uuid": "9d495109-8838-4a77-85c6-3888abfb66f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635933630, "uuid": "1818d9b5-1a30-4db1-b649-027d899e0a63", "value": "e6fae4d52ed5450e44b6c16ce80abf4e63cdc25d3e4fc4f55c220cc1b740c2f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "179baec4-3cd2-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1635963357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635963357, "uuid": "4d9a387e-b724-4a62-9e63-eb010b72ec45", "comment": "Malware payload (Dridex)", "value": "b2a17f98115eb64563fd32663ba5ff16", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635963357, "uuid": "73294658-728e-42c8-ac20-6570c0c2ca34", "comment": "Malware payload (Dridex)", "value": "e70d5dda6d489da9e0fd9123c2334ba98f9474b720aeac009ac489f7f9e5285b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635963357, "uuid": "413f4a71-a930-4331-89ba-6d511fc2cd01", "comment": "Malware payload (Dridex)", "value": "24096606d3f253fdb7e2c38472e9def5d94a1318", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635963357, "uuid": "a749c713-e152-4ebc-aca8-a4571fbfa8cd", "comment": "Malware payload (Dridex)", "value": "de447a796727a5d80b83a70a7b0402128e0b34b1f79b317d0018ad72c2398a857f740eef6a1d9cc17a89bc7b3e1063ce", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635963357, "uuid": "39918dc2-b413-4be5-a3ab-e719ff655a80", "value": "T1B693025FB67474C2C32DFD39010D347A6979E211A888ABFE8999F90C52F1782E70943E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635963357, "uuid": "48df5983-63c8-419c-a741-720865781dbd", "value": "1536:8CWUPZZKz/1eCzbqzLkh/OPvTFVKFWQ+bHBNcsoSc9zrPovSvHvld:83cEz/9qGWPvZVKFWjHB7oSWroyHn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635963357, "uuid": "dcae7826-cfff-4a4a-a3ea-2fd13202995d", "value": 89098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635963357, "uuid": "84c9faae-2eca-470f-b12c-fc891305c470", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635963357, "uuid": "97de74d5-36e0-40d8-869a-052e1e57d333", "value": "INV.86768.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "962dc25d-3c9e-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635941236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941236, "uuid": "5602a3f3-7b1b-4579-ac7f-d99ffbe41dc7", "comment": "Malware payload (AgentTesla)", "value": "1518e5de47d51f335e0800eb263f575e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941236, "uuid": "eaf259b7-ef87-4ad2-9d9a-734681f71faf", "comment": "Malware payload (AgentTesla)", "value": "e72a32127c16ca6b905016f14aae3049024f16a884ef90602310e9f4e5b9262d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941236, "uuid": "8cea8be4-fff1-4bbf-a244-06fe1aae246e", "comment": "Malware payload (AgentTesla)", "value": "e74a77aeb20d6803ba3882038e901de72d3e92be", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941236, "uuid": "10d2e3e9-fa14-4105-a2a8-2f6564b9c2da", "comment": "Malware payload (AgentTesla)", "value": "b3015a89781fb66e1e20703d8e6cfd45557831944d8f2a6cfeac554f9b2e93fe77075e3a465bb197bfab7c238cd623af", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941236, "uuid": "96ac1249-17da-4285-aae3-42aa474702aa", "value": "T16C054820B75D4DC9CAFC3734CF25D1B017A16C6E29108A1924F43DFBBABD61366316AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941236, "uuid": "5ea254c0-639c-4c00-8ab7-7f597c24b2ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941236, "uuid": "3238cf07-a947-4322-b3d1-62ce80c1d1b3", "value": "12288:o0iwVmqLSan/+7D5jDYX1ByuF7EzqZkJtLTPx0:5AqdnuFg1ByuNNZkHbx0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635941236, "uuid": "7f26c9cb-6106-4c75-9642-01b6078347b1", "value": 829440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635941236, "uuid": "050fdec0-415a-474c-a4ff-122feaf6186b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941236, "uuid": "0b974771-559d-4e90-a69c-4dbc1da2887f", "value": "AWB 5032675620_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41b60eee-3ca2-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635942812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942812, "uuid": "93734353-3cd1-4491-a1f3-7514d355318c", "comment": "Malware payload (AgentTesla)", "value": "dbb68385e5c2138bc527137f085a3964", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942812, "uuid": "7166b09b-d7b9-4122-b135-7615af29e4d2", "comment": "Malware payload (AgentTesla)", "value": "e76e7327037f16b768ff3f6f38c8f354b76f76870b2bc7716d5b57667df40a1d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942812, "uuid": "54b95934-0c12-4d85-b79f-772c2b9c8b28", "comment": "Malware payload (AgentTesla)", "value": "5b8ac9a31a68fb49e69f895382d297ad34ba1d60", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942812, "uuid": "8e617ed8-5704-411e-b9e0-e41156f3d9a6", "comment": "Malware payload (AgentTesla)", "value": "722d99887422aa6dbfef17b075b86a132810bf48f1c3009fdd637a0547cce0bbd2006c683faa5c0fe1c5d95e13b89fcd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942812, "uuid": "09c892f2-bc38-4a3b-9e11-fd7ffc8271e0", "value": "T1FEE48C86E0055961FA3A5BB82031D67433A66DE66DF1AD8D29D43D933AF32835C32C1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942812, "uuid": "d0a02368-f06e-426b-a321-1c0a04b7e3a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942812, "uuid": "29c688d7-5b3d-4b80-8c3f-542cef167344", "value": "12288:6EIbw8eGqb8pxPi5/z3aPP7dsg+7Zsz2jgCu7S17t9VjW:6Hbw8eGqbcxq5/z3aPjegPMga173VjW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635942812, "uuid": "c17f1eb0-b494-44c6-933c-08bb688a4f65", "value": 700928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635942812, "uuid": "42853d76-e8db-4e46-9829-a7a090edc2ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942812, "uuid": "6367e3f2-4e7c-457d-86eb-96534988c6eb", "value": "SecuriteInfo.com.Trojan.PackedNET.1092.32305.28019", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9083e515-3c63-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635915886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635915886, "uuid": "37246389-1bf6-4af3-8b86-38d455068995", "comment": "Malware payload (AgentTesla)", "value": "0e05cd390a3d599b614dc7d0c91ea4fd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635915886, "uuid": "6c09b2b7-153c-4f19-9f99-d0dc4cf3e649", "comment": "Malware payload (AgentTesla)", "value": "e8e5ced14db63084b0433fbb94799a865c2fbc24773953e2586dbbc583edbbfa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635915886, "uuid": "5f63581b-e38c-466a-9fa0-1dfe9586a6cd", "comment": "Malware payload (AgentTesla)", "value": "62945e0ed0423755ed36bc7b3c8b536bcad02b93", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635915886, "uuid": "6ea5eb86-3421-42dd-81bb-1583ec50d9d5", "comment": "Malware payload (AgentTesla)", "value": "df552fb4587e45fdbfe2d3fb1da47247825b519ea211214707f51dda3541b33e677168e34197e1f4ef5fdb809474565a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635915886, "uuid": "fac26843-38b7-45af-84e1-00d3416c00b2", "value": "T104B4E0D262E44215E5A94FB460716D2053B77FAE3C18F7DC6D9878EB3A73BC24120A93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635915886, "uuid": "1a36afcc-fcb5-44d0-a33e-26b4f5a294d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635915886, "uuid": "c048b6ac-a6f6-44d4-aa6a-713430aee39e", "value": "6144:nOvIl1mgauTuoDj+EzhBq0CDCSsxIQuqznXc8Kw+0SinyO3haKuMSCgi016FlWID:nOuTl19+zsCQVnXxKwGit8KbpxY68Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635915886, "uuid": "ed47939a-41e9-4d9e-850f-f9c66b670390", "value": 497152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635915886, "uuid": "09083a6f-d3ce-4905-ae7f-e0e8a235099a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635915886, "uuid": "e85a8642-1853-48ec-96e9-9ee5a229a814", "value": "TXgBFa7CM5uqZ0H.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03766c9d-3ca1-11ec-843c-42010a9c0014", "comment": "Malware payload (Kimsuky)", "timestamp": 1635942278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942278, "uuid": "d6e848b8-c29f-448e-95d3-862af4c3beb6", "comment": "Malware payload (Kimsuky)", "value": "481605fe95008cba64f3abcb17268fdd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942278, "uuid": "95deba64-b102-478b-a922-b96804e2b122", "comment": "Malware payload (Kimsuky)", "value": "e9053f4a026296f0b8949350d0dacb0a108c9b1b8e95000755c0eb691fee525c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942278, "uuid": "b6ff134f-7bf5-4fa0-9bf7-ff1d9ef180dc", "comment": "Malware payload (Kimsuky)", "value": "e6841d4d99eb5821b5377929f16d00632bd79690", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942278, "uuid": "b3ee7926-65fc-497e-a6b7-b957c8e0c2b0", "comment": "Malware payload (Kimsuky)", "value": "f6fb7ecb2ef5a6d0938cd7d54b1c16396e4f66e09c86fb611d1f799c616573dedd70756e71b3efa91f882012f939af0b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942278, "uuid": "dcfea7c8-28c4-4446-99d1-fc5b8203fcf8", "value": "T1BBB35B00B1C0C071C0EE6E3D4534DAA25B2EBA71DE68AE57139842699F743D19F36E7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942278, "uuid": "63aa064f-ce4c-4f90-8a36-54ecea982bf6", "value": "8308fd527beec1685acea37090f5c599", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942278, "uuid": "6a30a89c-bcd4-442e-bfe2-228969ce0edf", "value": "1536:Frcvn65jb1AIsU1kPxqtb7wvd9zExjIiUnG7foWdkblpJAWHKKsWi3cdqUmlQow9:FrL1uU1kPzd9YxjIhnGzkblHxqUwQoK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635942278, "uuid": "beded85f-1080-4232-b00a-32d5a5162870", "value": 112640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635942278, "uuid": "3a13feba-b34a-4c71-96fb-d30b5e8e386f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942278, "uuid": "662dcfd0-9964-4999-9829-0fbe6c5c592e", "value": "e9053f4a026296f0b8949350d0dacb0a108c9b1b8e95000755c0eb691fee525c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eaf4a61-3ca1-11ec-843c-42010a9c0014", "comment": "Malware payload (Kimsuky)", "timestamp": 1635942404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942404, "uuid": "74871704-ecad-4fd0-8277-7758578e3227", "comment": "Malware payload (Kimsuky)", "value": "a7e25f83a24ac1c73acb587457e325e7", "object_relation": "md5", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942404, "uuid": "1f31e797-92cf-49e0-9d3f-8772307550f3", "comment": "Malware payload (Kimsuky)", "value": "e918793c67a04b5272616056f66b127f1070ecc506c32cfa54980902cf6061f9", "object_relation": "sha256", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942404, "uuid": "c6c1026a-a173-4bc1-9bb0-8858ca9e88c1", "comment": "Malware payload (Kimsuky)", "value": "1a3dafb7b37dc36cb428405e976fd160063ce7c8", "object_relation": "sha1", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942404, "uuid": "bb495392-6b1c-4406-8c05-ee2c6fd60dda", "comment": "Malware payload (Kimsuky)", "value": "9c60b586c26c7b27e43a44409634f25034f5cb70d96dedae4827d626d690d3f15fbdf87ae3862ef7c230e464aa518eaa", "object_relation": "sha3-384", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942404, "uuid": "0fe8e621-0680-4438-86f2-912582f4cd05", "value": "T19EA1D7137913D28CD389B6A3997A64C4589C911A727C2CE9F78EC08DF524C2842FD3E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942404, "uuid": "935abed3-030e-4e0e-bd73-aba06d192092", "value": "96:1uVLmU+X8V1ViXyzQX1f0gUe3X87J3aLQ4UtX4QLoBf/ETQjOfjjepUc/:1KmxsVj0yzCWIn8oZUx7DMAjCpUc/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635942404, "uuid": "a38b3292-3561-49d8-afdc-1a1240063dc0", "value": 4796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635942404, "uuid": "096ce396-8d13-47f8-b476-d27277926670", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942404, "uuid": "abde07fc-146b-4135-8012-428015f85656", "value": "e918793c67a04b5272616056f66b127f1070ecc506c32cfa54980902cf6061f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "055e9986-3c71-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1635921666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635921666, "uuid": "3265826b-c9a1-4846-8ea1-03e0736c42f3", "comment": "Malware payload (Dridex)", "value": "547a4b9ebe0452fc106483b134a9c044", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635921666, "uuid": "45ddd794-67a1-4555-9b44-8f937c0a35cc", "comment": "Malware payload (Dridex)", "value": "e9ac6c6ba533f52db849035ac04b3b3dcbd769cc2d67470bdb30c40f962b8ffc", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635921666, "uuid": "45bc7fa3-d56e-44cb-bad0-7e0f2bed0046", "comment": "Malware payload (Dridex)", "value": "a1ce1cace39ca1b0c46eac10ddfc457fc1766ac8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635921666, "uuid": "82793b2e-32f6-4aa9-9537-85cca8d473b5", "comment": "Malware payload (Dridex)", "value": "517ef52228d8ff88248610f2f55a8ac9359d91e523e408e5b8b11ea8f5cb0604e2ffc95868d4b3a1fe1c697a2c4192e6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635921666, "uuid": "357efb0d-b9cb-46b3-81de-f0f060020e1b", "value": "T1D153F15B176AB467C426BE3F460D8CB0581474F9DC82D20A3868BF8B43FD2D39B6D256", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635921666, "uuid": "470e2b4e-d45c-45ef-bc45-b8ea3723fa6d", "value": "1536:8CW1PIbZ853SAJbphO0bgTkeImCMyaAkm:83KbC9Q3rAL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635921666, "uuid": "1a838db9-c547-456b-8f99-751eb3231b45", "value": 61619, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635921666, "uuid": "eff65846-6f07-429a-b33e-3aa035629146", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635921666, "uuid": "c9c29851-216a-4c47-ad6b-12c281014f29", "value": "Payment_2170.