{ "Event": { "published": true, "date": "2022-04-22", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2022-04-22", "timestamp": 1650672182, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "9f0cbc9b-7fef-44d6-ac66-420a91cd6cd5", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80173bd1-c221-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650620968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620968, "uuid": "7b47584c-7971-4a6d-b62a-d8eccfc75083", "comment": "Malware payload", "value": "70f4157007f7a4c9116fba2f94768351", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620968, "uuid": "da416137-dd6f-4b7e-a7a0-ab0a7a14ef71", "comment": "Malware payload", "value": "0019a95c77f69f272c4ef19e566ffa62bc7ad1ef2d863d569c34c897d28ece78", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620968, "uuid": "a2c7e06d-7a84-40c8-9e46-955d2ceeb68d", "comment": "Malware payload", "value": "6cad2ccc6c084fd4b57b2852e49ec5fbe9377627", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620968, "uuid": "119a1fc5-2026-4583-b068-5e5af4d5d9ff", "comment": "Malware payload", "value": "4c27f63ee16937f41335a1ac4045ff75cc19a6060c584830454d6fc22d2490a20fe23d53528517baae226f07fa8a167e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620968, "uuid": "1c63b390-bac8-4b8f-8a36-b4a9eba0dfea", "value": "T1AED60262B244113FD0BB1A3B8877E650A83F77612E128D5F2BF4896C8F355416E3A71B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620968, "uuid": "644a34fa-2aaa-4953-bd81-9a3eaeb3a845", "value": "0ecec953eafd56fe81f95a57f3aaf9fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620968, "uuid": "11a73deb-e808-4c77-af87-96f28c459431", "value": "196608:bQ8EPbOmGouCMWQRlWh7BvPp8mEdB1x3T336eu/8B9PEpil:bQ88xGOMloh7BZ8mEtIf/khEp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650620968, "uuid": "3d9f4703-c601-40be-a6f8-b166ca80da34", "value": 12797440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650620968, "uuid": "9def0362-d004-4200-b2a2-95d3f88424c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620968, "uuid": "50f76add-4660-4a67-8a6d-20e324664b2c", "value": "SecuriteInfo.com.Heur.10977.30837", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfe01586-c258-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650644751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650644751, "uuid": "cd4aff6d-f38f-4dbf-baea-36ea67a59c99", "comment": "Malware payload", "value": "6d5abe11d2a1067b579d55a4ab27392d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650644751, "uuid": "3c1ec60d-d21c-4a32-a089-9e701ef13e7d", "comment": "Malware payload", "value": "00542e04ac60a71d620bc7c6a69324c0fd28f37037dd596678997922cb8928f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650644751, "uuid": "7357acfd-4509-45fd-b3b9-15e102a55cb0", "comment": "Malware payload", "value": "7e3a0915f7a1ba7c5a291741d9c1f9d28644dcd4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650644751, "uuid": "df183ed8-8ec4-40f6-808c-0b4095d086c7", "comment": "Malware payload", "value": "b428dea4419b2be1dcf79eda500c430b6d0ed2d5d4d53db0bf2f8d507748cddd53d57f5fb708060ce306edb2cd5673e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650644751, "uuid": "bbf8594e-52f7-4d86-9e38-fb46af8c2d2a", "value": "T1F4D49D11F6AC80B5E07BD13DC9A3875AE6713C9847B943C79255EB2A2E736E05D3E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650644751, "uuid": "879a7c0a-d013-4c1a-9689-a8ede1ba010a", "value": "6ba79cbed2acbe9b8ecc8e14a572f100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650644751, "uuid": "2367015f-6d07-46a3-a39d-75bb9dfa76f4", "value": "12288:C1FIcocJwMTHzXO7N2OBHiyzskF1CubVnmn:tco9MTHzXO7NL/115mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650644751, "uuid": "3413c83d-c38c-4304-a067-51038291db31", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650644751, "uuid": "83bb539d-7634-4427-b46c-1d4b68722738", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650644751, "uuid": "b1a82463-a141-4803-9f73-a55f970a43ba", "value": "7e3a0915f7a1ba7c5a291741d9c1f9d28644dcd4.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa9133b1-c236-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1650630058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630058, "uuid": "c5854f3f-3017-4bdf-be92-7b65c99c8cc2", "comment": "Malware payload (SilentBuilder)", "value": "8529a186bf968eb2edc040eeb828662a", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630058, "uuid": "329ff78b-46a3-4680-9c1d-94108c8a4035", "comment": "Malware payload (SilentBuilder)", "value": "011285c28750bde556ee1fec21142449344f9efbf972f8a2776ed6f7b6c1bba0", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630058, "uuid": "cf380f4c-e308-4f27-99a5-7769dbf3ee66", "comment": "Malware payload (SilentBuilder)", "value": "160fc17d0c9b64c27a17f923cc6c0978254646dd", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630058, "uuid": "d9eac3f7-c568-4172-af92-f07e4b74f4fd", "comment": "Malware payload (SilentBuilder)", "value": "192f4c59b15ed3795c417af6ab138bcfc1b417aa8745a512c29079ffb5ecbab02d1d094e67d46a454c8b60a2b2ce7b05", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630058, "uuid": "1e800597-4a19-4ab1-9afe-a3aa058b3a6c", "value": "T1F523B646BA5D9859E9258B7548E743E9B333FC201F6B0B833616B3257FF49E05A03207", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630058, "uuid": "57e85ec6-d5a4-4222-96a6-2762423db34c", "value": "768:4DM52tfQXi8vgLZkTOHkQT51Vp6AwPdM8gQ6JT5X6DGwUdh+pqjeSLjcvLtzrxFq:462tfQXi8vgLZkTOHkQT51Vp6AwPe8gP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650630058, "uuid": "713cae79-afae-4a66-ba10-ab10b2fa478d", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650630058, "uuid": "691fd3b0-db3b-48f5-86ff-60fc6b7d84e0", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630058, "uuid": "06cce70e-c2a2-46a8-9498-86c3c8c716a8", "value": "INNOVINC.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f498d85-c202-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1650607544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650607544, "uuid": "5591b80e-1ab2-40ca-8a2a-62fac53f39c6", "comment": "Malware payload (Formbook)", "value": "a106e3ad7e9d1d2f929a92e5e720cb4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650607544, "uuid": "08b28454-18d3-40c4-b210-2bd1243d410d", "comment": "Malware payload (Formbook)", "value": "012a52b12d6268cb8aa122b2382fd58f69c392feb596712ae52748bd832ec604", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650607544, "uuid": "076e17cd-553a-40f0-92dc-24702a402ca8", "comment": "Malware payload (Formbook)", "value": "860648853cb82dd649a8b53eceb61e433162a80b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650607544, "uuid": "5f1320be-4f5f-43b4-95b3-1f6d528ea68d", "comment": "Malware payload (Formbook)", "value": "ea149be1ab678d8b2e71828e339aba7a5f59c0e506756e1a498d9bd2535d3d81168fd5a467af8906d2968a8964a8189d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650607544, "uuid": "62ce3a1f-8aa4-46c0-9cb8-4b96c97b6e3e", "value": "T11DD48CFC71817DDED41BC6B98A687C60663130B39ACBD616423B21888F9DFD69E005DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650607544, "uuid": "ff5ff440-a989-4ba0-9ba1-15f18c8b1db4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650607544, "uuid": "2105c4c4-7979-4e03-a40b-1ebcef6f108e", "value": "12288:AFiI/UQLgplHe4oWLUI3fbgu7mfVNXjFOs7Iq3od7lTPcT7j:A1UQLgpleyUI32ffXJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650607544, "uuid": "74e221d4-f05c-479e-9001-15f2a06d8b3f", "value": 615424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650607544, "uuid": "5bda6e13-51f9-4d9d-a0b3-c23802f9c6fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650607544, "uuid": "aa43aded-14db-4d92-afb6-7a7c2e2eb896", "value": "cotizaci\u00f3n_Latco1782902.