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "066819b7-3c9b-11ec-843c-42010a9c0014", "comment": "Malware payload (CobaltStrike)", "timestamp": 1635939706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635939706, "uuid": "4b8eae89-85d0-4cb4-900b-7da0c1cce75c", "comment": "Malware payload (CobaltStrike)", "value": "6dc83b05d8a025409cf9e0a8def09122", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sangfor Technology Beijing Company Limited", "colour": "#10F549", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635939706, "uuid": "033daeab-37e5-4840-9e5e-b191b9d44939", "comment": "Malware payload (CobaltStrike)", "value": "e9f17476998f0359a556912efa102710fc9063f0bd3d2403b22922d60c8562a7", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sangfor Technology Beijing Company Limited", "colour": "#10F549", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635939706, "uuid": "4d5ff9d2-ba4a-4a6e-8272-b986f74a8463", "comment": "Malware payload (CobaltStrike)", "value": "80657a92895b805c952102d9a030e9a37a66ac0a", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sangfor Technology Beijing Company Limited", "colour": "#10F549", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635939706, "uuid": "07797f16-3fcb-414b-a86b-5886104ac8be", "comment": "Malware payload (CobaltStrike)", "value": "84ac8b64607729d0542dd4895b2645db121b72737bc5291db5db7b8783b1db9b2afb32cb369233424b7dda271acbf3ad", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sangfor Technology Beijing Company Limited", "colour": "#10F549", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635939706, "uuid": "107e8415-0ea3-45f7-82dd-abe8d66695b2", "value": "T19D957C437CC530B9E4AAA233897976A13771BD45033067C32B48A7BE6E667E40F76394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635939706, "uuid": "2c86edd6-cd49-4a0b-a61b-6525d97c0921", "value": "c7269d59926fa4252270f407e4dab043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635939706, "uuid": "ade2551b-7eec-4494-9386-f8e4c193c2e1", "value": "24576:Tmh+vhYfSY43gchiBgkAu3E0D1cE/JWA/xPm/UlUQdUz2MQcOvEVORKV:g+vhEGg8iyBr0D13xTAKUQdUwDUV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635939706, "uuid": "4588427b-20b4-401e-8897-35732f248b00", "value": 2052952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635939706, "uuid": "96759bbd-de36-4ee5-9017-0e553385fd77", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635939706, "uuid": "a54b9c39-29c2-4736-aa7e-ce19a811dbf2", "value": "e9f17476998f0359a556912efa102710fc9063f0bd3d2403b22922d60c8562a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5730962-3cda-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635967031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967031, "uuid": "0c559f1e-e306-4884-895d-a6c2d5b896d4", "comment": "Malware payload", "value": "6f85d70c5acf674bcf79e843ba27bc3a", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967031, "uuid": "a2a88555-5e34-4e2c-9e8f-8d1f06c1901f", "comment": "Malware payload", "value": "e9f44ca0279aef804c4901fe791de1b8a12b47d7049cc609e5863f0868fb4d54", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967031, "uuid": "c8882014-e9ab-44c8-864d-abcfdd13853f", "comment": "Malware payload", "value": "1917d0616d509f703e363b137b5895ac0c5718c0", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635967031, "uuid": "c7199b8d-2a5f-4745-b6e8-1704dc2eb896", "comment": "Malware payload", "value": "91a298bf14052d1b88f01c5e86ac18a9a40d389f297443348f6bb1bbf9caa59405393e08c0e0ee73cf4d56c30a5a4e42", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967031, "uuid": "24b95544-36c8-4ad1-b1f7-6375db500b0c", "value": "T149B412BA7EE3C666E50786724511D827E89C04E9EC0DF10352BA848D6D3BDC50B82FDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967031, "uuid": "123d0527-46d7-4c2d-8bd7-dcd29ce59d5c", "value": "12288:a2M00acC9jCRbxcOfqOIzX9M+g03KE9E74:000RC9jCRbszf2U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635967031, "uuid": "2f09bde3-4db9-4f9c-902b-252cefe8a1a9", "value": 507782, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635967031, "uuid": "73e078a0-13de-41e4-91ed-791de6b6ef53", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635967031, "uuid": "80bb48db-6ecb-4792-aa72-c60766a0c122", "value": "Scan03112021.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "defd9d22-3ce1-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1635970134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970134, "uuid": "57704d40-9b96-4333-9b4e-202c088ded3b", "comment": "Malware payload (TrickBot)", "value": "e79b1c31c1491e41413047649506596c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970134, "uuid": "ad5301f6-5926-4f08-b6f1-98ee4f6e00e4", "comment": "Malware payload (TrickBot)", "value": "e9f6d1a2c238f02d3bfb8e909e22e085597923220edb929e33997b1ebe76c392", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970134, "uuid": "673f6498-947f-4e74-8abb-db29e6a9613e", "comment": "Malware payload (TrickBot)", "value": "c6b8bb8578a697d4d26a6293b1cc62e3471e45d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970134, "uuid": "0bfa39f7-bbb7-4b09-8f80-112db465cd4c", "comment": "Malware payload (TrickBot)", "value": "e56d4ebd0225cfd705af36fa1c98a3a29af651f508769de4d1e970e5a804c1bc86d5b5bc15efb983b31e9204a7ae5bc8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970134, "uuid": "b27b1539-147c-4090-9e91-3b9ed9ccb1ca", "value": "T1B315CE567DF0C07BD2A691710EF4BB7A62F999205B274ECB27908B1D3E31CC0563627A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970134, "uuid": "e1b4887c-ae4c-4050-8864-2ebc0c64869d", "value": "5c272247eecddf77307138917800d024", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970134, "uuid": "828478b0-67f0-4b66-a44c-31489dcc45f8", "value": "12288:y0qKG+wPRvCKXb4+aliMESpaPyyzY+NSbILBzLqkRYKpDVrSs1l:4P5Xb4+wiMES/XstzLWuVrSs1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635970134, "uuid": "920d9946-ee9f-4e04-bc49-928601db305f", "value": 880640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635970134, "uuid": "a4ea9e5c-9103-402d-b78f-b608253a5889", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970134, "uuid": "6cfa801a-51fc-4489-b471-d563566d0b11", "value": "e79b1c31c1491e41413047649506596c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2a5a51d-3caf-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1635948612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635948612, "uuid": "d9f842cc-fab5-4e95-9181-4865a074f570", "comment": "Malware payload (ArkeiStealer)", "value": "b066a27d17074aff63e18adbd02cd744", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635948612, "uuid": "e789e7ff-f836-4f40-83fa-912581da8f0f", "comment": "Malware payload (ArkeiStealer)", "value": "ea064a39af0130de8c6b8bf50e49d109bd678890b98ba06ed8d8223a64010e6f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635948612, "uuid": "255bad4c-900c-4cd2-93f8-afd367fa7493", "comment": "Malware payload (ArkeiStealer)", "value": "883b37d17fb3f4add109436e2b7a6981cf180c2d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635948612, "uuid": "6fb34a30-cdee-4401-a8e8-e2ae130eeec5", "comment": "Malware payload (ArkeiStealer)", "value": "04c29328ecd4120245185f0d009297fd00dd2dc85479f0fd585cb7181338a7302663c7cb04a8b200fbf425f4b1a3a8f3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635948612, "uuid": "60e3438a-1a56-4448-9847-8fab2d61f6a3", "value": "T12975D032F2C1C437C7772A385E166658EC2A7E015E68A84A2FE50E6C4F397717B2D193", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635948612, "uuid": "9bdba47b-f147-4e09-b1e8-3bd68446a44b", "value": "b85fbd69f590e538d65c2f55613c4277", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635948612, "uuid": "3f2b2a01-a7a0-4438-91bf-5574fc361aeb", "value": "24576:NYOWCiW8yssj9Ij2aREpmOpLF06E+b1VZk1SjVFsKICyWXqVWgH0Wy9bvFGNY83w:Nipoy+bPtFSVWyoDV83HgZV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635948612, "uuid": "001a3dcb-581c-4b24-8acd-b5c6dbd32dc5", "value": 1659904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635948612, "uuid": "9cce2742-8b7c-4c59-90f5-fbb81c8f8fb9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635948612, "uuid": "a57a3805-6297-4488-80fe-c30bf6d9209e", "value": "b066a27d17074aff63e18adbd02cd744", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8221801b-3c75-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635923593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635923593, "uuid": "efc9f71d-9e5f-4b19-af9f-99183ded6add", "comment": "Malware payload (AgentTesla)", "value": "01bda0dea80f389d9d9c8e90dcc1d246", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635923593, "uuid": "92d9c9cd-198e-4c5d-859d-9dc38f0311d1", "comment": "Malware payload (AgentTesla)", "value": "ea5e0cfb395b2b4e3b6650c2dc6351d1d160aea37a724f72d9f9f95c7e8e05da", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635923593, "uuid": "58be7116-c203-4285-8ca7-1db7205818e9", "comment": "Malware payload (AgentTesla)", "value": "ae7abc56dca30fa63db84086c1fa12e7cc22b356", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635923593, "uuid": "d09ee989-1eda-44ca-bb1a-c6d0985bc226", "comment": "Malware payload (AgentTesla)", "value": "7d8cc84a0dbc31fc0841fdd1e6d0a802aa5ef3a386e93ec0154cf70ffdedd34a05466e09ff266c224683b3d9bfb25f5a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635923593, "uuid": "767b1aca-edf9-420e-a729-b20ceae14ce1", "value": "T101D4DF3824E45662DBEA43759D84852523B15C9D6063EB0D2EF0FDE3FAFE7934E02816", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635923593, "uuid": "81e8ef5f-be7b-40f1-80b6-85747c2144b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635923593, "uuid": "17b68caa-13a0-4da8-940a-3691d4f01bae", "value": "12288:X9MTuV8E06RTlIQtUJcXhEENtZgYk+F6gy2UW06p3e5xQ:X9MTkTyQtUJRCTgYnq0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635923593, "uuid": "f04dd151-cf43-4cb1-a802-87890db07b35", "value": 651776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635923593, "uuid": "929938a5-454e-4bfb-9eb2-2aa6d7922361", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635923593, "uuid": "d91464f8-e1a5-483c-88ec-3e06aa409e5f", "value": "Shipment Invoice & BL-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d18fae7-3c95-11ec-843c-42010a9c0014", "comment": "Malware payload (SilentBuilder)", "timestamp": 1635937275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635937275, "uuid": "0a993848-3372-420c-93db-f75e6174e749", "comment": "Malware payload (SilentBuilder)", "value": "a9d2a402695158fcc2ec3a975e860312", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635937275, "uuid": "aff20a27-4ffd-448b-9589-9ab35e8616aa", "comment": "Malware payload (SilentBuilder)", "value": "ea7ada44215bb4ee4f4d9b8cb2194640e692570294bb3009afff3bae4be3c660", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635937275, "uuid": "dbf21fc9-94e2-41de-bcf1-6756b472d2c5", "comment": "Malware payload (SilentBuilder)", "value": "9d6f2d693865a1872d2d537fadaa60487a5e94f4", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635937275, "uuid": "99abf14c-c631-4fbf-8a0a-e37d51cc7c8b", "comment": "Malware payload (SilentBuilder)", "value": "73a9e716941020bbe2e17c16ef3f85100fb21b3edb307d8f15a9c5dd35ef674e95088ed20ac67027562782ed7ffdb93f", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635937275, "uuid": "fc1e0f2d-1d57-4f2c-a1ca-981da0003163", "value": "T1C6935A42BA58D86EF525C77148EB53A5B322EC305F6B0B872665B3203FF99E06E03547", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635937275, "uuid": "fd966276-1ad8-4393-a328-af66f2858582", "value": "1536:i5Kpb8rGYrMPe3q7Q0XV5xtezEsi8/dgw91vrVmxJiME2GhdD52lZPFu1AOgS+l+:0Kpb8rGYrMPe3q7Q0XV5xtezEsi8/dg6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635937275, "uuid": "546bd885-c013-43c7-b916-cc5d94061292", "value": 90112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635937275, "uuid": "9e8956cd-9481-458f-96c3-715c7dc85b4d", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635937275, "uuid": "89a64b5b-85f8-4495-ba23-f4d0da3ec0fa", "value": "miss-412510398.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa75bf66-3cb8-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635952437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635952437, "uuid": "3a1006bd-5d6a-46fb-a87f-36d9301c4a8c", "comment": "Malware payload (Formbook)", "value": "f56ca1c05966db7b7a97e52c36de6836", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635952437, "uuid": "6d2ae343-0975-4f54-815a-84affa9135c6", "comment": "Malware payload (Formbook)", "value": "eaf11cea9f18183f7136f75ac7d10673a332bf8ea838bdcbe7aad7de74e7dfdd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635952437, "uuid": "a2ba4f3b-57c8-41e8-b88c-c77930464566", "comment": "Malware payload (Formbook)", "value": "71dd157fef2b6cfc1c94fafe5d4a39203458278f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635952437, "uuid": "872ce4df-d9c9-463c-a989-250172bb45dc", "comment": "Malware payload (Formbook)", "value": "9bd9ab6c43f3ec66d48908a705d82ff4391aeaf732f0963976fb48f9146a67ffb1fed819f3679a337268182257c48980", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635952437, "uuid": "e4b565ab-0e26-4e6c-8885-79b6b066a206", "value": "T1C2C4CF3824E45626CBF983759D55952953B25C9E6043EB1C0EF0FEE33AFE3630E1285A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635952437, "uuid": "5e2eb13b-316f-47c1-b338-29c97befd22c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635952437, "uuid": "645d73f8-3b37-4592-bb99-7d7c745c1b99", "value": "12288:N9uYzWVjE06nO3Zgezu3Kwmik6plsMZ5/MhTli0613e5x/:N9uYzpO3ZE3ZtppOMZRsTXr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635952437, "uuid": "83159e07-3f55-4b23-9338-c9a8eb443906", "value": 577024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635952437, "uuid": "d7f4f856-257d-4dd0-8274-e83b4824bf6e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635952437, "uuid": "7a7d01f8-5a9f-460b-83d5-449e1e9ef17c", "value": "\u0416\u0430\u04a3\u0430 \u0441\u0430\u0442\u044b\u043f \u0430\u043b\u0443 \u0442\u0430\u043f\u0441\u044b\u0440\u044b\u0441\u0442\u0430\u0440\u044b \u0442\u0456\u0437\u0456\u043c\u0456.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46a413b5-3cbc-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635953987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635953987, "uuid": "99c084df-6bea-48a3-8eb3-61aef54f11e2", "comment": "Malware payload", "value": "bf32c609ff35d055940175ba5c417033", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635953987, "uuid": "7d006afe-bdf7-4a11-8fd2-7575d5c88be0", "comment": "Malware payload", "value": "eb0b13517d401d84ca170c82120dc018bb53f4676a5285deb9c3c0e80dce1b45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635953987, "uuid": "14eedffa-cd82-4f2e-a739-e5a4610946e1", "comment": "Malware payload", "value": "763f6a672d738c1db8a98acb7291e0f55431b1fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635953987, "uuid": "030825db-9022-43e5-8717-e3d8f4df099d", "comment": "Malware payload", "value": "7d7a8621e4e97d21ff3e3a1b1bb475d7d9a412d865cd825d9efedf031fd1056e9a361ca376be93169cad0e22a359568f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635953987, "uuid": "29ed96b2-704e-40bd-91d0-4f8399e6004b", "value": "T134C4E04536AD8A01C31C7F71A4A283507BB1AC3A2D42E64F2DCE318D55BB7160E76F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635953987, "uuid": "310dc2c0-c6a9-4d6d-80a0-a6ed52547b5b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635953987, "uuid": "df4c2334-f877-45e2-bb46-3394b2aa3d73", "value": "12288:6n86XfSkIbw8eGWgu/+hthiiYGrp5Zcg1uhNHq1Ec:6Cbw8eGWgo+PQyr+pNHq19", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635953987, "uuid": "41c5c06a-fa62-461c-bce1-8252dd735366", "value": 545792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635953987, "uuid": "f629279e-3537-4f1d-a29c-6cad3042b144", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635953987, "uuid": "57b1a5ca-3616-462c-a4ed-d74548b6adb2", "value": "October -december order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95b94e1c-3ce3-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635970870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970870, "uuid": "ee29e92f-2d27-4c53-a4c0-5d3d25fdef95", "comment": "Malware payload (Formbook)", "value": "62b82b3f411287f6234158f5581a6514", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970870, "uuid": "07996f54-4176-4b0c-974d-1b6e89f1d62b", "comment": "Malware payload (Formbook)", "value": "eb1a7fdf49ef074c93385c99303fb92155f677f17c17dff1f1ad5967700d6410", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970870, "uuid": "d1b86327-750f-4ec6-a165-0507a463b78d", "comment": "Malware payload (Formbook)", "value": "5da452ae017604c6df4ed28f0032f66364356eb6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970870, "uuid": "a6246ae2-9c8a-403c-bf1d-47abaf80e741", "comment": "Malware payload (Formbook)", "value": "e5b8d94eae9a00ab57d79a9e8bf35d9d027f24fe800d614f3f11ff429941e2f56c03fc61e8a67d3b31b82383d47f6a29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970870, "uuid": "703a5e1a-472c-4cc2-a21a-dc7ca0746869", "value": "T10B055830F35D49C9CAFD3734CF25D1B017A16C6A29108A1924F43DFBBABD62356316AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970870, "uuid": "e47c759e-391d-4586-9bfe-8836bdd656fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970870, "uuid": "f188b3df-9ae1-4ba6-b455-c285411717ed", "value": "12288:+Vc4pWt0x83djhvlC8fMDVw1tLX1EyuF7EzqZkJtLTPx0:Yvktldxvf8EX1EyuNNZkHbx0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635970870, "uuid": "a32c57c5-bd1c-441e-8c7f-7f564d8294ae", "value": 827392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635970870, "uuid": "3320e965-472a-4d96-b2b3-9dbe9292813b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970870, "uuid": "221b6cad-d671-4309-956b-d86710fe62d6", "value": "62b82b3f411287f6234158f5581a6514.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ece3ddac-3c64-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635916471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635916471, "uuid": "5108787f-d7e2-49c0-83a9-4b058d3a1878", "comment": "Malware payload (AgentTesla)", "value": "0061bb23f85eb17b10d36fce9360294a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635916471, "uuid": "9aee6c05-9fda-4b3e-bcb0-df9a6abad15c", "comment": "Malware payload (AgentTesla)", "value": "eb3b2bdae1a56ab88d39f7fa1dbcfdb5f98286d192c8cf01a2cf1352a33b72ab", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635916471, "uuid": "1cdd994f-e820-4c57-9175-71427445dd87", "comment": "Malware payload (AgentTesla)", "value": "164cffbf4823b5057110b1357ea1d2945172d2e8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635916471, "uuid": "11a6933b-d966-493d-a5f2-b9e9795538f4", "comment": "Malware payload (AgentTesla)", "value": "5a1a75ffd07f295b5220e79657f1b5032b564f4c91d2ba6c800e16ef2a579460674b61681f3416a1f8f6c2fcdbccb00a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635916471, "uuid": "a4232a22-0d2f-43d1-bb45-1b985631785d", "value": "T1ECB4E0C292E44255E6AD4FB010713D3013B37F9E7869F69C5D98B8E77673BC25220AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635916471, "uuid": "6aa2ed0a-6850-4805-9d14-30ccf45e28de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635916471, "uuid": "7e3536b8-06a9-4ca7-9600-94209611b50c", "value": "12288:3TTllsPqlNU0EDsD0n5Oqt4rd3NINsrWd2E:DTA+O0EDPn0qC2NsyM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635916471, "uuid": "dd17bd41-14bb-42e4-8232-87fb0a41797f", "value": 494080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635916471, "uuid": "0c997cb9-0e74-490a-82e7-632e788dbadd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635916471, "uuid": "3baaa554-0343-48f2-bc2e-55738a11bc6b", "value": "Revised invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06d804a1-3ca1-11ec-843c-42010a9c0014", "comment": "Malware payload (Kimsuky)", "timestamp": 1635942284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942284, "uuid": "855ae3e3-db56-41f7-9521-83f4dc3eab28", "comment": "Malware payload (Kimsuky)", "value": "1638e624f6973fdc34e8ed8243fe078f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942284, "uuid": "516bceb9-c8b2-4a46-a6df-131b7e1b3987", "comment": "Malware payload (Kimsuky)", "value": "eb63d7f5f01819169e63dcde9a00712248c32778ff1de67bbcc1d26eb3897db1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942284, "uuid": "337c9433-2474-4d44-9ae0-cb7a7eed5272", "comment": "Malware payload (Kimsuky)", "value": "b7862ad3479f8d4e1af3d0ae2a6eb93cba982afc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942284, "uuid": "d6d24fcd-8dbf-4e50-b28b-8160252a9040", "comment": "Malware payload (Kimsuky)", "value": "a150422d7a2be52390c42eb3a8bb906c8ffbf47412415bdcd7c7eb7f726d78b360a665e752f09ec5c25319d33bc61d8a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942284, "uuid": "4bdd3c94-0ffe-452e-bc7d-11d7bfd41969", "value": "T144B35B00B1C0C071D0FE6A3D4530DA625B2EBA71DE69AE57239842699F703D1AF35E7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942284, "uuid": "7b627e9b-c3cb-428b-b34b-332e3ba0d6a9", "value": "62666f2878e8ff196208c5362ae49110", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942284, "uuid": "125a8f50-262f-4b7f-841a-56fe0320f29a", "value": "3072:+pcuWIkH8WqQIpkZw4ts/k4HxKU1VQ49:+p9rDKmkq4rK04", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635942284, "uuid": "36a1d6fa-899e-455c-b292-8f8000de5530", "value": 112640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635942284, "uuid": "f3db93c4-2252-47c0-b27c-9fb21088e15c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942284, "uuid": "b908e1d6-653c-4993-be0d-546d893e7114", "value": "eb63d7f5f01819169e63dcde9a00712248c32778ff1de67bbcc1d26eb3897db1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e947dde3-3c4b-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635905727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905727, "uuid": "97062bbd-9c1a-48a5-9d9a-60274e972b8f", "comment": "Malware payload (RedLineStealer)", "value": "200e0067b6404714987c1512cb35afb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905727, "uuid": "3dab6b0e-91d7-4d5e-8c6e-3291937182f2", "comment": "Malware payload (RedLineStealer)", "value": "ebf527cd61c0b4250751c8263d858406b4aff2a852fd6a05fa262a355c5a6269", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905727, "uuid": "cf6ba320-4438-4c19-ab18-f56bc1a1f0aa", "comment": "Malware payload (RedLineStealer)", "value": "cb25d2295b34fc7b83e1689afb665d685c1d9871", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905727, "uuid": "5e8f2bd9-759f-4a8d-a72c-ba584785841e", "comment": "Malware payload (RedLineStealer)", "value": "79a48bf1e8717ee688b6c5d75b58d7872cc7b78263dcf63e22ebead2c28662472064d09cde44793d2a2418e5e9b86471", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905727, "uuid": "9a86fc82-0086-416c-8ba3-2a703f9f5637", "value": "T12713C019ABD04033C9F60EF3E1F3575585F0BAA68949556E70CC420A3F417F6A2B379A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905727, "uuid": "24538ad1-903a-419c-96b4-0726ef5b2ac8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905727, "uuid": "837f50c1-a55b-423a-a3bc-2ae212e123d5", "value": "768:QyWYsG4ABTySIMmHdV1MkJFDonDIZtYcFmVR6KoDGtM6niRGp9E+Mo:paG4AQSI71MqDuDIZmVRlppioQ+Mo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635905727, "uuid": "cc6f7b73-6082-438e-a09c-a32ca509d1b6", "value": 42088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635905727, "uuid": "d603041f-08bc-41b8-9a59-cc7e9c638654", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905727, "uuid": "7e55145f-b1ee-47c0-a83a-52f28a8bebed", "value": "200e0067b6404714987c1512cb35afb9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f3cdfb9-3c72-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1635922219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635922219, "uuid": "0fc4a547-43cb-480b-bc75-60ecfcdce47a", "comment": "Malware payload (Dridex)", "value": "af5fdfae0904b9675162641e3a0c8152", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635922219, "uuid": "d04c30fc-14b2-48c7-92ab-30f217de12b8", "comment": "Malware payload (Dridex)", "value": "ec1d1d46013c5301bd76b7ce83ccae963f2b1ea14ffe9997c6ac7c55d82a148a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635922219, "uuid": "73ad8d51-df27-43f4-a5ab-4644da7fd2ad", "comment": "Malware payload (Dridex)", "value": "d41cda7384ed1bd90ad96447d0e76510282a6e71", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635922219, "uuid": "0e155a54-ba8b-488c-aa2a-5c42d27fc871", "comment": "Malware payload (Dridex)", "value": "1fe8b6b7916c5be4922760961b731ec727260acc74cee2915281dc47fe2f9c1778a8e9121a0d30c0e82fccbedd893959", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635922219, "uuid": "b7803955-901d-4328-9a27-74a07a50e4f5", "value": "T18083F10FCE59B4B6C1FA467C5009AEE2700D7368AE50E2873095BA0DB5B57CB475D23A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635922219, "uuid": "fe54c8da-6f2a-4feb-ac48-28b69e1e34a0", "value": "1536:8CWbPqrE3gpMokPF58Ik4kosQFVvSuMCJvFXEqLNv1TZT5oX4oNoMr:83WEwFkd58IXkOFVvMCJt/xCX4oNoo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635922219, "uuid": "faa1f4b3-acdf-4b6c-bd33-bbf2a58a7812", "value": 84519, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635922219, "uuid": "1c7d4aa0-948c-429b-81f7-3b22729bc99c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635922219, "uuid": "1ebd096e-5602-45c6-b12f-600337a1e94d", "value": "INV.738108.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d722e0df-3cd1-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635963249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635963249, "uuid": "bd9f094b-f870-43c0-a1fb-968844022467", "comment": "Malware payload (AgentTesla)", "value": "b89ce0f45f61f9dec98c5528db8e5dd6", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635963249, "uuid": "27ee10b5-f628-41c3-986c-73e7bf459b68", "comment": "Malware payload (AgentTesla)", "value": "ed0ab71aeaef062fdb3ff0eccf77ff6cae590fb6f2fa42a4f246e60986a601fc", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635963249, "uuid": "09bb4353-8d06-457e-8970-99dfc5ebeda6", "comment": "Malware payload (AgentTesla)", "value": "26ff0b8025cf14df10ae1bfcd125b1da294396a8", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635963249, "uuid": "f4d12e84-5d52-4503-b70b-4787742fb87a", "comment": "Malware payload (AgentTesla)", "value": "1f1c27a6d9e348fb911ead940c4bda2718c8e9100a9cf59bbf1e1d3ab7742097fcea9d4c7ec8f8baaa028fa6ae10607a", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635963249, "uuid": "e491d537-0692-404f-a7b6-8775ed3ae6ea", "value": "T1A18423F04A2C69213BAED79C00D33C53627C7B965FA0E516A57DF6EA21014ACF81F35A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635963249, "uuid": "256c366a-c5e7-485d-8829-bd9069e01f8c", "value": "12288:1Z92YwkMBlT78DZfHr3nT1nYwlB3KDXLMnB8:BXn5Hr3n5nYiBiL8B8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635963249, "uuid": "9832c157-79a0-4a0b-a144-f564f99bd1c8", "value": 403111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635963249, "uuid": "af807268-1327-4e03-965d-d7c45028c006", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635963249, "uuid": "0b5c5d57-b1f6-4934-b1f8-8c9a23bd076f", "value": "SWIFT COPY_pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b11ddb69-3c48-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635904344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635904344, "uuid": "a2e07509-818f-44a9-b9a7-d00b3b650bbd", "comment": "Malware payload (Mirai)", "value": "8fa334add8d3245ce6778bf1e77ce1bf", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635904344, "uuid": "23bd69fd-62e5-49b8-af5a-9a1e3b64ae67", "comment": "Malware payload (Mirai)", "value": "ede127b1ff790f8ebe167ed465115d6705abce67d2cf202c6784ef8d48ae1807", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635904344, "uuid": "647bf73a-303e-4146-b5d8-f8f3760771f6", "comment": "Malware payload (Mirai)", "value": "9cda3017a6f67f1a530f653c62a2c1bc590d0e66", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635904344, "uuid": "16ca0fce-dccb-4a50-a7b7-8ae7bdbbb827", "comment": "Malware payload (Mirai)", "value": "39498b87854265a553e1c60fef7ce3dac4616ff911e718e9d59c43d021ecfdb8640e735cda96cb7748bc2c9b82102083", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635904344, "uuid": "c57970de-8794-4833-95c2-b8b9eb0aef2e", "value": "T1D8832895BCD29A5AC6D4237AF57E11DE332073E8C2DB7127CC200B587ADA51F0D63A91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635904344, "uuid": "d0657d49-31af-4661-bbec-03acae285fca", "value": "1536:jVbT6BwFG7df4yNtjnOfpD8c36pk979lB2lfMaYVD1pSTtwcQEHmkkkkkkkkkkk0:jVbGB+GZf4yNYRJjpgmhkkkkkkkkkkk0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635904344, "uuid": "50fba6b2-00cb-4a2c-b145-8f59cf396624", "value": 85392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635904344, "uuid": "82241bb1-6313-4c44-957d-232a408fa054", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635904344, "uuid": "38aae1d9-d824-4b81-a0a2-2699b07560c1", "value": "arm5-20211103-0152", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed236b3d-3c9f-11ec-843c-42010a9c0014", "comment": "Malware payload (Kimsuky)", "timestamp": 1635941811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941811, "uuid": "6866d848-28d6-4f79-a0e4-03b3e13b3bf0", "comment": "Malware payload (Kimsuky)", "value": "838b6c7924395f389dbbb5b6235e4e69", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941811, "uuid": "b4350290-903e-493b-ace2-1bebd87a5d6f", "comment": "Malware payload (Kimsuky)", "value": "eeb127110f45a3d9635aefdcc0bc0af961df068e69069cc77ab7b283c536e553", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941811, "uuid": "903b29f3-6a4b-4074-af7b-59ca8d2f4e34", "comment": "Malware payload (Kimsuky)", "value": "e8b44b97be6415ad513bea929ab994d70eadc386", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941811, "uuid": "80e37220-872b-4609-9eda-1f8e34358e70", "comment": "Malware payload (Kimsuky)", "value": "5b4e2b56e5224b6663417dfc6ab22b93cfe20ccfb6a06c386a6edd7f9192b13212af9fe42b7a16af1455155cc28dfefe", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941811, "uuid": "f2389df4-d74f-45f1-8b57-6ddb91e03293", "value": "T155B518A1B61572CBE49E67BCD57BCE825C2D47F803204853A86DB4BE7D77CC02696C28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941811, "uuid": "9598fb80-df3a-48f5-aa93-962611af5a86", "value": "5736c803d5d81cb661970317ca21a186", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941811, "uuid": "6200cc12-32ba-43f2-90c5-9d4e71d2225c", "value": "24576:/2CYyeCBIzwnRclcynITnB1esrMqa9PH820/aa1uS5RIvG5RBpCM/jCNcar/7kx0:s4UwT0IusSZTSL7HvCumwo5Pr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635941811, "uuid": "3cdac407-091e-4441-a8c3-da14959ba249", "value": 2493912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635941811, "uuid": "752b5111-0bab-4007-b013-4764a10641c7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941811, "uuid": "a8cf4f2f-e5e1-458e-b9d7-af1e46c03052", "value": "eeb127110f45a3d9635aefdcc0bc0af961df068e69069cc77ab7b283c536e553", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e06031e0-3ca8-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635945655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635945655, "uuid": "13514195-0873-4aa8-8c85-2f22015de8c8", "comment": "Malware payload (AgentTesla)", "value": "15abb953813a9c34241f687e6684cbd3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635945655, "uuid": "4db30a2e-1a89-4450-9f31-6a53c43b42ad", "comment": "Malware payload (AgentTesla)", "value": "ef0754bdec62a151c183b0446ba026ee8511e27b32810f71f7c864d703c584fb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635945655, "uuid": "d080063a-e260-415a-81f5-c67cb6abbc45", "comment": "Malware payload (AgentTesla)", "value": "e0eff31b1f9e4957d70183c1ae69facb0a1669f2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635945655, "uuid": "eb7a2600-34c9-491a-8cd4-5b55f0867756", "comment": "Malware payload (AgentTesla)", "value": "199e6bf091d722880f503e0950ea8d1af1380e11a670323fa1a6f69350b65767fe0b497f982ad1099d989cba019d8129", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635945655, "uuid": "7fa24790-cf83-4996-acf5-3ccf9011a1ec", "value": "T105351212B6D14471D0362D325935BB11AE3C7D202F24DE1EB7D06F6DEBB2281A529BE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635945655, "uuid": "f2cd56d8-e3f6-4557-8916-0468c9a553b6", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635945655, "uuid": "930bdc86-3910-4a54-85df-0bee5a6937f1", "value": "24576:TAOcZ4ZK1CeeXyVaHlMkqTlOiTpQ+ZJgi+nDKlm/:10XaHCJlOiTPZJlQ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635945655, "uuid": "3b1a39da-05af-4cea-9591-5f65a47ed711", "value": 1110523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635945655, "uuid": "5a23a2ee-9d5f-4658-8faa-e7c6c034cb83", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635945655, "uuid": "afbd413b-63bc-47c5-aea7-1062bef8bd9f", "value": "Quotation Required Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7123a30-3ca4-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1635943949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635943949, "uuid": "ba5c694f-5fcd-4ebf-baf1-ab798a24d102", "comment": "Malware