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "696136cc-c21c-11ec-8e58-42010a9c0032", "comment": "Malware payload (DBatLoader)", "timestamp": 1650618782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650618782, "uuid": "9802fcb7-76f4-41bd-9797-279f1e2e8677", "comment": "Malware payload (DBatLoader)", "value": "609962d33073d20f213e170a021e0691", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650618782, "uuid": "193f8303-6617-4f6b-95ba-47b4c114254b", "comment": "Malware payload (DBatLoader)", "value": "02a4cf01a65e70746623eeef46cd1c31646c23f667a90dd7ad3823772364500d", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650618782, "uuid": "07f982f5-704b-41d7-9b71-7d75d79ee6cc", "comment": "Malware payload (DBatLoader)", "value": "18dabb11efb9559b06b42938449242c02fa4a3ff", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650618782, "uuid": "61034134-7e90-4f18-b37c-ab3aa77c0492", "comment": "Malware payload (DBatLoader)", "value": "b40a83b20f5431538243394d6a386e3895fad4a75c456a558a375b7bb60d0ce078745b2462bdbb0a978d7d3f8afa07dc", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650618782, "uuid": "7e846883-d2d5-4512-9e92-dfa4a135a1e3", "value": "T16D356C12BA485473D4322E789D5FA7B85836BD11F92498463EF59C4CBFF63C23829683", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650618782, "uuid": "f960b213-517f-49d5-8b81-690a0f2c7a78", "value": "d4cf2d38c8388bbe93ed7c0af7fb2d41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650618782, "uuid": "a6e48e34-8620-4128-a3ce-d9e7aef9c692", "value": "24576:NODWeYzvYu8Qtm12YI/vrnqpM5mxY5pIOBz:NSWNcY3tl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650618782, "uuid": "fe639444-d38c-4104-b82e-d938e80955d3", "value": 1064448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650618782, "uuid": "cc10cb08-43ea-45b7-847a-d67176ef558b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650618782, "uuid": "69ce355d-035f-4b56-86a6-c5ea40aa51c4", "value": "609962d33073d20f213e170a021e0691.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27889285-c204-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1650608364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650608364, "uuid": "1027eea0-cd44-4286-950c-1bc24ff65731", "comment": "Malware payload (Formbook)", "value": "b9ba47bd36eddc3ec6690f867f4f065c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650608364, "uuid": "fa25a292-4bde-401c-ae76-bb585f181fc7", "comment": "Malware payload (Formbook)", "value": "035dd068094e680fb06f62eb2b838b182d29df63883906f0031444f1bea56507", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650608364, "uuid": "c6136385-710d-44ad-a34c-3c8509e68ce1", "comment": "Malware payload (Formbook)", "value": "145372771d3ad06c2d7e1bfd8cee311fc8b4c000", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650608364, "uuid": "1adc379d-2faa-4001-9413-4e9a1b58c6a1", "comment": "Malware payload (Formbook)", "value": "e793caacd4b1e4f30cb9097252a39564c72399b0a933652c5f1deaddb9a8846455af8e36f47b2da292a85ea763ca8e59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650608364, "uuid": "6354d9f0-4ebe-4fd5-85dd-0e6539514400", "value": "T1B8C4225E33D45F22D2BA47F59760928E13B8E80FE456E219CCE037DE2897B54AE11D23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650608364, "uuid": "a841522f-a429-4f0a-92a4-4083c440755e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650608364, "uuid": "973d1fe0-9649-4348-a03b-52f90b63aec3", "value": "12288:7z90jNqYHj5TDlbC3F5A+56YYLjtY9KEj/CeB:7ulYJm5IKEj6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650608364, "uuid": "99d625c9-d3ae-4af8-a602-aae3f337a9ac", "value": 568832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650608364, "uuid": "49fef757-2b79-42f8-af6c-3090189e5559", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650608364, "uuid": "c90da424-23d2-4a9c-b662-b5b0cdd7ab33", "value": "Nuevo orden 1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d9fd74c-c242-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1650635110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650635110, "uuid": "6c02eb3b-c47b-47f7-ab92-0b6a27169834", "comment": "Malware payload (AgentTesla)", "value": "282416d0dc7599c9d62938a3edb26713", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650635110, "uuid": "211c111f-119d-4f9f-a3a5-0bf71e162c1d", "comment": "Malware payload (AgentTesla)", "value": "035f0c3a9be668aa8eb3e67d504f82b2d7b9d110eea8003a258cb780b3e147eb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650635110, "uuid": "e204c2b6-d9f7-44c7-838d-9e7b8090ddd0", "comment": "Malware payload (AgentTesla)", "value": "1cba17be0947b64ec8f117848502e59860e16d61", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650635110, "uuid": "2f36c2db-5eb8-413c-ab9c-1f4c6ff52109", "comment": "Malware payload (AgentTesla)", "value": "42169d80353ce8a9f0038a8a35f524c9b499a7cae1c99cbac0452e4cab3dfa8ad3b3f3f07a052930acf12067a3a36b89", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650635110, "uuid": "9661808f-f561-4f66-b4fb-8ef53c8d4e1b", "value": "T177F408ADB2F0769FC85BC87289541C64FA607C67630BC207A05725ADDA6D997CF203F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650635110, "uuid": "4b34805e-b8e3-4eb6-b401-67605a4dc52e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650635110, "uuid": "007b173f-f078-4c7b-b7e0-6bab21df3777", "value": "12288:lqVXSLlie+W5RuVn0p5MqM7QuOzCx/Fn5xoFuO0QLlBzZFtSmqv2WX2Qh0hNIJmT:rZiQ/3HzC3wFuOqF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650635110, "uuid": "fd9bf225-04a1-4077-a046-421f6f3fcd08", "value": 794624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650635110, "uuid": "aadf2e93-216f-4dbc-85b5-faf29f8147e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650635110, "uuid": "fcc379e1-36d3-44a4-b816-74ae13397dc6", "value": "M.V Equinox Dream30,000.00 USD CTM Request & Crew Change of 4 onoffaround 15th APRIL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f9a1a0d-c23a-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1650631758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631758, "uuid": "008a5fc3-c838-41e8-aba1-c109d1b98de2", "comment": "Malware payload (AgentTesla)", "value": "2ef0cad03e84088c6e2a5f8fe2f73429", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631758, "uuid": "1339c2ba-468a-455e-b57a-5ee213e84e76", "comment": "Malware payload (AgentTesla)", "value": "037dc76d4ad2a4080a387072361ca724b020588b8102d89ae8aa7b7a01d32111", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631758, "uuid": "317ce04f-bd17-4a07-873d-a4a6e3095273", "comment": "Malware payload (AgentTesla)", "value": "30233f2e6dd4bbefcbbf9d9233591f74ee47a5cd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631758, "uuid": "810d9dd4-3b2e-49d0-8a0d-7c156ea1dd36", "comment": "Malware payload (AgentTesla)", "value": "ef9f9f900f0e79510ec62d73fafd404dfad099f1b86dae005737ce1d5cdabb5a5b0f6ede77bcb77a83b49baeaab08efe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650631758, "uuid": "e9a62790-cb2e-4b1e-b167-1b97f8f0916d", "value": "T1BEC412233BE0A723C97CDBF9191059554BB664A93494F75C0CB7E0EB2C2276053A9F87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650631758, "uuid": "23ca6e3f-1192-4d44-ac72-a51790561f62", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650631758, "uuid": "e54172fa-e4d2-4e69-8ed8-1a1f2286aed1", "value": "12288:pBAYtv/h/gbqZix0apdDEB/E4NBdsXCK8+CFzVw70ADEGYtWXUq2vT3t:XBdhaqZ07pdKNMCeCFzVe0AFXUl73", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650631758, "uuid": "83a773de-eb84-4d3c-b53b-d2ce7391fa2d", "value": 565760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650631758, "uuid": "810a9b84-af4f-4f99-8189-3bdc429fa3d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650631758, "uuid": "c30ab465-e8bd-4495-961c-3bd77eb71ac2", "value": "IAENMAIL-A4-220222-0830-0005036.