payload (GuLoader)", "value": "fdd20a047c8f090ee3443aefb600515f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635943949, "uuid": "7ed4ecf8-0c4e-4c6f-a68e-7874d21eb51f", "comment": "Malware payload (GuLoader)", "value": "ef0aac038740640a60555205552983cdc2c8fd689bdb90668f8783f75a09a2d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635943949, "uuid": "37b2cdd5-32f0-418d-884a-c3a03b6b03e8", "comment": "Malware payload (GuLoader)", "value": "31a35c6e0d65ea0f35d5f772a13703aa0c2e36b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635943949, "uuid": "13a559cf-2d51-4239-b987-9bf42ac39428", "comment": "Malware payload (GuLoader)", "value": "fd94dca1629083a6894485866295f572d3a2b8733f8c25cb313ed6714a9a0992718aa9ede2566f2ce11c504ead6d8543", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635943949, "uuid": "cf6423ab-c00f-4eea-ba1b-bad5a2abbf56", "value": "T15AB36C177E9DF80ED4B8F5B0C84076A02965EC643DA34D8E6FC47628F7F4B821921E99", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635943949, "uuid": "0ec33baf-3084-4fb0-b1a7-d32670f5e016", "value": "2833515ab53afc9fa809b5fcd09fa203", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635943949, "uuid": "fa21ff67-3dc9-463e-9106-b9cb74450a31", "value": "1536:/lamDRHccNYf1O1Ia/KgJ4+e9gGBPkMPvBX4HS:9amN8cNIO1QgJ4+e9hL6S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635943949, "uuid": "df4671af-e845-4172-ae1d-9469cc9f8aa7", "value": 114688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635943949, "uuid": "44151e96-8ded-4d5b-9b81-32589951076f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635943949, "uuid": "922358fa-a24f-41e5-a78f-628181e3a233", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "635fbc41-3c99-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1635939003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635939003, "uuid": "f480c1fe-c814-44fb-ad88-7b81413f0bc1", "comment": "Malware payload (SnakeKeylogger)", "value": "a0d1c255a573fd68d17b80875ed8f5bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635939003, "uuid": "0fb17200-0721-4cb3-9083-1baa837d7c8c", "comment": "Malware payload (SnakeKeylogger)", "value": "ef76819a8f32c201caf68bd2513a89d2db27c7a48e48b2b4ed061d650d756386", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635939003, "uuid": "fbce7ba8-d88b-4bc6-a690-83129bbf7b34", "comment": "Malware payload (SnakeKeylogger)", "value": "33b5de95c3417178f33fa1ff4b4d3048467ae29e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635939003, "uuid": "8c20d282-c14b-4d28-bc13-66461ae5ffd9", "comment": "Malware payload (SnakeKeylogger)", "value": "35a71874b3d35aa366c138ce392130451209e0b66ba5453046b4394664291c9157d9beeb8b257992288b63108ed7f397", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635939003, "uuid": "5bbf345e-6321-40ff-872e-ee4e54312b31", "value": "T1BD94EF45366C8B15C72CB3F564AA8340BBB5BE3E1842E64D2D8A71CB0AB33518F75D47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635939003, "uuid": "edb911e0-35f8-48ad-a221-422506dc6702", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635939003, "uuid": "edf373cb-9ba3-42bd-8f3e-f5142473d7e1", "value": "12288:QDIbw8eGr1FYMe372rDTmyR+YlXHcBQD4y41fUB2g:Q0bw8eGr1CrQmyR+YlXHcny4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635939003, "uuid": "299e174d-1419-4b79-b4b7-c015373b713d", "value": 408576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635939003, "uuid": "315a5b3d-e8e1-4496-be9d-63782bdecaed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635939003, "uuid": "fa625787-7336-46ba-b2f2-834ba75aac2c", "value": "New PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8ac934e-3cee-11ec-843c-42010a9c0014", "comment": "Malware payload (DCRat)", "timestamp": 1635975680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635975680, "uuid": "82c01d87-2114-4873-b916-cc877642f9af", "comment": "Malware payload (DCRat)", "value": "8ec4e097f5f5ccf81400c7ad330c2fd5", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635975680, "uuid": "d5a9b5f6-da28-47ae-bd55-c83125a36848", "comment": "Malware payload (DCRat)", "value": "efc5f59b8176c528faf02bef217ea9babf7294c81501e1af81831181136c53d2", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635975680, "uuid": "9cbdb656-0832-4e64-ad59-b3417334d566", "comment": "Malware payload (DCRat)", "value": "98c372b5f6c1cd4d39cf662c6ee60c0b2c515fc2", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635975680, "uuid": "b70161d8-8f53-42d9-ad3b-92b458de48d9", "comment": "Malware payload (DCRat)", "value": "4e8b2e7bb981a0d38d34744ea35b995bf14c9be7fcf94b3c7ca128711327a4fa826427303e0ce891390cf5540276586d", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635975680, "uuid": "d5026254-b0a6-4e4e-8e7a-5ab0aef1c5f0", "value": "T18B4549127A84CE52D629163BC5EF406447BCBD017A62DF1B7EAE339E61113A36E0D1CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635975680, "uuid": "8ef477c9-f67d-4fd0-a023-0fb239755976", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635975680, "uuid": "2d1f54b9-8a10-456c-aeac-42c7056f6741", "value": "24576:U2G/nvxW3Ww0tK4pykeV7XFqZWfBZ3zX4eGOOR0+4r:UbA30ckeV7CWf/LN6E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635975680, "uuid": "1e656745-863e-43c6-ab38-5e3a10b0d87c", "value": 1251080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635975680, "uuid": "fe482c76-087a-4c86-a2e2-271acafff2e9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635975680, "uuid": "53012ecf-d59d-4891-8809-e78700a7a108", "value": "8ec4e097f5f5ccf81400c7ad330c2fd5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "126e1a84-3c73-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635922546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635922546, "uuid": "72e76860-1b08-46fb-ac57-71d3537dbea8", "comment": "Malware payload (AgentTesla)", "value": "eac246b470c6180e61df7a1c50ef14b4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635922546, "uuid": "8ef7fe56-619d-446e-bb89-19edf4d63bba", "comment": "Malware payload (AgentTesla)", "value": "f14059f113f4a4f314271e2df1308a5337e99d69477249b0002e803d3af91328", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635922546, "uuid": "5a52213d-5cd9-4bf9-8e00-b36ce1658399", "comment": "Malware payload (AgentTesla)", "value": "2276a6486d21626ef7414b4a4211f47fefba22d2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635922546, "uuid": "b6f13db1-4bd4-4445-a699-05138c53698f", "comment": "Malware payload (AgentTesla)", "value": "2faad54d3c2dafcb4c3076f9d4419835bef3a0db756a78f26d31b54d5130fe91b38b3bf9544b4616f2305d6f95eee68c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635922546, "uuid": "c2ff3cd0-3b56-43ea-a75e-66088a85b1c4", "value": "T156B423762BCCD60A4E0AD0E69E5B507984C72B3293D1C20661AB721F7FED09C9BE41D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635922546, "uuid": "5871547c-488e-4adf-a9c1-66ad66e02fde", "value": "12288:C1RE2A+0gcVTQrRJ/wHYBsWQmFX5gem5u7EzqFELhl+8:C1WIcVTgRWHYeWxFX5fm5KNFELT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635922546, "uuid": "beba9d3a-a8c5-43c7-92bb-0332c06c4119", "value": 515571, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635922546, "uuid": "54c1491c-478f-4806-b432-cbaaa9dbdb95", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635922546, "uuid": "11d17bab-0c6a-4ae2-97f8-ce80913b16d6", "value": "TRANSFER SLIP (2).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13ac07f8-3c5f-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635913959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635913959, "uuid": "ac6648c1-69bf-4473-afe1-e135f0bb5b15", "comment": "Malware payload (RedLineStealer)", "value": "a12e30f4c354f10ad9807d63331bc8be", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635913959, "uuid": "2f63621e-14b7-4edf-9855-093ce2d2f9fb", "comment": "Malware payload (RedLineStealer)", "value": "f1bf3808bd2a90a84ef3b4a122616281065f600fc38fc92224eb47738e4dfdd0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635913959, "uuid": "86c370b9-50e9-4615-b64e-97ae781ae105", "comment": "Malware payload (RedLineStealer)", "value": "2bbfa01aa381f26c88e8803f6c7f8557b7ec4e9b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635913959, "uuid": "9c19f60d-04ff-4b22-a418-3ec969ac2e0d", "comment": "Malware payload (RedLineStealer)", "value": "5bf8a6d557e09dbc0c742abb4f52d83d9af0ddcb7d0567acd94d1c173d7266fc70c55f1594141b1108bd0caf77fea48f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635913959, "uuid": "ec91f547-47bd-45f2-8678-8b4372ccb3a5", "value": "T12B84CF10E7A1C034F0B612F84AB9A268B93E7DE16B7450CF12D956EE4B386E5EC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635913959, "uuid": "6bc2b760-d267-4852-86b8-09af58ba8b6f", "value": "7e51d9833813c1a3fb57baba54855909", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635913959, "uuid": "4afa244a-e173-4634-b343-b35d92fce7eb", "value": "6144:UXk9bhENGp/Z8rpUNrvtvY2i5xxna+ZEIel3UYy0QyUQ:U09FkGp/qpQpvNuxna+ZEx3UYRQD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635913959, "uuid": "33edd1c4-07fa-448c-8102-919b250ac1f9", "value": 407552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635913959, "uuid": "87f5de9f-6696-43b8-a30f-1df9b81c489b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635913959, "uuid": "53d49ea8-90dd-4e9a-869f-33c30dbc02a3", "value": "a12e30f4c354f10ad9807d63331bc8be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "925f1eea-3c46-11ec-843c-42010a9c0014", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1635903434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635903434, "uuid": "bda12d11-2a89-4d3e-bfe6-c9729b39f1c1", "comment": "Malware payload (AveMariaRAT)", "value": "a1ee1882a908c82b4ba00730399cc815", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635903434, "uuid": "f1058790-e222-46d4-94cf-2699d7d4b536", "comment": "Malware payload (AveMariaRAT)", "value": "f2052e40e4ac02d98c4b1ec658b450fd7d9dbb0fc9dfea4de51f5857bfcf8133", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635903434, "uuid": "90141aaa-4239-4b59-87d2-b4c3ff3945fd", "comment": "Malware payload (AveMariaRAT)", "value": "67a7c7dde00c5248dc618f267aef3929e6267afe", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635903434, "uuid": "3b04d16c-f88b-409f-bcc0-720a983a8d56", "comment": "Malware payload (AveMariaRAT)", "value": "71f7f0d556606c97a364427aed4acb25ec76a6dabc52ac82c58837296202079e9cfec2b278a00ec545863d028606324b", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635903434, "uuid": "8990d89b-1175-46e0-b8d3-2f91369f51cb", "value": "T183A48E023189ACDAE4536DB25CBFD53061696E5E5139CA0E3293BF2B55F3342306BB4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635903434, "uuid": "1e923431-21b1-4dca-bfbd-4c0f5389791a", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635903434, "uuid": "d4194a25-474d-4983-9f1b-918aad8ae42e", "value": "12288:wbrhm4UZMFrF9noRX5MTOFMbrq4Z5IlNbf8LCKJTerN:ErnUWFrFi5MTO0rq4Z+HCCoerN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635903434, "uuid": "4995e538-8295-45e4-8418-cc066e694407", "value": 482806, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635903434, "uuid": "fe629f5a-f91b-4fc3-93fb-928944ce4f6b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635903434, "uuid": "a8a67a64-f9e3-47f7-a2c4-f8df85f4ed4b", "value": "42755 NORINCO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4795a55-3c7f-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635927945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635927945, "uuid": "d1d9491e-30e1-49fd-88ef-8e6280fc043b", "comment": "Malware payload (Formbook)", "value": "a7f0349f75c38b54c62c04a8040f719e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635927945, "uuid": "dba48803-8124-4651-af70-4e53354bbd41", "comment": "Malware payload (Formbook)", "value": "f235fd6ad540e3d6d8777b27c927cbf15a3317151dcd9306ec82486f9b9ef41f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635927945, "uuid": "4f29d5d5-3852-4747-ace1-3b8e6c39f950", "comment": "Malware payload (Formbook)", "value": "1b2b8a1a15c16b51841cecb99e803f8d608eeae2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635927945, "uuid": "09bcc224-b310-461b-81c3-edcfa6074874", "comment": "Malware payload (Formbook)", "value": "2b0fd71452e06628dccbb5e1d99a31c9e29f8f289657f2a6475b3021a48cc225a05934394655199e0778167f8a0d9128", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635927945, "uuid": "68c45a2a-1f20-4d0f-a9f6-67d4de8fc13f", "value": "T1BB16335311EA8013D733DFB4A91E308F6732B2E8C62F995F7B05351A6B8D16B1929ED0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635927945, "uuid": "58cfe45b-419f-47a7-bcdb-eeea0301726c", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635927945, "uuid": "948314dd-bd24-484b-a81f-d1b55d435558", "value": "98304:JZqTKXMsHG7zXMqxN0uChGAPW9lpcSVgz8jIK75O5n5eo1u:JQg4X5YukGIW9+a1U5eJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635927945, "uuid": "8efa5397-8002-44e5-89ba-deab2d65b9a4", "value": 4357498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635927945, "uuid": "d6b3f195-01f4-4dbe-9abf-5062868f37be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635927945, "uuid": "cac9c5cc-7a35-40f2-a929-dad36b95e812", "value": "a7f0349f75c38b54c62c04a8040f719e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f10a902-3cd3-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1635963934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635963934, "uuid": "925fb4a9-96c0-465a-9498-5b85fac7abe9", "comment": "Malware payload (Dridex)", "value": "d3b6b5d4209ae7ba5a0818c20573dfb8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635963934, "uuid": "816db62d-a479-48b1-ac55-6bc2c980f951", "comment": "Malware payload (Dridex)", "value": "f267239bf2004eeafdf30ba02f3bcb1722f3ec5402f486e0bffafcc0ca53376c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635963934, "uuid": "0aae527f-d71b-47e0-963c-e44361167077", "comment": "Malware payload (Dridex)", "value": "0f50dcc23962ba0d6854b00e4ac0fd2084f94515", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635963934, "uuid": "ae5b9494-027e-4833-936c-d5cd5c26d123", "comment": "Malware payload (Dridex)", "value": "599a346cd84827e3db8d28e52f8b4b05d06664e70c3b82774195e1ce7413652ac3cdc96fb7951f2e8ebc0819bac5bdec", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635963934, "uuid": "d0bb6738-515e-4215-a638-d308e586bb5e", "value": "T1F6A4BF04C1EA0676D52B62FE75FF0CCA47104DF9B506AC84D3435A5A5B32FEC3A7A84A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635963934, "uuid": "b24dd8ad-13af-4a30-83c1-22a3a37ac832", "value": "ccdf79216449388cf5a36d38a385d866", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635963934, "uuid": "0f7fdd8f-4010-4c45-a5a6-27714f174c2a", "value": "12288:6ZKEZNxJPdthZz/MqmOce24Wqa+cKdDSFczjJgiUCeoCqoE:6ZKEr/1jhz17Px", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635963934, "uuid": "45e9b40a-25f8-4fee-964f-9cf84e3f72d8", "value": 471040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635963934, "uuid": "c9902673-53ca-4508-937e-9ce159989ca9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635963934, "uuid": "0ca41116-785f-44a1-a69f-48efd1cec794", "value": "SecuriteInfo.com.Drixed-FJXD3B6B5D4209A.31918.4897", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b2c368d-3ce2-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635970396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970396, "uuid": "6f6eac93-5a98-452a-b35c-266f7e0aaced", "comment": "Malware payload (RaccoonStealer)", "value": "257821abd783205585f9488e38394db8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970396, "uuid": "cead1c92-10e8-478d-8006-85b939853417", "comment": "Malware payload (RaccoonStealer)", "value": "f2aadfbc2f3da3c6d9663a10a5ba0691dcaf46a52371ec11f459465868bb6874", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970396, "uuid": "4bebd744-0386-47b3-8c5a-7736d8134f31", "comment": "Malware payload (RaccoonStealer)", "value": "2b18b9fe15be34f809eb212dca1972a64d5ac77d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970396, "uuid": "ca726f8c-4087-4b7d-900d-80c7b2b31cc3", "comment": "Malware payload (RaccoonStealer)", "value": "68f39c623539141805c702ea2b3e96123ec8e93a619d28f6e310cd61f80e6d2ab709a3f44846b24c762b3510a2ed6203", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970396, "uuid": "11d4267e-2eca-470d-8501-187e7bbb9db9", "value": "T1A5C4E000A7A1C034F4B656F84AB69269B53F7DA16B3494CF13D926EE4B74AE0EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970396, "uuid": "492b7916-472f-4979-90a1-389cbb3bcc8c", "value": "59ee824971f432b778ca9bd24dd5ed5f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970396, "uuid": "a64d3973-3ff8-4883-adb8-e0734569c39f", "value": "12288:1f7pmuV3FBuwLGk3TVUmdLyNgKwV0QcBw8M4zmADM/:x7IuVVBuQ6mNtqDBz0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635970396, "uuid": "21b76291-5be3-4ba4-b40e-2fef7731c047", "value": 552964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635970396, "uuid": "79739559-97db-4dc6-8372-63f5c4006bc7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970396, "uuid": "5bb5f160-16f5-4efb-9e97-a2e47fb3f8a3", "value": "257821abd783205585f9488e38394db8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e081a9d6-3cd9-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635966701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966701, "uuid": "b279656b-3911-4807-992b-f2a56d5834cf", "comment": "Malware payload (AgentTesla)", "value": "affeee86f202b4bfbc4b562d8dd4d2b8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966701, "uuid": "509e8959-c383-4f3f-a9ab-48ec15ae82fc", "comment": "Malware payload (AgentTesla)", "value": "f5ef3b61a69bc7fa6a82a0ae54c02842d96687752b9c25150574a9cc5aae2c24", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966701, "uuid": "a2090498-364d-4b41-ad9e-932f3ebbfc14", "comment": "Malware payload (AgentTesla)", "value": "d066fd1097e0d70dfc2d22be6a5c7a14ef191bc8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966701, "uuid": "5c19f760-0984-4556-a1f8-2456cd93bfd3", "comment": "Malware payload (AgentTesla)", "value": "2b88ce14270da266127880c9a36c775eadd751f51424a8a8692504d827429a40d2c3c4ef3df372039019b130322061b8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966701, "uuid": "e100529a-4e65-46bf-939b-46506ed8525c", "value": "T1E914125FFC35A6FAEB83BAB359F4378987B2AC15AC38A8073A10F1745537543111506B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966701, "uuid": "3974423d-d494-4e7c-a43d-6e28a1512b1e", "value": "3072:/Ljd0MEfjGXuixaSWFjxOMzs4X//ybPD5dyPlhECiMHaDPOIjSRGA287DNQQUXF2:zW3feIFnzfybPDfEECnoWCSR88HNwcnF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635966701, "uuid": "1de09140-d4ee-459e-ab2a-86ce6f8cb820", "value": 206568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635966701, "uuid": "8f69ff46-be47-4f43-acd8-5f09e0312eb3", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966701, "uuid": "d85ba5dd-e1ce-494c-8216-3b23f78a3ab7", "value": "Proforma inv..xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "055857b5-3ce3-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1635970628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970628, "uuid": "1dbb12ca-0b2f-488e-826b-ab3bbcaa1ca2", "comment": "Malware payload (RaccoonStealer)", "value": "f12bcb53a7dc757da0f6ffc5249ba5b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970628, "uuid": "7e14ae97-fc20-486a-86c7-f88620eb4bf2", "comment": "Malware payload (RaccoonStealer)", "value": "f6029d0784b4e31957c8f086acf3748e27e63f517cae08f8ae56b64fe7e4a2ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970628, "uuid": "d4ec467c-482d-48ea-a64f-5b6630087a9e", "comment": "Malware payload (RaccoonStealer)", "value": "01980c2d31d10f4d1110f9be81383ebe4e5e317c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970628, "uuid": "75d8aa6e-ed15-4483-96f4-17c44de8756b", "comment": "Malware payload (RaccoonStealer)", "value": "c31231862172be9de1fb940988f6dd097e2d8a5be297b8e5e5b0111c137eaa3bc9f41d99b70292febcac3c9441d2d7ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970628, "uuid": "c219ca45-feb0-4da3-9007-5f1229cfd8be", "value": "T12BC4D000A6E1C034F0F652F449BA9369A93F3EA1AB3454CF16D926E95778AE0FC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970628, "uuid": "ebfd6b07-4a80-4ab5-8cc4-79d0bb227137", "value": "e024db68009cf7f32dd817cae1867bf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970628, "uuid": "2959470d-acec-466f-a8b6-ccde5bba3bc5", "value": "12288:diO/kHaqXrbeFDeA5DMld0FBJdZdUTch9QZqwjidyW/vl:ALjXweA5YIFpZMcnHd5l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635970628, "uuid": "1cef23b6-8caf-4e18-970c-8766d6304775", "value": 551424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635970628, "uuid": "1839d8bc-d410-4e5d-819e-1a5d0f7ee78c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970628, "uuid": "84f601c9-9787-4fdc-93bc-22e21d6a0ac0", "value": "f12bcb53a7dc757da0f6ffc5249ba5b9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37b538d3-3cb4-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635950526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635950526, "uuid": "8a36344b-caa4-45ff-9bf2-31371b9392f2", "comment": "Malware payload (RedLineStealer)", "value": "dfe1f6881bc4a08b4490425d40e677e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635950526, "uuid": "f7cc732b-2b58-49d6-bf78-c79df616fb31", "comment": "Malware payload (RedLineStealer)", "value": "f67b8ca39c114ffba7a4835e2d9104dfeb82b7bdce12de99c23db82c74fbe51a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635950526, "uuid": "95dc338a-50ca-44ac-9674-e6dca81f37b3", "comment": "Malware payload (RedLineStealer)", "value": "4db2096dc91e683900853333a78fb210cc91a4fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635950526, "uuid": "bc6c6ea3-58a9-472e-be9a-7fb055fcc6e4", "comment": "Malware payload (RedLineStealer)", "value": "ecaba74d30d568d9e431106f07677a44ab002d99751b0ed8fa5872d3e47daf5eb731360ec4e2c48e84ade4ee037883a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635950526, "uuid": "6b66c65c-cb70-41c4-b7e5-ec9ad8126f26", "value": "T1F4941EB822DEC61DCF4425B797A3BE308B2E1DC1832757D97709A9E08E791E12E0D257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635950526, "uuid": "cf9dd13b-00b2-4045-aea7-49936a9e2e03", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635950526, "uuid": "fc7372ec-6295-4d75-8281-1c6ab5028da0", "value": "6144:mINM4ittERdRaKjCnBj8HoTXFvsjFnsgduQMV:mrqjQCH9bduQK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635950526, "uuid": "eb815df7-d1cc-4c66-85f9-1c754c1482bd", "value": 410016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635950526, "uuid": "c3a69b56-dad6-4f4b-9e58-3e09e1644b37", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635950526, "uuid": "dd2855ad-2665-4af5-8f3b-83308b402a34", "value": "CheatUpdate.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7a2a17a-3ce1-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1635970095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970095, "uuid": "f0eb28be-f925-4934-9db4-360c506f19fd", "comment": "Malware payload (Dridex)", "value": "d44d18b5e40002c7fcae488509af8982", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970095, "uuid": "0328893f-d797-446f-ae51-efbec52398c4", "comment": "Malware payload (Dridex)", "value": "f6891c049ad794609629a2cd0f88491c22d9977ff7653360be2d2bfcc4c1e9cd", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970095, "uuid": "5d3808c5-889e-4cb9-b814-7c28e7096bc7", "comment": "Malware payload (Dridex)", "value": "73a0e6f12bed1ef03003452e9c9d98c9da612ef5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970095, "uuid": "1acc9fc4-e7c0-489d-a478-61ff20179998", "comment": "Malware payload (Dridex)", "value": "438ddad19efc36e78fb2ba034caeae64e0cea451c4a79c375099c87cb01c113d3e70157b431b5decba668ff5d16ad0b4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970095, "uuid": "3ec9ff46-f683-4b53-8329-1d491a883127", "value": "T19273025F92A872C5C35BE87D024E0862BD62A6166CC49BEF1DE5E70D61E1383B70E41F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970095, "uuid": "afce7086-cff8-4244-8016-f87c8db70262", "value": "1536:8CWmPZZKz/1eCzbqzLkh/OPvTFVRzzgmSyA4VY3PgyYSs5/F3wMY:83mEz/9qGWPvZVRzzgmSZp3jnsxF3wX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635970095, "uuid": "8545f3f7-36d3-44fd-ba2d-51471cd42a1a", "value": 80350, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635970095, "uuid": "895ea8c7-7d8b-46c0-9409-9784c7edd043", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970095, "uuid": "39dc350a-9f15-47c1-a42f-02bc3610976f", "value": "Order-135078.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8128eb0e-3c9e-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635941201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941201, "uuid": "3c318976-e777-4291-9a98-03cf80cd33ea", "comment": "Malware payload (AgentTesla)", "value": "9932bdc9a79c04fa59092a638b633f4e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941201, "uuid": "f14885ef-c335-479d-89a0-02c9d84074d6", "comment": "Malware payload (AgentTesla)", "value": "f6d1f91e538dff80f6111eaaf7b95d829d0b014b54d4e832a0e0d50f539099e9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941201, "uuid": "d0acd66a-58ee-4bdb-bb40-336058f4f7ee", "comment": "Malware payload (AgentTesla)", "value": "0e920db65538b82e4af9f171050c2beb40a71f97", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941201, "uuid": "5fc14b08-5e42-4ce8-8a4b-8a019cb72d11", "comment": "Malware payload (AgentTesla)", "value": "8f168d459db835913d8fcf25f61b16555f03087c5595a4755618d06ff57c385256afa0f95e81a898a754a517a9056dab", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941201, "uuid": "570b9431-ebfe-4e4d-91d1-7a8715c79765", "value": "T17DA4F10636AD9B15C72CB3F1609A9350B7B97D3A0852E54E2DCA72CE0A737424F35E93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941201, "uuid": "b361b641-3491-4d32-9268-242f0e42a4f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941201, "uuid": "d568cefd-2384-4938-9d65-f630034eeda7", "value": "12288:gxIbw8eG9pthb8YZS93CZUFNu7d4kkFCVZ1:gabw8eGPLb43CSNu+o1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635941201, "uuid": "7d2f6534-480a-4f1a-b793-86e12cbd10c8", "value": 488960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635941201, "uuid": "e9fe89d1-a52e-4c14-8c92-6b4454f823e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941201, "uuid": "d4c0e245-bdbd-4d5b-a2aa-ff51d65e22ab", "value": "Recibo de transferencia de pago para ES6783902021098046 03 11 2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4c9e1cf-3ca3-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635943542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635943542, "uuid": "3e5cd979-03d9-4766-8dd3-7d54dba64fdb", "comment": "Malware payload (Mirai)", "value": "198659eedf6373c25f54f6be8070c953", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635943542, "uuid": "8221a624-7b21-4dcf-98ed-7619af01572d", "comment": "Malware payload (Mirai)", "value": "f6e8f47d9bba68df3472aa5cf9a0303dfd0443b0af09d7ef63f8f02a6d37519b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635943542, "uuid": "587347df-7519-456f-9703-11184450530d", "comment": "Malware payload (Mirai)", "value": "cf922b9c0d1925bdf5ea2ce7b77e7c939a371450", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635943542, "uuid": "8bc54ef8-bc96-43cc-8176-5f985d309838", "comment": "Malware payload (Mirai)", "value": "fd2181941a64287abbbddc68b652c2095f14647459b1ae2f994975eafd750abb30f96990e40d2538946346cdc6c22eb8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635943542, "uuid": "09928717-9c85-4270-ad67-d89fa46d3c01", "value": "T157436B256A7A2E17C0E4B4BE22F74754B2E1665E25E8C61E7D330E4FFF21A50A0436F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635943542, "uuid": "be8d1a0a-ebcf-4e33-9ce2-ca4b125dae2a", "value": "768:Cuopf8bQPAZqRU+fECeU6tq9bXVh5PnXIsf0lkgUI7O+qoSJ/I:CuOoQAqRU6ECeU6tSbX/5PX5If3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635943542, "uuid": "e44e78ee-807c-4d5b-8305-9a33829b4c38", "value": 59664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635943542, "uuid": "9b6487f7-d236-44fd-9304-92e2378dd22e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635943542, "uuid": "b8ebe594-1a01-4b82-b245-cc82ca384e87", "value": "198659eedf6373c25f54f6be8070c953", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a44f6501-3cd2-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635963593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635963593, "uuid": "e25450e7-98ab-4b75-9448-f0830324a180", "comment": "Malware payload", "value": "5e2a45118445517b62afdb40ad02f624", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635963593, "uuid": "95c193c0-4c3b-4f1b-88c4-0c4fb0d4af36", "comment": "Malware payload", "value": "f6ea005ad45ca044b6575ba4e3e13b8e315657202b5a38a070066ad167e0bc62", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635963593, "uuid": "74f5e6a8-40d2-4fbf-9306-ecba284c107c", "comment": "Malware payload", "value": "499a7e90ba84c811e13e1e4438a5381b67f61255", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635963593, "uuid": "5b16f96a-6f81-44cd-bb43-ffaab66bf361", "comment": "Malware payload", "value": "8af89fdb77fe23580e42ba3b042966d5a47ef52506cbeaa120b6af615923f43d161f3d49de6d3fd8b6a15bafa879348f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635963593, "uuid": "e06613ad-41f0-4d58-8f35-970934607fa6", "value": "T1DAC533C722241E95D761B87081213B16B913C5D8A776C8BA27DF8E9B505B93FEF38312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635963593, "uuid": "b7a0325c-c73c-4831-9c7b-c047b0218dd7", "value": "511cff895609a1cf1f0a80aeee92ffc8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635963593, "uuid": "5b46a1df-8e88-41c3-8517-82b83848baf4", "value": "49152:xPZ4KxZh0CsnQLBNkgLAItP1OelOl6DcFz3nSG1waWlQBxR/:xHh0Cr3k3Itzc6DASAwazxR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635963593, "uuid": "0e27d10a-dcaf-4fef-8079-e451c529455b", "value": 2651036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635963593, "uuid": "69900e22-85f2-496d-8bd8-b9344fa17de0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635963593, "uuid": "f7022589-f978-407c-95e9-a5490b355367", "value": "5e2a45118445517b62afdb40ad02f624", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40524dc4-3cd8-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635966003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966003, "uuid": "010dbe7e-9585-44a9-970c-8ac3e5e5a2c3", "comment": "Malware payload (AgentTesla)", "value": "199e59926813eba310c9c218c2d8c7bb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966003, "uuid": "1f583919-4ab3-4ce2-8bba-0f475cc19db5", "comment": "Malware payload (AgentTesla)", "value": "f7285e3849b4215f2b70e8b4c0e0c6707953a6eae62f178cadc829f637cd88aa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966003, "uuid": "a1cd2a23-1ca0-4951-b131-f3213b4cd86f", "comment": "Malware payload (AgentTesla)", "value": "6964d83c27d93ad1cae4adb4112c1bac03d450d1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966003, "uuid": "2e99b4f9-51d9-4444-94c7-6bdddb1da001", "comment": "Malware