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6872f0b5-c28a-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650666025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650666025, "uuid": "32f02a00-de88-4b3a-baf6-c3f8edd9db00", "comment": "Malware payload", "value": "b23fbcb253e7b01abd2d1a982a85c1d6", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650666025, "uuid": "de753679-4a2d-4df7-be1e-1f12cd74a5e1", "comment": "Malware payload", "value": "03a682d57f151869fcce5a9712201ffd065e3625914cd9f83d9003d7457098ca", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650666025, "uuid": "e5c0c371-a604-4893-bafe-f8f0d62afe67", "comment": "Malware payload", "value": "96246f52f32fda00a2f23158f89db2c1f7325c12", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650666025, "uuid": "94cb2707-3a1a-423d-85fe-7d51214591e2", "comment": "Malware payload", "value": "aa076e3d8417e521b5500e2898d0489593081632a79298198cf53eb2aadd3a5294964e3935ea63d591cc1f18001bd279", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650666025, "uuid": "f59b8883-7233-4b95-8c8e-4f26ef17bdfe", "value": "T1EAC46C11F6AC80B5E07BD13DC9A3864AE6713C984B7943C79251EB3A2E736E15D3E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650666025, "uuid": "5ce7ebec-2f55-4005-b57c-b294fb9eb810", "value": "6ba79cbed2acbe9b8ecc8e14a572f100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650666025, "uuid": "b5413f4c-be97-44ba-97db-f7a15fce4bd1", "value": "6144:1oJyHSfFIDAqBcJ6EkVgNazgHH6mXZOs4z7N9nAeieHiL7iinzGCvCsP5Ot8:C1FIcocJwMTHzXO7N2eBHiyzsk8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650666025, "uuid": "7a7e3858-fff7-41d5-afa5-e535cfb12c75", "value": 547129, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650666025, "uuid": "542f0ae0-70e9-466f-8e03-322a7016e0fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650666025, "uuid": "6fc396cf-0cd1-45f8-a8c1-7f77646080d1", "value": "emotet_exe_e4_03a682d57f151869fcce5a9712201ffd065e3625914cd9f83d9003d7457098ca_2022-04-22__222019.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c623adb-c221-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650620934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620934, "uuid": "785c9fbc-a6f0-447d-b0cd-ffde93742b81", "comment": "Malware payload", "value": "2d8b43979d531f61abf325df96fbbf1d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620934, "uuid": "57fe5e66-aea7-4c45-87d8-bf4fc026d623", "comment": "Malware payload", "value": "03d3c59abeec12071b380cff95ebc0df7898a7ec9ff34d0c539f3f2f2f8a5682", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620934, "uuid": "4f0ab2ab-f0a8-489e-8fbd-016f211254c5", "comment": "Malware payload", "value": "e6d798ec226f234d6c0af967942df4d6873dbe76", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620934, "uuid": "eb70d933-42aa-4afc-ba94-e937ffd8c1a8", "comment": "Malware payload", "value": "60ac3a89cc4648fe34fe90a9878f753ab5f646778134060771252a056a3b5d1c4357bdabd0d822f86373903b6c6c917c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620934, "uuid": "807f5457-b07a-43fe-bb10-4ac8fd12ec19", "value": "T155D54BE3B2C4653AC46E163A4D3FA658993B6661251E8D7B07F0488CCE367402B3F677", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620934, "uuid": "7ced28ad-d231-439a-a03f-0333856b1f6c", "value": "54573d9ea39348f88f98f339af755e42", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620934, "uuid": "032fe489-d301-42f1-a35b-742a342ef84d", "value": "49152:2E4hgLpuRQSmEEm1FWSdaIo+tZTjtSxI7geDEYCEA:2cU1FWgoBadEYlA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650620934, "uuid": "7366a304-8e59-4993-933c-9e9746e12dc4", "value": 2963456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650620934, "uuid": "42f16a01-9387-418a-b7c2-b6a83564053b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620934, "uuid": "805003bf-15e5-4253-b5f1-7b5bdb7fd1e3", "value": "SecuriteInfo.com.Trojan.AgentSpy.68.6300.16736", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7825c82-c20b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1650611612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650611612, "uuid": "87739120-d638-4742-bf01-6853f05e6bbd", "comment": "Malware payload (Loki)", "value": "db47c464e4b7f5a9d3ca3b09a8d96cf8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650611612, "uuid": "bf6208f2-d66d-4a0a-82ac-cb30ed2afb5d", "comment": "Malware payload (Loki)", "value": "040387594eebe4988e59500a6b8a47bea39f63547b5cb7c89ac878c0d30fcc20", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650611612, "uuid": "0ef828b8-c170-48e2-9634-1fe2fbd553eb", "comment": "Malware payload (Loki)", "value": "7edde26e9c6d3726da1e4dceebd46e742b1d4d4d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650611612, "uuid": "fb4de21c-9d8e-46b6-be92-af7e063282e9", "comment": "Malware payload (Loki)", "value": "4183f6ff834bda10705f8cb977d5f952be6f64c1adf826ca15c4c9a6bdafde7b32d47951669f035c10dc6556458d0ce2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650611612, "uuid": "3ba26809-026a-4d0e-9116-0189a8589382", "value": "T13EE30208BAE8C963D46357310B3F66B6AFBDDB1161B4454F1750DF1E3E22686CA0E782", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650611612, "uuid": "6576e11c-d174-47e1-a026-2ae91d8ff10d", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650611612, "uuid": "06c3ff30-c212-4418-8bf1-41dad30f619e", "value": "3072:l1NjcVVnLpPunbXwPVJEsEGH2AUzKyHwss9k5tlbAoJQD4AWf7bN1:HNeZmAPcsEGWDKkwPk5lJQDgfz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650611612, "uuid": "64968a7c-56a0-4eb8-89d5-418362d65585", "value": 154023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650611612, "uuid": "4dcf3da0-b2b5-42be-baa7-b3a60672428e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650611612, "uuid": "e6c58714-c801-48c6-b765-fdb1430d3b93", "value": "db47c464e4b7f5a9d3ca3b09a8d96cf8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efa05e99-c296-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650671406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650671406, "uuid": "17676ef2-36d8-4036-a048-8f34694e594b", "comment": "Malware payload (Mirai)", "value": "690d7d1d1026758ddccc4b8553a77fe2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650671406, "uuid": "f7a1fd94-d182-421f-a313-52352d6ce6ba", "comment": "Malware payload (Mirai)", "value": "043c75aaaef49914099dc29548188b81f322bef15898338a6a1b14d841f06ed7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650671406, "uuid": "0c638ed7-0639-41c1-bc6d-69f1ca6d6129", "comment": "Malware payload (Mirai)", "value": "ea3d0ec41b65287f54e052c5a066cae2ebdc2ba8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650671406, "uuid": "2fcd1092-1f7a-4cf8-9a3e-56a09f30bbb0", "comment": "Malware payload (Mirai)", "value": "a485b44eeaffb76ca5eec7db955ba691204b44280a27310499402d44d79d55890f7a6207b84d350617b8ec0f423f055c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650671406, "uuid": "fac947e7-eb3f-49d3-b557-aebf372dd60c", "value": "T1BFB2E017AEBDFE5FF4102A701CE8CD7512C160CFD118A31069427DC2E825684A7E9BAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650671406, "uuid": "f0d9948c-e4fb-4ffe-9fdd-a1d65d16fb80", "value": "384:M61DKlF58AxvqhzikFJWo7J9+HhyeOHeKe/Z8mxrdlEer826kZ+dK/c5q2fCfPSr:7qdqhz7n7J9M0dS8mxEeDZSK/cDyyDP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650671406, "uuid": "2dfaa227-c1fc-42c1-b6aa-30f51be1e8c6", "value": 24280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650671406, "uuid": "715d2c81-1885-4b8b-9ec7-93eded75a835", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650671406, "uuid": "3884be1a-6e37-41b5-983d-4d54d4245f98", "value": "phantom.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6124bef7-c269-11ec-8e58-42010a9c0032", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1650651839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650651839, "uuid": "b224b37e-a886-47fb-9b51-4b34cdf9ece2", "comment": "Malware payload (ArkeiStealer)", "value": "b45e7e0051ca9575cf26ab88b0c6b5b9", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650651839, "uuid": "619e09b6-93d1-4f6b-93a7-4b1dbb4021d6", "comment": "Malware payload (ArkeiStealer)", "value": "04df2d1f6f304d667cd8f34691554975e4df5ffa8bf354dd09fa5122cf2f8999", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650651839, "uuid": "f91478c2-b420-4a96-b55f-c09092e2154a", "comment": "Malware payload (ArkeiStealer)", "value": "cc79f4219d85665cc0471c78423e4cffe083e6ca", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650651839, "uuid": "d56d8fb4-fbdb-469b-be8e-f4d127d9a938", "comment": "Malware payload (ArkeiStealer)", "value": "3921bd068e1bf9cfaeaa79629b6a3a3f0b5df9b41eca2bbd17e284a055e27080704bf2c2b0a98e6621eb58f1b8b5da3c", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650651839, "uuid": "504c7d6e-0885-48c1-9acd-ee145790eef6", "value": "T170E4F150AAA0C03DF2B712F87475C37C652E7EB19B6051CB52D66AEE16342E0ECB474B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650651839, "uuid": "93491d87-1454-4020-96e0-ea1b17d4c6c5", "value": "318349caf1d96b45a02e10e8be9a2be1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650651839, "uuid": "b84a3070-8a04-42e2-bb16-fa4f29920d95", "value": "12288:ePTEwKfbwq58NEJsMd5a6WXqAae70LJvUv3FMHnEphj82UU:7/jwqGNesMrwae70NQaHnEXeU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650651839, "uuid": "d762738f-2ccc-4886-900e-bd2edadc75c3", "value": 709632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650651839, "uuid": "573acb44-df9c-4a7e-b347-87f96e760dac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650651839, "uuid": "7b0eea0a-36bd-42f1-bc60-0587a7604f19", "value": "p.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cc1d8b5-c24d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650639672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650639672, "uuid": "b2cad9dc-7e65-453a-9ac7-be59c923aaa9", "comment": "Malware payload (Mirai)", "value": "2b1bf74beb5ccabe6e5c1a21a7076a98", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650639672, "uuid": "bcaf646f-ac77-4b97-b41c-770414a2e1c1", "comment": "Malware payload (Mirai)", "value": "050ad310d652b384b04c20c85779759c4c225c1445959121cc9c89ede86bdfe5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650639672, "uuid": "5c8536b9-d639-429f-bde4-5b786555363b", "comment": "Malware payload (Mirai)", "value": "d42c638e885b5318df85b4bcfe51c7e921222bb3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650639672, "uuid": "2fc884c1-32c8-4234-81b2-0c0970f5ef5b", "comment": "Malware payload (Mirai)", "value": "74208b7dfb8165a0f54920e546e8a21724b2f415a38e602cc8064d435dbc5f7e8fee9b6871d16617c2d85bc6c8211af4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650639672, "uuid": "361e2130-e072-4636-a517-2216270d6717", "value": "T1B3F2D101AA0E8284C7AF903E5EDC5E861400479951A5B8F6BE94672F2B7BF15FB0D2C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650639672, "uuid": "7c2c0abc-fd39-4ed8-9df7-70680ea837f2", "value": "768:L2lmq4LL6evsahSmMKFmhcwOP+XFulnv5Tel0OkPIxVmkFyhXwVnbcuyD7UVyqJ:L2lk6oBhOKYhB0+XUvxmgA/mkkwnouyo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650639672, "uuid": "ac3c317a-a48b-4ce7-8699-a2358ed53e08", "value": 36732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650639672, "uuid": "9c4f5e28-1857-4a5e-8688-8df8dec3853b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650639672, "uuid": "0030fae9-4951-4d4c-9509-ef4c89d97d9a", "value": "x86-20220422-1501", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b2034a4-c225-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650622704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650622704, "uuid": "fa43f82e-f3a4-4a4f-bd37-c3d145988144", "comment": "Malware payload (Mirai)", "value": "f9fc99991319c986e3d577c4cedb25f4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650622704, "uuid": "78ba16b6-3934-48e5-9aaa-40a3c41dc5ba", "comment": "Malware payload (Mirai)", "value": "075f6ef88f1e7393e392559eb46173f037c49729b1276f80387796900259dd15", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650622704, "uuid": "62b2eda0-2f43-44cc-914c-48bd52e44121", "comment": "Malware payload (Mirai)", "value": "b71dc4986b1063e6b3c43a104bc8f7a6b40d34ea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650622704, "uuid": "af42eab0-7749-4f1f-be52-5d06806d2252", "comment": "Malware payload (Mirai)", "value": "31eea59796017680f721a9a5baf44a389e6e358e7074552e4b19b0e05b6812cfe44866c3305574fadd9d82a8c7f5429e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650622704, "uuid": "b3dc6655-a9d9-40da-b4e1-9548aa47ace5", "value": "T1EDA2AF65F65A4EF1EEFDE8F04DA5F6C027B40B9DBB91CF916009EF22490281692438D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650622704, "uuid": "1607cc31-0fe8-4216-abf7-820cb91ec4ce", "value": "384:Bz1+wCDiWb+IzIF9Z13ac+ZT5Vy8CUgbJN0JjnM4uVcqgw05LxJsuU:j+PWWb+ZN3aJ15Vy8k30JQ4uVcqgw0zo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650622704, "uuid": "bcfc750b-bafc-4b73-bd4a-4255d3728158", "value": 22248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650622704, "uuid": "91dcde45-7d1d-4165-8bb7-8422bf7e719c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650622704, "uuid": "51145d5b-764e-4095-8626-3043e3f13622", "value": "f9fc99991319c986e3d577c4cedb25f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a32a4f62-c236-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1650630046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630046, "uuid": "a9132ee5-9a01-4563-a334-691e8a34b308", "comment": "Malware payload (SilentBuilder)", "value": "402a7ba73bf410277bf7cdc7685ccc33", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630046, "uuid": "10b03fb2-66a0-43c1-81df-7717322c4700", "comment": "Malware payload (SilentBuilder)", "value": "07ee21f0ca058d1bf64f4d2dcb26057b1b0eedeef2afb3114655580ac5bfeb73", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630046, "uuid": "6315e76e-0207-45eb-9ffb-960e7b67b941", "comment": "Malware payload (SilentBuilder)", "value": "34eae8a8504a134b9899b1c9ebf356a5b2b48477", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630046, "uuid": "d8f3db85-c58a-48d1-b185-7be7699326f2", "comment": "Malware payload (SilentBuilder)", "value": "439a4e99ea7896f0c9ccd1d2f7d48d473d8e2c7adc916f5df76b427582da91be26d2bdd12edf01c2e47d67b1ca0a8e73", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630046, "uuid": "ed96d30a-e6dc-4d61-84c3-4aa543855deb", "value": "T1E723B646BA5D9859E9258B7548E743E9B333FC201F6B0B833616B3257FF49E05A03207", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630046, "uuid": "6613dcbb-14ce-426d-ae0e-d8f3e9e7ce6e", "value": "768:4DM52tfQXi8vgLZkTOHkQT51Vp6AwPdM8gQ6JT5X6DGwUdh+pqjeSLjcvLtzrxFa:462tfQXi8vgLZkTOHkQT51Vp6AwPe8gf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650630046, "uuid": "d2eb3923-9b11-473c-96ef-d37deefd8376", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650630046, "uuid": "7a7fbb77-4d14-427b-943e-2b1ee4b08954", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630046, "uuid": "58ee4d9b-d02d-4bcc-a6d7-a36d30e8d699", "value": "AAO-010422 RTLT-220422.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cee13b0c-c211-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1650614228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650614228, "uuid": "adf6f6d3-6355-49ca-a3ef-b6b8ac3da9df", "comment": "Malware payload (SilentBuilder)", "value": "1c0ef67418840bace31d3fb48d49918a", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650614228, "uuid": "f48b4f92-fea9-47f3-8f9a-a2625169e2ed", "comment": "Malware payload (SilentBuilder)", "value": "080aeee87dacdc82d27ee7f137deeb9108a5f98be6abd4d4ef56412de58357f1", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650614228, "uuid": "e4bded39-79db-43a3-bb4b-568f3b4da6de", "comment": "Malware payload (SilentBuilder)", "value": "461e34d8732e400f95cffe9343025de94f21cbe4", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650614228, "uuid": "4a42b610-3718-431c-a4e9-626a78124894", "comment": "Malware payload (SilentBuilder)", "value": "87e793e748569e697538d6270b9ace25e4ac0e3c5e29e095bdbfd7624647bc89d8e3e690546cb3bd092393ecdd8954c8", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650614228, "uuid": "81b3babc-e9d9-43ee-bf84-f7a81522829c", "value": "T10723B756BA5D9899E9258B3548E743E9B333FC205F6B0B833616F3257FF49A05A03207", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650614228, "uuid": "a60b78c9-da97-4d36-9582-f0503eecd745", "value": "768:yDM52tfQXi8vgLZkTOHkQT51Vp6AwPdM8gQ6JOiX6DGwUk7qHDSEuRZjiBp53:y62tfQXi8vgLZkTOHkQT51Vp6AwPe8gF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650614228, "uuid": "09b86c68-d63c-4f69-88c8-99b0b62f55d6", "value": 48128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650614228, "uuid": "28608655-83cf-4769-94c7-fb86d613d819", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650614228, "uuid": "4cebedb1-6952-4b06-87a7-0229d487936f", "value": "BANK TRANSFER COPY ACH.