payload (AgentTesla)", "value": "d1e679edf85931e8e12e8135528661de92f4b3521735869b7141128c010bfb63d8cfc7b6fbb01cd4fedde67264b73a56", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966003, "uuid": "2ebe07d8-42d8-4176-829e-4fd23ffa19a5", "value": "T19124185A6715D461CB5F417FC016820831F1DB03A72AD2CF5AE5D9FA2F812CEF92A8E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966003, "uuid": "cd5bdfc6-23ba-4a09-987d-2acbd8941757", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966003, "uuid": "541f8074-cf8f-4059-a6fe-e4d90cb0b9ac", "value": "3072:9GWLdEsUtFR7wF19JC0XhUsbSJzrF9TJFk5nXaoxSxF2NRNWb3vY4jy+tp9T:9M7w5JxxU1JT30KYNLWbvFWKp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635966003, "uuid": "1d1af73d-e489-41eb-a6ce-8400e58c94ab", "value": 219136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635966003, "uuid": "d7069710-9fe7-4d4f-9210-49b8dc967fa8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966003, "uuid": "19c3cc93-fb2c-46ce-852b-406057c9397a", "value": "199e59926813eba310c9c218c2d8c7bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9084f24f-3ca0-11ec-843c-42010a9c0014", "comment": "Malware payload (Kimsuky)", "timestamp": 1635942085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942085, "uuid": "e122c25a-3137-4993-b908-0b165440fa9a", "comment": "Malware payload (Kimsuky)", "value": "e98fae79f1c389313fcc27343ea2e359", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942085, "uuid": "31000859-4704-44c5-a48c-ba11bf4b2425", "comment": "Malware payload (Kimsuky)", "value": "f72efc60725e918d413b74dfa6a2782924ec701356ec4ded8f52008294dc0c00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942085, "uuid": "4a624dec-7339-4c63-bd16-e0e2152eb626", "comment": "Malware payload (Kimsuky)", "value": "8bf0703ed031054a1f19a37269d1e8b855bbc747", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942085, "uuid": "e66d94e7-971a-4571-ad21-b2d417935567", "comment": "Malware payload (Kimsuky)", "value": "7ae8b6441e2fc8b36f627994f4d651565ebce3ec97d58f0be551b2c81ef4c53c30ff36a99c63e4be4f37536a4e23eb2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942085, "uuid": "cade095f-607f-460f-aead-d3a2bc13292c", "value": "T1CE246C09B69004B1E857C1788AC38AC6E2B174498B75EBDF1760476E5F3B7F2AE39311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942085, "uuid": "c68ecaec-fa17-419a-84b1-fce30d592ec9", "value": "9b269df19a2df3d02c7048a35a449fce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942085, "uuid": "738e7a72-0df6-4303-94ad-1f0820efd1af", "value": "3072:AFSYAyju5JpkC7xfYZo9cPqvTV+ql4yFa+zB+K+H/kocFAQUG5R:AFJ0qC7xAZliT004+p10fkoefUG5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635942085, "uuid": "c1278b59-b91a-45d3-89ec-36e7ac91b93f", "value": 226816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635942085, "uuid": "f5dd74bb-904d-46c9-a890-6c771876b4fd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942085, "uuid": "024c010f-5f64-43b7-91c1-5771fed28f25", "value": "f72efc60725e918d413b74dfa6a2782924ec701356ec4ded8f52008294dc0c00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5088308-3ce2-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635970520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970520, "uuid": "dda9f03f-ad0c-4eb7-91ab-64628179b6bf", "comment": "Malware payload (Formbook)", "value": "7244d490d3bf1bafa56b539dccf6f75c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970520, "uuid": "17dcd056-6cf8-4f12-8d58-e387ccfe27b6", "comment": "Malware payload (Formbook)", "value": "f80f85e18cf0debe8a88bd545a1be3450175ec390fd14b38658e89503f3eca0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970520, "uuid": "68ccaa94-c4ec-4fea-8d1c-2c583094443f", "comment": "Malware payload (Formbook)", "value": "0fd97231d84926e9be8375a8e2f1c8c21a2b2abe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970520, "uuid": "6230e952-02a6-4403-9e55-d756361ca3ba", "comment": "Malware payload (Formbook)", "value": "b836ab93e6908231df6cd4f017801a46d6edcfcab4c1c8c5c8e48f5636f1e11b4dd3606286b3a32c40be5616cabb256e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970520, "uuid": "d374ffcf-fa90-4fc3-8a48-1ad9b1f3ff68", "value": "T195A4F002716C8B61C72CB7F570AA9310BBB0AD3A1413E64E2DCA71CA59773468F79E53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970520, "uuid": "4c1ebf80-7c1d-4fcf-809f-8c7a1ce55255", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970520, "uuid": "ccb4dff8-e6e4-42dc-a8d1-0552160d8c9e", "value": "12288:E9Ibw8eGB62ZfuIzklLXh6Pc7ChgPsy3DexFMeY3SIR1:Embw8eGBHZwMc7nPzDeIeY3f1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635970520, "uuid": "6b897be1-fc41-4f85-b081-077cd1e61650", "value": 477696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635970520, "uuid": "4ebab657-a264-4ee1-9800-588744409d87", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970520, "uuid": "0ec87742-737b-4c01-855c-f3ecd44bebf7", "value": "7244d490d3bf1bafa56b539dccf6f75c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b096bccb-3cae-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1635948152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635948152, "uuid": "b120535e-7124-4cbb-b38c-10a2347b7eb3", "comment": "Malware payload (Formbook)", "value": "9150940760194f5f4e608a66eed2d0a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635948152, "uuid": "c3a14752-ca09-41fe-a11a-887028be40a0", "comment": "Malware payload (Formbook)", "value": "f8d83d34e0fc406604af9a11462e8e8ad2b3cd5d3cebe4576e1792a3b861e84b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635948152, "uuid": "b57e8038-0c2c-46d1-a612-cfe87e770eb0", "comment": "Malware payload (Formbook)", "value": "416e29c7a5f80968f7581a2fbf05fdd99fc212da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635948152, "uuid": "dd5ab2eb-a385-48ac-81e8-31f3ff69cd2b", "comment": "Malware payload (Formbook)", "value": "94607f076f58c38c4d9bd5ff8af7bd04ffdc44e98cfbea4522e40374ef393f4dacf47711eb0c2a410864c02f85ae1052", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635948152, "uuid": "c346cc1b-4f0b-4a2a-9471-a3f9dc717103", "value": "T1A6053720F35D88C9CAFD7634CF29D57013616C6E69108A1D24F43EFBBABD2136631A5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635948152, "uuid": "844b6718-e453-491f-ac6c-c2a5025e802b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635948152, "uuid": "7963553d-c3b0-4b62-a003-f8c1df019c65", "value": "12288:+jSYm0ziXGKiMdEvyqcJ8mqlwxxndhLvj1RkJJLTQV0:X90OWK1dEkJ7/ndh/1uXUV0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635948152, "uuid": "53d84d78-930b-4b7f-a1b2-0524496c5822", "value": 839168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635948152, "uuid": "57b9897b-eddd-4d2a-b4aa-06a323dfe6c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635948152, "uuid": "a63b30e7-d680-42a0-822c-de9d826fea57", "value": "Drawings HQ30-DM140.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5e9fb6d-3cc3-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635957261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635957261, "uuid": "dec76149-8bc2-49b0-aed0-884f031aabc3", "comment": "Malware payload (AgentTesla)", "value": "e9b4264184b3f6b9b2eee0807a8d8723", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635957261, "uuid": "057c8ae7-0c8d-4dda-9402-3bc1ff1c7a5a", "comment": "Malware payload (AgentTesla)", "value": "f9f0270bade7891b2db9b9d5ac587be12658c4bb9c30556e237b08a1c0e1a50b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635957261, "uuid": "c15a40f8-a48b-41a4-a13c-a3af6694f014", "comment": "Malware payload (AgentTesla)", "value": "bd861924588f76a2a88a536b2c26da4b5939cdaf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635957261, "uuid": "63e93db0-4ef0-4ad1-925d-891d212a38e6", "comment": "Malware payload (AgentTesla)", "value": "7082aaa7f52d2c5cf92e93b432f64481fda3095de792b2c413aba14e0c75a776d91d1539e928f72db871da94350f60e2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635957261, "uuid": "0eeffef8-a974-46ed-8613-a73b7f539009", "value": "T17AF4E1326245AF95EF7A1FB8C40120410FF46C1B975EC257FE9A3CA63BFE552CA24A50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635957261, "uuid": "99e57217-56cd-44ab-9627-434c749a8156", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635957261, "uuid": "3d6b0900-5901-44e0-93dd-78712e0782dc", "value": "12288:R7iqJFTPkpqd3D/2xmajoXneQQw8g0D7GNdNdnTtw3HuCb8UgWA:R7iq4E5kaelwO0xTtA5b8UA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635957261, "uuid": "7ad35a4a-09e8-4506-bce8-f07c7c5e2720", "value": 782336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635957261, "uuid": "faf987a9-6335-4a5f-9f04-62adb6e023e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635957261, "uuid": "57316de6-369e-4b45-973a-a733791d0ec7", "value": "Kopie von Kopie von Kopie von Data-Matrix-Label Yeso- 2021 PO45179437 Lot 2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af1b7094-3c48-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635904341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635904341, "uuid": "1bee35c5-10dc-441a-9b95-1b258371c2ac", "comment": "Malware payload (Mirai)", "value": "48bfe55d7795f2d6905c6cdbea372b9b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635904341, "uuid": "c0e646fb-97b2-4c6f-b122-42eba7c99f69", "comment": "Malware payload (Mirai)", "value": "fa1be914982a111f999fee0ed612d94ba9d0792257ee54c41acba3c2126e35ab", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635904341, "uuid": "3209577e-50ce-41f0-90a6-1162e8b6006c", "comment": "Malware payload (Mirai)", "value": "760d6b9c2779c3bb8f5eb2c8e1b95824fb8277dc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635904341, "uuid": "cd4da6de-c570-4bba-bf78-3c303fef824d", "comment": "Malware payload (Mirai)", "value": "8329ab8c0ede36ef72fd2f9f6d15f171f06476a9e50a35a4b40dac3b91526f356a621b02e18209707addcd747dc4da00", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635904341, "uuid": "4f55b526-e710-4dc6-ac78-944d449332aa", "value": "T1FC833BC5B953E9F4DC1209322077FF369E76E1BE2214DE83D3A85673AD52A03E10269D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635904341, "uuid": "975b93d2-2400-44bf-8cd5-57ad55b5a1e4", "value": "1536:hNw7TjznqVg1WeAvqwjP1Zr7uuInqYtHsnYkf01hwkq/rnVzWX9yX/miwwEH:fw7vzdrAvhjP1Zr7/InqYtHsnw16kErK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635904341, "uuid": "7e75949c-a803-477d-b325-41f367f974c0", "value": 86800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635904341, "uuid": "90be97d2-03a6-4b8e-93ac-0313e65e6611", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635904341, "uuid": "be80e0a5-b4c6-452c-846a-713fe9506ff4", "value": "x86-20211103-0152", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9fb02ad-3c8a-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1635932706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635932706, "uuid": "9fd5ab87-9110-4efa-97fc-bbf20015608d", "comment": "Malware payload (SnakeKeylogger)", "value": "831bc325b7b0873a10425d7185f0b900", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635932706, "uuid": "63566ae6-f31b-460d-b044-d08aad5ade7c", "comment": "Malware payload (SnakeKeylogger)", "value": "fa7eec6b007ef08dd8a91194c6dadaaaaaad837e18531efa3293f2152a0d2e92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635932706, "uuid": "50993454-8492-467e-8eb8-4fca0e19daf1", "comment": "Malware payload (SnakeKeylogger)", "value": "025517b0c12441b7f28a295819b741c5091d503d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635932706, "uuid": "6e157bce-e3a9-4387-9529-f14c8ecee10d", "comment": "Malware payload (SnakeKeylogger)", "value": "6954858dfc74bc8c0e86cb07a9df97c4f10b12ddf7b40adbe8bfbb4f1aef38a824bcb502af1cda74b97d4d178e20e0cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635932706, "uuid": "ab69880e-beac-4fc0-9a65-723851888908", "value": "T12484E082756C8B11CB9CB7F9B4999350B7B52D3A0412E24E2DCAB0CE5AB33418F75D87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635932706, "uuid": "d301e0a9-e19d-434c-aa72-c996f593e2e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635932706, "uuid": "27b88542-7863-44cd-824e-6b323fbebca5", "value": "12288:jOIbw8eGXYlCwNbqo5WiovvAiirDWaE64crPfD1:jRbw8eGXO3WidikDWax1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635932706, "uuid": "23df92b9-7dc1-4bf5-9cd8-b3dbaf134901", "value": 401920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635932706, "uuid": "e66414b3-75e2-4449-9ac0-d9e7e73fb6e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635932706, "uuid": "1f944afa-90f8-43f9-a4bf-4d771794c12f", "value": "4adad6HZnriFji8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e8e1904-3c4c-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1635905978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905978, "uuid": "b9c1d0a6-87b0-4853-adda-3b7c3966b131", "comment": "Malware payload (Mirai)", "value": "5d9fe50219a65b660caca6c99422311f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905978, "uuid": "e30e99c7-f2ae-47df-b9c9-142bb4b58411", "comment": "Malware payload (Mirai)", "value": "fa80ac77e37388f1754bf59ffeaf1ad0de536b7aa3100185292d58eb65a24eac", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905978, "uuid": "979deae0-bfe3-493a-8b7f-ce1607b10c25", "comment": "Malware payload (Mirai)", "value": "3f467c6710e8cc08fe58dcb460023b819094e950", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635905978, "uuid": "d786bfef-1342-4446-961e-7a023c484dc9", "comment": "Malware payload (Mirai)", "value": "39ab07f8a42de37afdbe8e1662b5a41349578881b61d327d67a16264639874a348bc0606194c026f07a3b023c16c2b23", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905978, "uuid": "823411c7-bea1-4e7c-adc2-c56aeeb5d5ba", "value": "T1E1B2D11EC0AE2E74FEEB7D755941E2817B615BDF3A61CEC016C15B120322D281F9CAD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905978, "uuid": "c99db696-bc6f-4245-9008-78f1cb76efc0", "value": "384:EA0AeimAzNCdvw1PwIWWtKfz9VuBFoeIoA8FXw2t7tTmojIoNrM4uVcqgw05VxJK:KApCdvwJr69VJoA8FZtxCo8IY4uVcqgo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635905978, "uuid": "12390495-c935-465f-90b6-434a6fd84a1e", "value": 23936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635905978, "uuid": "6d145d6e-4ca1-4176-a16f-bba178706781", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635905978, "uuid": "754abf55-7bf0-4f41-83db-ea0181f0964d", "value": "5d9fe50219a65b660caca6c99422311f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f16f6b26-3cc8-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1635959428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635959428, "uuid": "593318f4-dd82-4a1b-8e46-5348ef32434d", "comment": "Malware payload (Dridex)", "value": "4da5e5b8b5acdb74b3e09db50e2384b7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635959428, "uuid": "c23a0720-b4ad-4485-9988-784fefd99af5", "comment": "Malware payload (Dridex)", "value": "fa8f8414db17b5c7847499e1e5474ddfee9ced8840e8b25d3c4e00b6be429a54", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635959428, "uuid": "75e9608b-a698-4c0a-a5bc-36e8c6f3162f", "comment": "Malware payload (Dridex)", "value": "eb6dd6ba1ec05398d058c976baff8f0ef1638f86", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635959428, "uuid": "f5894a14-aa7f-49dc-8e04-f2071e9d7fb3", "comment": "Malware payload (Dridex)", "value": "8dc1994d559c8fb6612127214aacc17fab85ec360b292a1ee56baeeb22a99fe93a0850a6158e7cce45121770523f4fbe", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635959428, "uuid": "2204910c-b074-4427-8e64-653d60be09b8", "value": "T17D830216CA58F462C6AF89FCC105BEF3E84D525C9CA0D74F39E5F708A87129B47C825A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635959428, "uuid": "7fb8eb8f-871c-422f-80a0-2c2d3040ee84", "value": "1536:8CWrPqrE3gpMokPF58Ik4kosQFVvSuMUxF/LISI1NrTmvgy/Xvc8w5+xksg/5:83mEwFkd58IXkOFVvM05L81NCo6XiAkh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635959428, "uuid": "0605c62e-dc87-4c1d-867c-5031bbeea617", "value": 88227, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635959428, "uuid": "d6fccdc3-e4a3-4c3c-9520-46c78421844e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635959428, "uuid": "8680ea9c-639b-4d38-8023-38a5851e57fe", "value": "INV.53694.