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a953f740-c236-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1650630056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630056, "uuid": "50942c65-f23f-4714-8278-4f2f19896711", "comment": "Malware payload (SilentBuilder)", "value": "c68ee62cf1e75b0fcdcbfb23b2bb25c5", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630056, "uuid": "40232dc8-d540-4240-9564-1b719d4edf26", "comment": "Malware payload (SilentBuilder)", "value": "08143989a1974a340faf79e9a4bd81e14aac6f3bde03c23c78811065cde3ab91", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630056, "uuid": "5f0e70f3-6d98-4f3d-8348-6cd324cf6837", "comment": "Malware payload (SilentBuilder)", "value": "3554158be6f988b702b5839713d5cb9ecb02f0cc", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630056, "uuid": "dab865a3-3e9e-4c4e-82da-a07585fc60f4", "comment": "Malware payload (SilentBuilder)", "value": "7cc0a70ecb186d055f539eec50a73fbe2d1da41ee0091650a7899de09efb38f12ec50c7e3191caca996f91280c412bf3", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630056, "uuid": "5576aff0-c350-445f-a734-45f81c5042ae", "value": "T1F423B646BA5D9859E9258B7548E743E9B333FC201F6B0B833616B3257FF49E05A03207", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630056, "uuid": "b6b41158-3661-4df3-836c-5bc2c3d88e65", "value": "768:4DM52tfQXi8vgLZkTOHkQT51Vp6AwPdM8gQ6JT5X6DGwUdh+pqjeSLjcvLtzrxF6:462tfQXi8vgLZkTOHkQT51Vp6AwPe8g/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650630056, "uuid": "1407d27b-ddc1-4408-a389-7db6e9e620ed", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650630056, "uuid": "0324dc7b-ef98-41cb-8f47-969019b0a1a4", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630056, "uuid": "b3cbf485-402f-4453-8a4d-7ce49396d5b7", "value": "iMedPub LTD_2.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07e16838-c286-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650664145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650664145, "uuid": "ed8519d2-b989-40b7-9e01-51fd65bc6579", "comment": "Malware payload", "value": "acbbc946a9441b52cc8cd84292977931", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650664145, "uuid": "6fb857f9-15d5-4ea5-a2b2-dbdcd339a5b9", "comment": "Malware payload", "value": "082d5935271abf58419fb5e9de83996bd2f840152de595afa7d08e4b98b1d203", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650664145, "uuid": "36e80f74-99bc-4417-97cc-ac28da1b8967", "comment": "Malware payload", "value": "232258201e20b9b256a64987227148095aa2954b", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650664145, "uuid": "c48c970a-d6d2-48f7-9017-8d8204d26659", "comment": "Malware payload", "value": "95d24919acfc090a69d9825a1455bebb5682e93403e119ac2a5509f366b22e67de05b1a5ec69e2f7f4bca9af19d464d9", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650664145, "uuid": "1d770c82-eef0-4524-8629-3d1d9402c790", "value": "T16F71D89E24013790FA17097AE822F20D872679F19CF4EB39B4BD978A131528478D1E3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650664145, "uuid": "bec8e498-2d36-4d94-b7e1-5815696d9006", "value": "48:88r4ablfVt7cfvWOOLbbfFrcMPGJv3yxhsqTNkTBMF4EEPC6FqfJrwy0H:88r4o4uLfhzGNuhs6N22F7ACXfaTH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650664145, "uuid": "7bee5383-7259-429c-9319-68b22c0efcff", "value": 3728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650664145, "uuid": "bb60acac-c895-490b-aedd-07d6d1f1861e", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650664145, "uuid": "8a48b09f-85c0-4491-bad1-e42802cffc41", "value": "INV 2022-04-22_1538, US.doc.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eed4dba4-c241-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1650634897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650634897, "uuid": "db431f15-cb56-44d8-9c4d-e93b9b186c0b", "comment": "Malware payload (AgentTesla)", "value": "adfa2d703fe1a061bb4ad1a36e7dadc3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650634897, "uuid": "e111285a-177b-42c2-9992-b49a985acb5d", "comment": "Malware payload (AgentTesla)", "value": "088d96e8046ad96c772018986366ec2454495bf83b169465b2e323f21672da3f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650634897, "uuid": "8d97e34d-1888-4ed1-9724-1c4cd30e09cf", "comment": "Malware payload (AgentTesla)", "value": "7d73cb82cc7425723507d1bc800008162b66ddba", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650634897, "uuid": "9859a533-cb6d-4045-a27e-93d923d93590", "comment": "Malware payload (AgentTesla)", "value": "7ccc006dad60e956161ff60f2ed6eaf2577f6c7181bae0608702106e88c0f9a18ad0f289a6abb4106c3d42227169a640", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650634897, "uuid": "5243073c-d657-4ece-bc7e-df52838f0488", "value": "T1668412247E19D347E30E82B46D76CA2F04B2FD81EF0A79BB4C9A71ED45F97D042A4984", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650634897, "uuid": "c1dd274a-1ae0-4e65-807c-22bc92eb2941", "value": "6144:f8831ASs2xOshjDU8jGf2QjHpv36TxvR+rK2Ix6/3LGKS/8mxt680Jc/tdF9T:k8fsAOs17jQpcxp+2hK5sxt2Jclp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650634897, "uuid": "4b288ed7-33dd-4df1-a422-b6dc3741e09e", "value": 377344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650634897, "uuid": "a92a5ec2-46b7-4804-b121-eef1e76eba96", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650634897, "uuid": "c696786d-483e-48eb-ac4a-8dea738a9d37", "value": "Shipping Advice MSG - ETD FOR SHIPMENT 22 APRIL. 22.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "637fda98-c211-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650614048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650614048, "uuid": "ea802ab1-5faf-4cd0-9510-f8316c4e03f5", "comment": "Malware payload (Mirai)", "value": "7ba6f2927d03a4fda80365f513d394ed", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650614048, "uuid": "3c4fe4c1-5e04-4a63-9048-d41736ae26ef", "comment": "Malware payload (Mirai)", "value": "0909384ebf32cbe734ea40fe46f847757eb1e7bc198fe2ec6d1ace9976679eda", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650614048, "uuid": "ed7ecdea-c156-4a99-8ad6-ecf7d1e043db", "comment": "Malware payload (Mirai)", "value": "61abe8fea7e216dc45f6f571c49a592d428eaa36", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650614048, "uuid": "3a5f8f93-61ed-4746-a634-6815bcf883f7", "comment": "Malware payload (Mirai)", "value": "b53a2475eeed54d49853b4ace644d4afaf624428cd87b78a186f6196bffc2c94bbff0636aad38f384233a2805679117e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650614048, "uuid": "c7e36878-79d7-4e2c-835b-9af5c4b06110", "value": "T1A9132A42322C0E1BC2A65AB0363F17E083FFF99424F4B689654F9B568675E761086FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650614048, "uuid": "d901191e-bd13-4404-bbbd-8e9dd71f5473", "value": "768:ZwdJtlmj/V8l+C1EvRolahi+pUAkt/tmHYlUtCk8ebuQRA84M:ZQIdNC1EvzkAAmH5tceARM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650614048, "uuid": "3ef687bf-0643-4a39-8110-7573150562bd", "value": 43732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650614048, "uuid": "bf9b592d-79a1-4c1d-9022-054999e41466", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650614048, "uuid": "c979c227-5a2a-45b1-b469-05bd4cd73bfb", "value": "7ba6f2927d03a4fda80365f513d394ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69d7df04-c213-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650614917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650614917, "uuid": "d5badaeb-061f-4ed2-850a-bc061a362c76", "comment": "Malware payload (Mirai)", "value": "6b5c673c87b783caf410e992177b1d25", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650614917, "uuid": "5279f585-0417-4cf2-9463-6feca82583f4", "comment": "Malware payload (Mirai)", "value": "097bc78310e5bc2fe6ad18392ca23c049c6ccfe3df57bf6eb43fd255d086a5d8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650614917, "uuid": "44b7d94e-b1fb-4f58-9367-434ab60d535c", "comment": "Malware payload (Mirai)", "value": "86116df59459d1875229d9aee121dd864913cb11", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650614917, "uuid": "c61d49a8-1398-4dc6-a9fe-de943dbdb1b5", "comment": "Malware payload (Mirai)", "value": "872731b1440593aae44bdc6e70882ba5c59d34ead65f357a3fee143fa747a5eda60ae3d549342e45bd5a5b31c3524ab8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650614917, "uuid": "c4572d5e-f801-4371-8f8a-8c6d17f46d99", "value": "T1EA232951B8829A13C6E4137BFA6E41CD332663A8E1DF32079D222F0477C692F0DBB655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650614917, "uuid": "1e699e65-dccb-416a-adf2-b03efe5af295", "value": "768:oTa1Suyj3927Zxdqn0kblr5aAQ3sOHBunGzURvInmhgVycP3auOgqh+UPN+wc8/b:j1Sbc7ZxC0kbWAQ8OHs2KutqeOi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650614917, "uuid": "401e98bc-f523-451f-bf0e-f2412f46d943", "value": 47620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650614917, "uuid": "dcc3659b-6ff4-4c1a-8743-9fa5b2890c9a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650614917, "uuid": "89931dc2-938c-411e-be38-2a17b59aba24", "value": "6b5c673c87b783caf410e992177b1d25", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d2d7444-c206-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1650609205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650609205, "uuid": "d6cb5cc6-3dfa-4a1f-bc31-ead87f9cd080", "comment": "Malware payload (AgentTesla)", "value": "c29c8c36af6ecdc5af7b2187d13d1ccc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650609205, "uuid": "56c69ef5-8880-453f-b9f2-3a72e7d649ee", "comment": "Malware payload (AgentTesla)", "value": "0982b1fead8070929f56d0f38888115a22983af4c855c67bddb5372b8631e72f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650609205, "uuid": "1f3d34a4-fcf4-4299-b383-7d1727d1dc9a", "comment": "Malware payload (AgentTesla)", "value": "113282db20c505f28085efe27f7c143d663a5305", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650609205, "uuid": "c598cafd-931c-4faf-bd45-baa9b6d94cdc", "comment": "Malware payload (AgentTesla)", "value": "5c38f10f4bc541b8f61dd0ca7127b3b5457fb986082c0af5e0e46576c745faa411d31833206c381988e1ab49b41ffbf3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650609205, "uuid": "bda55c28-b5f5-45af-bf5c-c62d971aa86e", "value": "T18C9423D9F82033AC985B5078D158D7EB91409D492B8F1CEC3612A8CF7AD6AC5631BC6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650609205, "uuid": "26e650e8-42c8-4815-837e-52344f2e5b1e", "value": "12288:Bu2PX8lrA2V/W6rI6paxjVSR1kwSTwW74:A2sr1Y6rIyIVSXkwSl4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650609205, "uuid": "2b0c2d65-761a-4a8e-803d-6e11d9081186", "value": 412320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650609205, "uuid": "7ca444ff-f9f8-47c3-97dd-498bfb9ea117", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650609205, "uuid": "85de1cc7-895c-465d-9adf-38d109b167a0", "value": "BL+SHIPPING DOCUMENTS.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92296fa9-c248-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650637748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650637748, "uuid": "fc92fa04-3732-4f2f-9dd3-c80a83c4b942", "comment": "Malware payload (Mirai)", "value": "81fcd62e6095f7d509de89a1617d632a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650637748, "uuid": "63470b24-9841-42eb-9195-58edeff8ece4", "comment": "Malware payload (Mirai)", "value": "09aa428bcfda8dcf82b7c0c30d824a619432e57b557882bd0e8d689c8a73cecd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650637748, "uuid": "b0d02f00-f8c1-478f-9316-bb9730fd3914", "comment": "Malware payload (Mirai)", "value": "919ac367e28d5a9be993df39e465abcd8d08c8bb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650637748, "uuid": "78d64dc9-7a50-4f2b-8ef8-5f043e956bdf", "comment": "Malware payload (Mirai)", "value": "fe0debdc4c6972dda4026d7b43691f309e94c862925e20541c2b41d788bccb155d84689fed3b558b16c1ecc1191eee77", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650637748, "uuid": "a1a80936-3c9c-4370-9f06-cbad8ea1e01f", "value": "T1A6833C02E743C6B3CC830BB2029BAE665931BDAA1E269F49F31D7DF45B128C47116F56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650637748, "uuid": "4d33180c-db99-4bba-9e17-3adeda06dd2e", "value": "1536:W35b9Vc4N3J6lreu5r4hWj8LIWDloRmF+wVOz+sXcfW7k:Ab9Vc4JJ6liuq0Y82oRmEwVOz+ucfW7k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650637748, "uuid": "cc48a11a-6514-4dbf-9c1b-2511faf5ef78", "value": 84999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650637748, "uuid": "7f5a160f-8abc-4451-8eb5-eb26508cd3a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650637748, "uuid": "38a6ed7b-8a49-4a44-b131-b63c49ead5db", "value": "81fcd62e6095f7d509de89a1617d632a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bdcc18a-c21b-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650618249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650618249, "uuid": "b4c52f96-b919-4401-b41a-0798dbed1fc3", "comment": "Malware payload", "value": "0d5967de55afacc3c5a1dfe4eb08ffda", "object_relation": "md5", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650618249, "uuid": "a594d228-ac76-4586-b669-2f0de1453160", "comment": "Malware payload", "value": "0aabff133188b9ea7917ee842b28a62c3380c254a0f2cf0873c796bf022969be", "object_relation": "sha256", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650618249, "uuid": "2742df88-5152-4011-be7b-3b96924c42e9", "comment": "Malware payload", "value": "1cf4decc7daddeedd51ed9541b7ecb101d9b7638", "object_relation": "sha1", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650618249, "uuid": "55b8ad2c-9b81-4073-b58d-b49d293e41e5", "comment": "Malware payload", "value": "d1a643cfb899d613a8dff630af3ba38365a8dde540c1d59e0dc3d70ac4d54c7adddd07d08a5404097fa70b0c8975e423", "object_relation": "sha3-384", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650618249, "uuid": "d04b95bb-8258-4b25-b868-ed9965042e46", "value": "T14FC48D57F7C7FAB0E6BE827A86B1891C527774520260A78F674072896D23392493DF0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650618249, "uuid": "52796790-16c2-4f23-920b-f466345e55e1", "value": "a31761b5a590c4c499d5f4a347d75c12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650618249, "uuid": "7881f344-95f1-470f-bfb1-058bd56cd519", "value": "12288:Vn/zDvGHAykHSzLW/4+8bzbBSreMdmhgFK/UqW:ZzbGHAzHAjX1JcL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650618249, "uuid": "f4e38146-c06d-465a-aac1-b59f27d74f81", "value": 566784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650618249, "uuid": "f4df5a38-7691-4c37-9761-a3e29a108bb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650618249, "uuid": "bc4bdb9f-d6f0-40c1-ac56-3ae09d1ad0ca", "value": "PO.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45e091e9-c256-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1650643633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650643633, "uuid": "57bbb881-eb64-4305-8f34-5d8e3858ed96", "comment": "Malware payload (AgentTesla)", "value": "965f1f7f894afaf9635baf5e90639db1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650643633, "uuid": "0407fb34-3cb9-4082-b031-36a04c756a70", "comment": "Malware payload (AgentTesla)", "value": "0ad21a734a1d00896b47ab22b5eea0cebf86f8300f09673ac07e29f15835528b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650643633, "uuid": "e575b657-0811-4375-92e9-00bdbf2c9a70", "comment": "Malware payload (AgentTesla)", "value": "822d39dbebf5658dece48a052fc679b37f20698d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650643633, "uuid": "7de42ece-1428-47c9-b638-a5c89013990c", "comment": "Malware payload (AgentTesla)", "value": "f6d15951d85fb6dcf798c5c7f856a258049e36c027654f0256a09c13be4e01ab363e2fd3984910861990e8f69003df75", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650643633, "uuid": "4fb3cad0-2c43-4ba5-a79c-2cb555c56b64", "value": "T1F3D412AA32690B25C5DF0BF2F8A445091778AA07D523F70CCEC436CE5D523C5A662BB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650643633, "uuid": "3e341103-ee05-4385-8ff9-262b31774a4d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650643633, "uuid": "02decb5f-4891-4664-b54b-d5a55494dda9", "value": "12288:llluPGzeQErMKM0tfpdHPMsa562w/KQSVXGVh/w0qVDJ+rAT6zM:cGerlMyfpdvMsaA2dD1G/OV9/6zM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650643633, "uuid": "a537fcb5-3a49-4d52-8127-720d9153cad8", "value": 620544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650643633, "uuid": "e060462d-83a3-4f3e-a5ad-ab32bb596896", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650643633, "uuid": "824b467e-d364-4c43-82ef-e194c3e5284d", "value": "T3hAdK4WBctcU9o.