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d61d523-3ca0-11ec-843c-42010a9c0014", "comment": "Malware payload (Kimsuky)", "timestamp": 1635942080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942080, "uuid": "4170e808-d97b-4daa-8c79-a3a9a7d984a1", "comment": "Malware payload (Kimsuky)", "value": "84029803723dbf7d045e5727b1d8d5a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942080, "uuid": "00aadf45-9b0d-471a-9c64-e6ffd9ec598c", "comment": "Malware payload (Kimsuky)", "value": "fa92b95ad1bd95d9126abc6f9005f3687f417aad788f1e6cd4de219613bba717", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942080, "uuid": "409e6f7e-81c9-4a5b-a26b-6563a572b0d7", "comment": "Malware payload (Kimsuky)", "value": "3b68ff8ec9858a7497e46bf3fc88bc248014ac30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635942080, "uuid": "fe613200-f405-430f-8a59-79e206dae100", "comment": "Malware payload (Kimsuky)", "value": "77fa1c36e21c6e86072d9359970f34005a97cd47935def4591dfb28902c0f50dd37d91576b02cb573aa4d7879619593f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942080, "uuid": "a79292ce-0b11-44d0-901b-229d51959fd6", "value": "T175647C59B3A944B9E477813DC9574906E7F2781A0771EAEF03A042563F237E09A3FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942080, "uuid": "1c7613a5-84cd-4913-989c-b6304a4eab5b", "value": "77b34438da1c6957e5e5dcccce760d8c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942080, "uuid": "ba395e43-de34-4bb5-8c78-f25e870a78b5", "value": "6144:CBdslFReQ7QW/YzrQ3jx0+PZbbducCNSohLhH3:CBd8FCW/EUTxRbR5oT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635942080, "uuid": "14a74ecc-47b1-47bd-b3ab-0b70e7a2d43e", "value": 309760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635942080, "uuid": "4a5dd4b0-7213-487f-aa91-7889cb28bd70", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635942080, "uuid": "0cd0dfca-2f21-448b-a979-6d0d6491d70d", "value": "fa92b95ad1bd95d9126abc6f9005f3687f417aad788f1e6cd4de219613bba717", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54ee9a44-3ce2-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1635970332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970332, "uuid": "e70edd7c-733e-470c-8944-0272692c949a", "comment": "Malware payload (Loki)", "value": "528a5848e90b9376107a782fa94d7be1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970332, "uuid": "4eebd72b-2d00-47a1-9ee2-e85a0f9852f1", "comment": "Malware payload (Loki)", "value": "fa96070efd7b2eb92a14d382b871438fb12fbdbaf4738b56616e55ce84fb9513", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970332, "uuid": "acc7db89-05fb-4c73-827f-8aab7dff3e75", "comment": "Malware payload (Loki)", "value": "ea2b5de1e0b97140044b40ae22dd39b9c3e61e1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970332, "uuid": "b2a0b666-24af-4ea3-b94a-a76a8fd40731", "comment": "Malware payload (Loki)", "value": "643ce24c0a7fa4ff5fe15552d26a21c5d7d1c423a0b6fe3173f0127b45320bddfcc4137518bbe76bbdacafe9666f1ac3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970332, "uuid": "b76274d5-c306-4d26-9130-c6e80627fdc8", "value": "T1A354021417BC4B13ED3EB3F9A860164047B0E2662213F3AE6DD97ADF916AF204491F97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970332, "uuid": "ca1a1ac2-9fbd-4631-9eac-33c4f92abc8d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970332, "uuid": "c04552d4-e259-4a36-b5c5-897d00df3414", "value": "6144:BAR2KaGrxGJA83UuWgPWjp9coqLtgRO2CR7dZyCLU1ulT545uWN:BbGlG2sCgOjp9otgROLBECLUU15I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635970332, "uuid": "6475a166-5614-44a4-826d-3036948e3b4c", "value": 294400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635970332, "uuid": "e0e0e104-bb9e-4984-9af2-606e52133fb2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970332, "uuid": "3cc1aa5e-4117-4ca4-86cf-694fba70b60e", "value": "528a5848e90b9376107a782fa94d7be1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afe6b767-3cab-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635946862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635946862, "uuid": "893f33c5-2c69-4bdf-96ac-7a0adf274f36", "comment": "Malware payload (AgentTesla)", "value": "76ad8e49fb6a808ed0a807e3924a9638", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635946862, "uuid": "d4339018-48c6-439d-afea-37de0b959c55", "comment": "Malware payload (AgentTesla)", "value": "faaec3c18360b102a4411ed70fd04bbd8248af5960dd2a88458663634bc97507", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635946862, "uuid": "e84bc0cb-8f72-4f2b-b8cd-b40abacd9cf0", "comment": "Malware payload (AgentTesla)", "value": "8bede0a3fc5028ab8c03ac69781e6d3c9522bc88", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635946862, "uuid": "75d443c0-1b4a-46ba-b02a-2da5a984cd34", "comment": "Malware payload (AgentTesla)", "value": "510fc382cf2b7f89346cbad144aec5e63f392167e6d93a10490948c00ad1e930799132ae181298ad0575ef32edf65bea", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635946862, "uuid": "cb06e923-2920-4c6f-a990-76ad753e6168", "value": "T188B4F086326C8BA5C75C7BF560998350BBB46D3A0443EA4E2ECA71CE58777024F35E87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635946862, "uuid": "f99711dd-2861-4c23-8be8-145a1380a018", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635946862, "uuid": "03601779-e445-4740-876f-6162eeb46565", "value": "12288:rvIbw8eGtWIFcu6WJU5Jw1G1JVhE6YYZaruWjHx1:rwbw8eGtWwcu6WusIJVhHcjHx1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635946862, "uuid": "ec102220-f45b-4203-aa37-80f1d451675f", "value": 500224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635946862, "uuid": "568255c5-a715-4435-bae3-272f2dfd37ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635946862, "uuid": "45464111-b4f5-4303-9763-8cf1c7f6ebba", "value": "RFQ #9038477588677876677577588000001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9070d68-3c95-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635937483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635937483, "uuid": "30440c37-5284-44c3-ab6a-dd96eb9fc7b8", "comment": "Malware payload (AgentTesla)", "value": "c51c51421093bae4df7acba44967ce88", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635937483, "uuid": "68042be6-ec50-4765-be31-de56af2e1f48", "comment": "Malware payload (AgentTesla)", "value": "fb341956a91e5052b5126a7e8586219d18992bf9083ca7eadb333f8ec99f2611", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635937483, "uuid": "fff7398d-e1e3-4b0e-8e9f-4451ab2f4b95", "comment": "Malware payload (AgentTesla)", "value": "c1ba993a7a187153c61d59d7e6ee7686ec4115ad", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635937483, "uuid": "9bdafd38-6f00-4bbb-8b5d-52134e820369", "comment": "Malware payload (AgentTesla)", "value": "c87071aaafe3433d1c8f7c4aa77e30bd9c862e453c01349c707fd863a2c05a90edf37afc6b8f0c01059bd26743c51d79", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635937483, "uuid": "7633bfcb-ae49-4ea8-a936-a56c97fd3e07", "value": "T1C545917138E8788CE9D6483044DC2C621D5AF9733D9AF15A94D39C4CD47A083ADAEE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635937483, "uuid": "32f4fb73-b19f-4647-ab72-4b748aa0d473", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635937483, "uuid": "244bcd6f-adba-4eb1-8fbb-3b89aef0761b", "value": "12288:TUolF/Gzj2A9LMnQN9bRZ9bRoqJFTPCM6/7VygBM8vr+703PeI7ZHrblcgBi497R:rlF/G+A94atDtoqr5uz+7qtrRt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635937483, "uuid": "8921471f-9509-469d-b8ff-8fa8baa1f830", "value": 1201664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635937483, "uuid": "c88e12d8-7382-46db-9480-5b528be6c35a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635937483, "uuid": "e4c9d1d9-f5ef-44cf-b6f5-80f62826da92", "value": "NEW ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f16367a-3cb3-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1635950163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635950163, "uuid": "e2203ddf-ef65-49c2-b176-cbdfb44f4296", "comment": "Malware payload (Dridex)", "value": "75aabe8096cca0a983d1b9efd8e0a13f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635950163, "uuid": "cf01fbf1-da53-45a5-a90d-055ff55ed8db", "comment": "Malware payload (Dridex)", "value": "fbd632b530d77292de0c9d7a69b1e7beb1e30332abe27255f01aa231dad6cabb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635950163, "uuid": "a53afec2-42c9-458e-a8ab-0fb2ac920a11", "comment": "Malware payload (Dridex)", "value": "0e794960caadb4c67cd11a9690169116215be424", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635950163, "uuid": "d5eba2d0-066a-4d14-816f-4122d82b7842", "comment": "Malware payload (Dridex)", "value": "71bacaa2a969722d15604fb7750b8b804fa61b81ffd4241706cc71e967d1e6101c360cfd854b0c1f6b17a12f9c8269d8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635950163, "uuid": "e4a79fb9-09b4-42b3-8c0f-ab803c70e152", "value": "T13153E10B17662417C8297D7A5A0E9CF4642871FE9C41D20E2836AF5B01D71C39FAF66F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635950163, "uuid": "e0fc6b1d-4e6c-4e51-a6d1-b301bcec636c", "value": "1536:8CWePIbZ853SAJbpbrW2GfwQX9uONqsQIgFaHFjv4Bsvc6xCxRH:83fbC9br5qHXhNqstgF6h4BsJip", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635950163, "uuid": "a36065a3-237e-4a41-832b-5fc3b8700ac3", "value": 62028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635950163, "uuid": "4dbd8f37-ed57-4ec6-9913-1e0129274852", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635950163, "uuid": "0c74e443-617c-4cf3-907a-ce7482dadc0f", "value": "inv.804004.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b8e3ee8-3c74-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635923072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635923072, "uuid": "b8432c80-b314-4a34-91b4-66ccb303b2b3", "comment": "Malware payload (RedLineStealer)", "value": "34cbafe3f2730c41f9cb94768f1bd321", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635923072, "uuid": "97edb4cd-dc89-4ab9-81ff-5ab30b415c1c", "comment": "Malware payload (RedLineStealer)", "value": "fbdfeb1a790a2604c1eae72a9f72b069f5880bc73fba2b41d61ce01ca012dcba", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635923072, "uuid": "ee8391bf-8303-4ece-97ce-83b97d7e7d47", "comment": "Malware payload (RedLineStealer)", "value": "bc9715564c709c4f0cb767fd86a341b9192f552f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635923072, "uuid": "09fd9ded-187c-4bfc-b2df-824b63c3bf28", "comment": "Malware payload (RedLineStealer)", "value": "8736188e0c40451a46af6083b22c845180a6ab5bf20842c34a1147f6dc15d0c4d0bbc21f330ac9de3b271b149fb1aa2a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635923072, "uuid": "3e639853-5dab-480d-970b-72cfbe861464", "value": "T17484BE10A7A1C035F0B212F84AB692B9B93F7EE1AB7494CB53D416ED4674AE1EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635923072, "uuid": "de455e3f-276e-4545-9a1e-49f4de571c50", "value": "e024db68009cf7f32dd817cae1867bf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635923072, "uuid": "9b900a59-a419-4662-8df2-7e8f673994b0", "value": "12288:e+3BOrmyjx7B3N+mKbKDQYagREk0Jkxe:53v41BeONgJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635923072, "uuid": "bfba0fa1-ce25-4b9d-a7db-05bfdff48271", "value": 407552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635923072, "uuid": "1dbbf7af-5d23-4386-a5ed-895d7470c393", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635923072, "uuid": "9c17466d-a763-47af-a23c-3478b1729d80", "value": "34cbafe3f2730c41f9cb94768f1bd321", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf61ad59-3c86-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1635931024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635931024, "uuid": "9f38c3b1-5ae8-4114-9ffd-904e17e5ca22", "comment": "Malware payload (RedLineStealer)", "value": "98b3762502ed43a82c8336678a263343", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635931024, "uuid": "6ae00f1e-c2cc-422d-a646-32031f29fd40", "comment": "Malware payload (RedLineStealer)", "value": "fc2445d52e695c7339778f394c559e6f3f16889947900fce5ff5b2fa2c7dddfa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635931024, "uuid": "647203a3-b1fc-4e53-8146-7caf70a4bc22", "comment": "Malware payload (RedLineStealer)", "value": "1eda49657560d2870e2697d5228b6645d44c6afb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635931024, "uuid": "454fede7-a24a-4bd7-a204-c3730804a61a", "comment": "Malware payload (RedLineStealer)", "value": "5ffc55e39329dd1d27c3f7e96e01535be7409b9b0606d0e113cb431729e4f8f97e098e22ae0cddc0723bc6a9cae2d2db", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635931024, "uuid": "485b58d3-ccef-4102-a24b-322f7d2e4159", "value": "T17774AE10A7A1C035F1B252F84AB6A279B93F7EA16B3490CF13D527E95674AE1EC31307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635931024, "uuid": "a54f1f76-91b9-46d6-9719-80eb3ca1c998", "value": "e024db68009cf7f32dd817cae1867bf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635931024, "uuid": "140f201c-6904-4ee7-8fa6-523a91ce498a", "value": "6144:A+kVGVfeMujKI1TH1/Uz7MB1PWEGtVUMQgAOtsNPMGDFW:AV4MLFVUz4BdWEGtVUCAOtSka", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635931024, "uuid": "fd3881ca-b006-4992-b3bd-210029f161e6", "value": 368640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635931024, "uuid": "c437069c-7a0b-457a-a958-dfef90bffbc5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635931024, "uuid": "0e6b4ca1-81bf-4d8b-b64e-f79e23b0d9df", "value": "98b3762502ed43a82c8336678a263343", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d65c0f1-3cab-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635946670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635946670, "uuid": "ca9a30de-58a7-47d2-a4a3-fcde7b766681", "comment": "Malware payload (AgentTesla)", "value": "81fc8deda5997aaf1ef91ecdb49226da", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635946670, "uuid": "ceef8afc-33ca-4601-9e78-1e57155042e2", "comment": "Malware payload (AgentTesla)", "value": "fc8ca7a351891033abbcb110b3e14c0546f56ca08621ceab02fd08a8e49feb58", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635946670, "uuid": "7af456dd-c303-4b2d-8de2-1c0b3b81ecf0", "comment": "Malware payload (AgentTesla)", "value": "66ded03bd98ad2bb9d5b212c60c9c885f0b52f98", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635946670, "uuid": "349776bd-f1e3-4dd9-bdcf-c87b1cd38fbb", "comment": "Malware payload (AgentTesla)", "value": "cbf6ef9566aa5c96f470b45506c96ae67e13aa2308ab5b96f1aba92ec5f19e511a76688b82a828428b5ca69b2f6bfd13", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635946670, "uuid": "605d904b-6c5a-430b-a42d-5ecd3986f46b", "value": "T141053960F75E8DC9CAFD77348F25D1B003616D5E25108A1920F43DFBBABD2136631AAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635946670, "uuid": "dfdaae05-b408-486c-bf25-5d79660717cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635946670, "uuid": "5b34e268-0d4b-40ab-b3bb-e9337a5da0fb", "value": "12288:ojX8YvO0dpFdcIxa4zS229ZjkYdZmZHPAof17EAmDUJJLTQV0:S8YvO0tlO24ZjkSZmZH4of17RXUV0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635946670, "uuid": "a8390c60-58eb-48e4-afcf-100c85628178", "value": 868864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635946670, "uuid": "69702141-647b-4658-a7a6-b294d4489159", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635946670, "uuid": "7ea58321-4157-4c26-ad04-56e46b2b0571", "value": "REMITTANCE ADVICE USD 6029.31.