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "330c8a35-c24f-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1650640595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640595, "uuid": "6dd146ed-ed4d-4903-86cf-69d176198597", "comment": "Malware payload (SnakeKeylogger)", "value": "7b678b2856804dbc7d79d66a7f24cebb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640595, "uuid": "34cc8795-de65-456d-9380-88ea71fcdd5b", "comment": "Malware payload (SnakeKeylogger)", "value": "0c656a34dc4cedfb65ae9157b33f6af2ad1435f24b00fc93a623d1d50f31750a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640595, "uuid": "7e3f794c-c0cd-47ed-9c00-bcdcf6ba58be", "comment": "Malware payload (SnakeKeylogger)", "value": "3af9b28a27026890d3ec36c0342f3887495c2424", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640595, "uuid": "07f72134-9426-4e83-ac00-cfa56ca367a1", "comment": "Malware payload (SnakeKeylogger)", "value": "9e8c4a04b38da86f475e9cbab71491368d73f4fac658b9e1cc52bdebf0aafd8714d266c194d0be528f542aabff30c480", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650640595, "uuid": "1e5b26f8-28b6-4ddd-811b-f15407ecc190", "value": "T1ADC23A065394C332C4B60B7768D70791D732D69B656BCB1EF88D022EDF6370686A3B62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650640595, "uuid": "8f4dd4d6-7d8e-4d59-ad3c-4321784d40b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650640595, "uuid": "6a967013-ca95-4d8b-a78c-26af9a8ff042", "value": "768:3fKmGAzhIVD1SUaq1LyJvz/ztYcFmVc6K:imG+hIV2aWjmVcl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650640595, "uuid": "7df1a287-a78b-4d94-a136-08d7c2b82df4", "value": 27648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650640595, "uuid": "5a93323f-3472-42e1-8dc0-46b8b81143e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650640595, "uuid": "a872810e-28ff-4323-b8cf-0d14c73dffe0", "value": "56516426-056C-4DBA-984B-979F68AB8D18.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bdef55b-c221-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650620960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620960, "uuid": "af88ee50-704a-45cf-ab50-61dece96e5b7", "comment": "Malware payload", "value": "57d6bba9fd1cc4b1577a93fc245012ef", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620960, "uuid": "bc0c7a40-3b5c-4f6a-80be-2ba6f414a9b0", "comment": "Malware payload", "value": "0c9c85e0d7de31826145bb3da20cec78df12f91934550e619882ad1a46b9e722", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620960, "uuid": "230f0c75-4fc1-4801-a8d3-4cf3e5e8ac37", "comment": "Malware payload", "value": "ebe41e63866cc268a439416084050cec41b38659", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620960, "uuid": "8edba15e-e9ee-4b77-a1aa-0ac465fb8889", "comment": "Malware payload", "value": "24e67a49703e3c3be7f3006869475311ec62b249f2e89b46511e529cc3193af480c4f8e108b6c5ce9bbadaecfa0f41f1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620960, "uuid": "76027312-e73e-4f37-b905-185ebcebd090", "value": "T156D54BE3B2C4653AC46E163A5D3FA658993B6661251E8C7B07F0488CCE267413B3F637", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620960, "uuid": "dbc1421e-31a4-47ee-b13f-aa6be0a4ad7d", "value": "54573d9ea39348f88f98f339af755e42", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620960, "uuid": "fe5bb0dd-df62-44f5-96df-4c91477b98f8", "value": "49152:2E4hgLpuRQSmEEm1FWSdaIo+tZTjtSxI7geD:2cU1FWgoBad", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650620960, "uuid": "be644827-35bb-484a-9623-45b81e7b7b8b", "value": 2862080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650620960, "uuid": "2b7c4a8f-b4ae-467a-b582-3362a4272880", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620960, "uuid": "3729273e-324d-4a81-82aa-e9ccc8cbc250", "value": "SecuriteInfo.com.Trojan.AgentSpy.68.17649.24374", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9b44a4e-c243-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650635721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650635721, "uuid": "22241766-6add-4fa6-a28c-5f6f13df0a02", "comment": "Malware payload", "value": "1eb54b23af10302467f9e50bd277467c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650635721, "uuid": "74f675e4-b4a8-48e7-b1c5-6d7a40e140f0", "comment": "Malware payload", "value": "0c9dab8df8f41aa63b9a1d348662fe2db2957c7790105d4f5fb39f6b978fb645", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650635721, "uuid": "dba0136d-16ec-4d65-b654-f6843a206b2a", "comment": "Malware payload", "value": "0ee8c360d98c9b326fd5c3c41292775d213588fb", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650635721, "uuid": "f6e29469-acf7-465e-a846-e0344418fa1d", "comment": "Malware payload", "value": "6a21e4f43e753ccaf8425dbc0ea3a3c9905bcebbf6658cd3fca11806447657a1250b12a1859ffa0024e496f471a13359", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650635721, "uuid": "525fb66a-f31e-4653-ada5-b94175edce90", "value": "T1E3D49D11F6AC80B5E07BD13DC9A3875AE6713C9847B943C79255EB2A2E736E05D3E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650635721, "uuid": "159af15d-a3bd-4962-be7a-65190f406bcf", "value": "6ba79cbed2acbe9b8ecc8e14a572f100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650635721, "uuid": "24dd204a-7a71-43a9-9ec9-08955ba31397", "value": "12288:C1FIcocJwMTHzXO7N24BHiyzskF1CubVnmn:tco9MTHzXO7NN/115mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650635721, "uuid": "d8bb53f7-a251-4725-8030-829325db6060", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650635721, "uuid": "3782f8e7-5a43-49b5-ae58-5dfb57dc0701", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650635721, "uuid": "435cd268-f812-43ac-bd23-b40eed1f6d09", "value": "sir8aJeR7lCqW0IjG2oHH9qecvwMPm0E.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16e6502b-c260-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650647849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650647849, "uuid": "63ede274-93ee-4be5-bbb5-0be82ec9eeac", "comment": "Malware payload", "value": "66dae377adc16b2089d3ffa092f959db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650647849, "uuid": "f80885fb-b2e2-4f6f-8593-8bd466277f83", "comment": "Malware payload", "value": "0d31029730141de206ecfc0f9b54a93ff32c52f4e901cba711ab832dd354a909", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650647849, "uuid": "1037b8e2-c0df-45b5-8682-101cf017d1df", "comment": "Malware payload", "value": "212cb43359588f9e1809a04d35bff333ab8d5d0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650647849, "uuid": "7bb0456a-0a76-4508-83c2-0df667e2e82e", "comment": "Malware payload", "value": "5c7a7474e5955a6ad46e68294167c4447ee5dc6564ec3872de738890cbdf05b617ab505d8bee4db62dff9be60a6cd43c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650647849, "uuid": "85040030-d7a2-4680-a9ed-6aef05819728", "value": "T1EDD49D11F6AC80B5E07BD13DC9A3875AE6713C9847B943C79255EB2A2E736E05D3E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650647849, "uuid": "7dc1a809-5fff-41c3-9c54-cab322b87b72", "value": "6ba79cbed2acbe9b8ecc8e14a572f100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650647849, "uuid": "dbad1262-ae1a-479a-8831-49cfbfbe2073", "value": "12288:C1FIcocJwMTHzXO7N25BHiyzskF1CubVnmn:tco9MTHzXO7NA/115mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650647849, "uuid": "7b5a24ab-d217-4522-a1f5-5ad82416a8b8", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650647849, "uuid": "a50d0cac-50b8-45fa-906e-0afca6727ee3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650647849, "uuid": "c4ee9525-5260-4fd0-b6d9-258a24137600", "value": "66dae377adc16b2089d3ffa092f959db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b60fd401-c1fd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Worm.Ramnit)", "timestamp": 1650605596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650605596, "uuid": "78f777ca-b936-41fb-b897-347df457dd36", "comment": "Malware payload (Worm.Ramnit)", "value": "d6bac6b96ed7a5610234806b997aed4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Ramnit", "colour": "#8B8B76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650605596, "uuid": "0603b1e1-05bb-4dee-ae47-524340795d1f", "comment": "Malware payload (Worm.Ramnit)", "value": "0d3ef54991f98e97d556cceea13e944509b5e4466079e8d44405f8644e668828", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Ramnit", "colour": "#8B8B76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650605596, "uuid": "9499f152-1087-4bfb-9329-1683690280f5", "comment": "Malware payload (Worm.Ramnit)", "value": "3364bd1fc2b4024c5536a2a871b82e6e80b24cda", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Ramnit", "colour": "#8B8B76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650605596, "uuid": "96cc4a85-06ed-458d-9df3-221abddd5873", "comment": "Malware payload (Worm.Ramnit)", "value": "882b3835818f62866d9b8cc97cc80bc87b4fbbec4401b46d4f353b2733a597acb1101068c88c8558492c83cdb472ea5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Ramnit", "colour": "#8B8B76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650605596, "uuid": "fd323a99-0519-4c8b-87ad-0f29cd30fd78", "value": "T1A0B28CA38E44C5F3D3CB1AB410623E1FEBFF963552729C5AEB941DC7A9BA1D0D028106", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650605596, "uuid": "cc6a9fd3-8218-417d-b808-1bcea1fcbd32", "value": "a96d166ab17e011e8049d87211158ae5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650605596, "uuid": "fc13592b-6c90-40a9-8488-cd2771512134", "value": "384:7FmSi4TZQKqOejdDaOsI90wx/4POkIRMPeagtd6LPAPMSAO/08N7UFW7GbAxur63:d5qBjd2W90wx/eOnRMVgtdaPAP1AO/0i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650605596, "uuid": "48a5e9e3-3855-4c8f-ba86-1d010caf98b4", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650605596, "uuid": "ab32f3b4-2501-4e7c-88a4-a5391e02158b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650605596, "uuid": "213b5fda-10c9-4ae3-b049-ac858775d864", "value": "DAH.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9fac9a8-c263-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650649465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650649465, "uuid": "3cd5310b-c9bf-4253-b937-23c2e2761308", "comment": "Malware payload", "value": "e9f9fd621b1a47388bdcdcdb9c8cd871", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650649465, "uuid": "0764b33d-adf8-4ecf-a8af-2f9e1c84c543", "comment": "Malware payload", "value": "0d3fd7d89624e0c5f453c2f1e61f11b5e437af5938252a3912e9f16925308071", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650649465, "uuid": "e41dde16-e860-42b8-8a9d-9fe3a4f74abd", "comment": "Malware payload", "value": "c43331133465f6eb8d4bb6e7bbb1cd4efc154221", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650649465, "uuid": "e4ea5dc6-bd01-417f-878e-f19fbe66457e", "comment": "Malware payload", "value": "0a633b6a48c0f5198d92a6eb8d5275708727d4e7ebc91ba603842e6587f1b18faf65564123ab6482301b5e89a06dd52f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650649465, "uuid": "730d8597-fb13-4436-a657-4f5f75979e0d", "value": "T156D49D11F6AC80B5E07BD13DC9A3875AE6713C9847B943C79255EB2A2E736E05D3E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650649465, "uuid": "c622286f-3922-414c-8e72-3fda0056e051", "value": "6ba79cbed2acbe9b8ecc8e14a572f100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650649465, "uuid": "41271baa-5245-40de-b2e3-00b325a6cb9b", "value": "12288:C1FIcocJwMTHzXO7N2EBHiyzskF1CubVnmn:tco9MTHzXO7N5/115mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650649465, "uuid": "ffbbcd51-6f3c-4fbc-bd57-6b268a0ecd62", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650649465, "uuid": "ea9ba1cd-54ec-4c18-9289-47739b7c3ee0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650649465, "uuid": "75951d10-85be-41d9-902c-ac4488d1b046", "value": "e9f9fd621b1a47388bdcdcdb9c8cd871", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14186a95-c24d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650639684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650639684, "uuid": "79d8ecb1-b1c1-4de4-acfa-e01a984ee93a", "comment": "Malware payload (Mirai)", "value": "500ac8e1ab1c76b1d3815f670fcf430f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650639684, "uuid": "1ab8d81c-d310-42c7-b7ed-bab110c013e1", "comment": "Malware payload (Mirai)", "value": "0d9643027a17b54fca46ecddb5e06155e525ca93b2ae57826a7f5e5f379a9b7a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650639684, "uuid": "eada3c4b-d6c2-4771-8706-b8888e08bbbd", "comment": "Malware payload (Mirai)", "value": "4eaa1d8a12cb20d22e62cd46e36eb6236d796b96", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650639684, "uuid": "f233e36d-c111-4669-9e64-48389b443a34", "comment": "Malware payload (Mirai)", "value": "5a38c59e38b36163fe5ed511a6a927194610083218f22189814bb308b093d73bd3ffc0ec5c888e9e6df01e3c61105c1f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650639684, "uuid": "13476c00-0c8b-4daf-93cf-be78362856d9", "value": "T14A03E191E051C3D5D60B507798997E8D0821AB6DD0A510A6FEFE21B3B462FFC3A78217", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650639684, "uuid": "e7772c0e-535d-4bec-a000-0d4859b59ebf", "value": "768:evg4b2Hdt2MZ24Qzx0lSenguOrjjPAVLbQfsjTviMfNRSQUPH1nbcuyD7U0yqk:eo4cSuDZO/DAVHQfsfLNz01nouy8Pqk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650639684, "uuid": "df415a68-985c-4221-b05d-7826d97e1571", "value": 38684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650639684, "uuid": "ef113063-bd16-4f05-9d45-6b57ff8dd092", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650639684, "uuid": "46c7aa20-b9f8-400a-9145-548d09bd9828", "value": "i686-20220422-1501", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de1c6f61-c214-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1650615542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650615542, "uuid": "556dc611-ad74-46e2-a86b-8810610a7fc8", "comment": "Malware payload (SnakeKeylogger)", "value": "6c601ae53d41d311aa487754e909d2c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650615542, "uuid": "771590af-a3ca-406e-846f-9df2e6c8dac1", "comment": "Malware payload (SnakeKeylogger)", "value": "0e53b22264de00b429a207ae12e8a495970011076ace05303f13043e407680d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650615542, "uuid": "da297e0f-49bf-48ed-9649-193980202493", "comment": "Malware payload (SnakeKeylogger)", "value": "d1732476063e725ff74a5c9de9bd0f2f7474581d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650615542, "uuid": "cfd44ecc-8a1c-4a89-b3db-7facd803e33f", "comment": "Malware payload (SnakeKeylogger)", "value": "70ed372c69ab6110084a9ef19530d531bdcca3d15ebf0914cb49d65ae5983b67aa149abc54e3db55ce65901d22f7931a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650615542, "uuid": "18926a32-97f4-42f3-b5d3-35aa6b1bc458", "value": "T19EA45C98755071CFC497C971CAD5DCB0BAA0B4AA470FF38BB4934BA86E8C596CE006F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650615542, "uuid": "662e199e-b5dc-4e3a-a4f5-94f29399d676", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650615542, "uuid": "5ca0497d-7a60-4769-9ff2-5929ba204016", "value": "12288:naz/8XD6khusV9R6jdd+jHsIC13X9pnjTIp98Yl1oJrx:mcPDL8b+jHsT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650615542, "uuid": "32ab25e1-51eb-4ab0-bf8a-dfc3bfdbaee3", "value": 456704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650615542, "uuid": "9e712855-2a28-4c53-99bd-1982bd560fa6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650615542, "uuid": "dbf3c7fa-aa9e-48a3-9ba3-3cbd8f137226", "value": "New contract BL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c8b7dde-c269-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650651832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650651832, "uuid": "8dcfd6a6-71a2-47e4-8402-fdd39d716194", "comment": "Malware payload", "value": "630bd23149b135ec864d5cbce65420cf", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650651832, "uuid": "a55ed336-af2f-46f3-a8b7-6db60795e60e", "comment": "Malware payload", "value": "0ed01bbdd71cbcdcef8e01da6f1b6b4eee8466c5f5501bf37b248d795cc289e4", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650651832, "uuid": "0d7ce9a6-8fd2-4e07-a3b0-fd1e539c5206", "comment": "Malware payload", "value": "b3b45c2062590135a9f1055598a9ba5b49fca26e", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650651832, "uuid": "ac421d4f-7a99-4d18-9b5c-b1661a2c91b9", "comment": "Malware payload", "value": "dcb43e4915961ba3c8b2f408