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eca3a05-3c9e-11ec-843c-42010a9c0014", "comment": "Malware payload (Kimsuky)", "timestamp": 1635941089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941089, "uuid": "2efc7b2f-a240-45e8-8a2f-cc0b8527f25a", "comment": "Malware payload (Kimsuky)", "value": "c861f25bb943f77a909b33d62bb71926", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941089, "uuid": "21fffcec-dcd6-4dae-948d-6013d5a54fa2", "comment": "Malware payload (Kimsuky)", "value": "fd59597169668b90c47d0ad6db1bcd7d778c6d54ee3c42bdd2d86b2d2d34c885", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941089, "uuid": "c6b3e359-774d-458c-95bf-8b1ae38eb776", "comment": "Malware payload (Kimsuky)", "value": "576b953cb4fe71adb71a338a42524b0e424824c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941089, "uuid": "6e842bf2-15b1-4a90-94fc-2c5939c7e8e9", "comment": "Malware payload (Kimsuky)", "value": "90d942628f25a524142f561d6a5a6a50f0cef9d5eb0188a2a318c68dafe98c3e95327899a27ed3390bb827d07c3e479a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941089, "uuid": "65e1bcd2-aa21-4f6c-85e7-6c9a31208fd6", "value": "T171A44B2D59A5027DD0BBD178C5974983F675380A23BADDAF03C042B31E53BE1AE7A718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941089, "uuid": "82b30650-fc63-49e4-a755-a51bc155277d", "value": "135958949bbabf35c044a2b7dd89f880", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941089, "uuid": "8e640cb8-497d-4e09-bd1d-a4136760c893", "value": "6144:xE/Np5g0cqbMwItonwEW9m37Z1BsJOtYVOP/7OXohDxL4W587isn2:OMSnwEJ37ZbOOL7OXocW58j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635941089, "uuid": "ab0dfda1-7c7f-4725-8296-24e909a450cd", "value": 485888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635941089, "uuid": "b59f877f-8511-45d9-940c-78839612e9d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941089, "uuid": "9b828318-1b25-433b-841a-15cd7fe03666", "value": "fd59597169668b90c47d0ad6db1bcd7d778c6d54ee3c42bdd2d86b2d2d34c885", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adc62e94-3cc2-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1635956737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635956737, "uuid": "6d1cf950-b02c-4b9e-afe7-9db0351dd33a", "comment": "Malware payload (Dridex)", "value": "921cd61eb1135fe1152f2ebc16fb997e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635956737, "uuid": "c8561a6f-d244-4bf8-9a9b-b1df1f7f36ea", "comment": "Malware payload (Dridex)", "value": "fd6089cb57da5cf1825bc9c0f85c6c1363399514aa3f6ab7a5542f05fa4c2f07", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635956737, "uuid": "7480a58d-67eb-450c-8ca0-1146fca9c7ac", "comment": "Malware payload (Dridex)", "value": "176083f3314e90a942c6780b76feff39aea41954", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635956737, "uuid": "1688d689-6430-4f5e-b360-06df4ff02b91", "comment": "Malware payload (Dridex)", "value": "b8d7ab531bf282482c5e12d672e9cd897191c5e0964a54675f0fb2d6c4013127d7d8235392afe32fec71f722e50db4b7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635956737, "uuid": "63c957c3-d26d-4ac4-b058-962d9bf6775c", "value": "T1C363E18B9760789BC425AE394B0D98F12818B4F8DC02E61538E5BF4B51EE1CB97AD137", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635956737, "uuid": "fc0c3f9f-9c4c-45ae-a8de-b322e31ead0c", "value": "1536:8CWhZPIbZ853SAJbpUqizw0/CIpwWNP92DOG6pIKlotHe+xJo33+R:83hmbC9/5f6NP92KJpIX633G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635956737, "uuid": "0e515356-cd21-4ba2-986f-20efaa7bebee", "value": 69540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635956737, "uuid": "1f463ac4-c5e9-401f-ad44-0e6ef722879e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635956737, "uuid": "00b9f15e-836a-4f63-b3fd-24f62c5067c7", "value": "INV.60565.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e6c29d4-3c5c-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1635912742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635912742, "uuid": "07aaf7c9-6131-48cf-aefc-6210ca513c0f", "comment": "Malware payload (Dridex)", "value": "48982e578416c6121c4f5fce5c02480c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635912742, "uuid": "73a7b7c8-921b-4e47-a8b6-c7e91d01a8a1", "comment": "Malware payload (Dridex)", "value": "fdba781b1b02d7207bfddedea1414a60f6398b904a08550ed8347a070cd3f360", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635912742, "uuid": "b41aa688-4255-411d-b7f5-a4fa10d13262", "comment": "Malware payload (Dridex)", "value": "0e0a9a291939959598595de264df5277d6fdebc6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635912742, "uuid": "f7d8e2b3-c5bc-4d8c-bc54-3fc7fb9c514d", "comment": "Malware payload (Dridex)", "value": "e0344910aab479818e7f2017929bdeb2c5d13e1a4893cdff13b9ff6b312da9811a4569644f2b340ee85be20c48aed72a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635912742, "uuid": "0182bc32-fc91-4da2-a0fa-71e478051753", "value": "T1EBA4AE94FAEE40B8E5187A74C4DB19A56E821E24C4AB1615F4587F0E4E338F3970FA73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635912742, "uuid": "962c8cd3-acbd-416a-8676-0dd6b9d0cd88", "value": "c6e29838e1e1c81859cd162bf701404b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635912742, "uuid": "f74a6749-8244-4878-b3c6-d43012ba0c15", "value": "12288:tGw8ObmVk9gbUngly9sp+ROx8ufNX/7vuZU/4BLl2iZ:trxC+mggkqIwG4X/7vuZ44Zl2iZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635912742, "uuid": "25078f4f-30bf-4e5e-a1e2-c9a26dab7d3a", "value": 462848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635912742, "uuid": "ea738b39-2005-4bcf-81cd-463acc1cd224", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635912742, "uuid": "1082b2d0-d1d0-4fae-aa96-161bf12d6a45", "value": "SecuriteInfo.com.Suspicious.Win32.Save.a.31952.24258", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2634600c-3ce2-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1635970254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970254, "uuid": "4594b8a5-c4c3-4f0c-aa0e-bfb07e4a8f59", "comment": "Malware payload", "value": "e69a4e02eb8a57ae5ec8d614b75fe93e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970254, "uuid": "a392c82c-7278-4375-a178-f0bcfb221733", "comment": "Malware payload", "value": "fdbe8c7bc44589f665fa238212e45a94caba79424e37abd7499636cc1e05ecf6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970254, "uuid": "3ade598d-bec1-42c2-99a3-e806a584593c", "comment": "Malware payload", "value": "25e7ea9d8e0915661851c1e1b70e3761d233cf6a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635970254, "uuid": "9207181a-d9c4-458a-ae90-c91d61604cd7", "comment": "Malware payload", "value": "70e0b4e54ed211cb8100e2d8248ed3f6c1299940e5fc0faec1863681c6ad977229dfafbe998357ffaa9d3e6d8e2123ee", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970254, "uuid": "1756a01a-6383-4331-a084-433fe875b248", "value": "T144A3126FD1E96855C0F5A8B68BCA28E1CC371A0D4006B11F3E6D93BC276108FD79E65D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970254, "uuid": "cb4363bd-ade1-433d-b07e-02be9e636961", "value": "3072:83+FzIsj8aipSW4vHREQ4iZKUbcUYPxZfQm:8DOipmvxpZK7xh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635970254, "uuid": "707efee6-3eee-46ef-a8ad-e6640a25f498", "value": 100277, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635970254, "uuid": "c70e4a78-c227-4c84-b183-8a27caaaa67c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635970254, "uuid": "5d20a89d-8c77-43e5-bba4-6ca2e1287add", "value": "Order 791090.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af36450b-3cd8-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1635966189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966189, "uuid": "297085bf-f136-4bfa-8bda-0841958788f8", "comment": "Malware payload (SnakeKeylogger)", "value": "f173e85cf4045665c9c37f7c108b3087", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966189, "uuid": "b6ed13c9-50a8-443d-8331-48be005ff661", "comment": "Malware payload (SnakeKeylogger)", "value": "fdf007986400acbc813f41ec593b2c5384b4c8c77d38a1375e76c7804425e3dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966189, "uuid": "180d5b88-7065-4c3c-8413-fc6f06d49626", "comment": "Malware payload (SnakeKeylogger)", "value": "e236af9c19d2de893b17c6ca97682e0b6a73b135", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635966189, "uuid": "c4afbd40-5205-4cbd-bfaa-f9f21b2c224c", "comment": "Malware payload (SnakeKeylogger)", "value": "d0960a1d62b87538e6663d29adae0cc3ddf564bb89831b90fa400ddfd9638ea65e803e6faff4fa1799d114a17d433b19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966189, "uuid": "69da2b4f-a61f-48c2-9f22-fa18f51355da", "value": "T1BCF43720B35D89C9C6FD3734CF25D1B017A16C6E2A10CA1924F43DFBBABD65356306AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966189, "uuid": "29d87e7c-d65a-4399-a7dc-7132b8a0b73e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966189, "uuid": "8fc3de7d-0f49-4278-834b-b3346c07949b", "value": "12288:ra1X69BDRqu8PPfZU1wyuF7EzqZJJILTJA0:T9BDRqPfq1wyuNNZJONA0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635966189, "uuid": "4befb73e-ad0e-4ce0-9dd3-509173794d55", "value": 759808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635966189, "uuid": "440bff25-327d-4edc-8d80-c45d2b631801", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635966189, "uuid": "3b9e3659-9a6e-4901-8ea4-ea02c6281478", "value": "FHDWHOHx071va6u.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70edea29-3ce0-11ec-843c-42010a9c0014", "comment": "Malware payload (Vjw0rm)", "timestamp": 1635969520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635969520, "uuid": "c42bd0d3-1299-4725-a635-9e1aed6a7101", "comment": "Malware payload (Vjw0rm)", "value": "8f2569f160a79cf0482a6b4856c9524d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635969520, "uuid": "7072895b-b807-4320-8f38-77c1fe8ff0f1", "comment": "Malware payload (Vjw0rm)", "value": "ff2cdeaf5569a23096756e9c5ecbdf73f544a38b88bddcca6572565d478de269", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635969520, "uuid": "43962894-db88-4fc7-a8f4-1d3bb23c4adc", "comment": "Malware payload (Vjw0rm)", "value": "0d31e3fbc9bebc19cd6c5703a6c37388d10bfcc8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635969520, "uuid": "9b272cfb-86e5-4930-8355-5531de980ac5", "comment": "Malware payload (Vjw0rm)", "value": "3d5089677849d885e96b7caad9f48b104afef32855b67ee468693d774ed729254a27bd604e8c100fbda433878b80cc3f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635969520, "uuid": "891c6aa7-cdb2-4f30-a5f9-06cea70cc0bf", "value": "T15BB27BDD7910F8D9E520F22469AE9DC4ABF8935BC801928E381EB6404F71604D7AEF6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635969520, "uuid": "36316d36-6de7-4e68-a65a-aea0dc52c4f6", "value": "384:tm3uw3mx5W0X/2dZUzF6L8ouHBIZG9kiA1SmVkvkAk2+vNM0BYvcfdv+isNfPe:ol2xw0Xc9w4ykiZtS2+Dv+iOm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635969520, "uuid": "a4b2819b-c2d9-4419-b57d-4a58152bb208", "value": 23936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635969520, "uuid": "288b26cf-e450-4dfe-998f-c833d79098c0", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635969520, "uuid": "76112b56-d251-4aac-83cd-85d12163c0ac", "value": "eReceipt.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a03e428-3cc3-11ec-843c-42010a9c0014", "comment": "Malware payload (Hancitor)", "timestamp": 1635957053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635957053, "uuid": "ab7f72a0-eb23-42af-b492-f8c6b9141829", "comment": "Malware payload (Hancitor)", "value": "22dfca22c5dac239e284812a030fc09a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635957053, "uuid": "508747b0-d396-43a5-a08f-22fa39b2801a", "comment": "Malware payload (Hancitor)", "value": "ff4d0ac86f830ee6a99b1d0005ee9081cffb190ea0882b12f769afc46bf6fcc7", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635957053, "uuid": "7dc3322a-7a9a-42b9-8c0f-540e582446a8", "comment": "Malware payload (Hancitor)", "value": "80173d0b70efca680c5fe2a60c79a5d4081ca342", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635957053, "uuid": "857c6e93-6574-4151-826d-5a10aceb4ad2", "comment": "Malware payload (Hancitor)", "value": "c9590addec6a716b9a1d23248808d93701f8a65fc1f19500e8cbbc4d3b5bd6dbbb435a8253dbed2976e5750f54477759", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635957053, "uuid": "694c9ccd-d380-4e3a-a71d-da79a85f3c00", "value": "T158C40103F9959F57E51BC3B87E628C696B6DED494B08B7CB10307F0EA7B03609C4265A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635957053, "uuid": "5d1ed0b9-1496-486c-b515-9561a3350f1e", "value": "12288:xV9iQsDr8Nc0tEILt/5J0RiCFNpQU0cz8:xVXkr8NJnLl08CDkco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635957053, "uuid": "895d6b8e-285a-4a15-aaec-24f5948506f0", "value": 589824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635957053, "uuid": "b4945a7e-43d5-45cf-9a15-ca76952d7dba", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635957053, "uuid": "a948d655-a458-4904-9e0c-41b2bb81ff07", "value": "22dfca22c5dac239e284812a030fc09a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cbd3c31-3c9e-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1635941220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941220, "uuid": "a5929ae3-0cd2-41f1-a37f-b02cf25ae6ac", "comment": "Malware payload (AgentTesla)", "value": "5741c3777acecbd99ac93f4536d39f7c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941220, "uuid": "a93ad098-fd91-4fcb-8f27-c1e99eb3e500", "comment": "Malware payload (AgentTesla)", "value": "ff8b5e34052086cfa5bf37d816c8c9284eec76b7b40c12df24fd25c34bcabc88", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941220, "uuid": "79976009-5491-4ca3-9269-909f7aec3410", "comment": "Malware payload (AgentTesla)", "value": "3d92e2538076e1614d3b102558f13900700f03c2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1635941220, "uuid": "ceecaf3e-2c55-4f18-9956-00c9473658c0", "comment": "Malware payload (AgentTesla)", "value": "4ac924bbb0db96eeae4a91ea9fe3b38fac099a6946788273c6b83852a4c4cf1973177ca37f6159b83ff95fd50d696a16", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941220, "uuid": "4a77c91d-a120-41fc-93e7-18b2aa7687a7", "value": "T187054820B75D8D89CAFD3734CF25D1B017A16C6E2910CA1924F43DFBBABD6135630AA9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941220, "uuid": "c8e6456e-1429-476f-aaf4-c623b4a6c35c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941220, "uuid": "c8e28ddd-b2a0-40a0-85b7-977dd406d7b6", "value": "12288:gZPrcCAZHi+h90W7sEWzGaiGmh1wyuF7EzqZEJNLTeR0:ordAU+sWA/C9jh1wyuNNZEnSR0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1635941220, "uuid": "deb21f22-b17c-4478-8144-81f07f5100fd", "value": 836608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1635941220, "uuid": "dad3da3d-8f9f-49e2-9bac-c0745d4bcf18", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1635941220, "uuid": "e9e961a2-d671-439e-aee7-2b15a56f9abc", "value": "AWB5032675620_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }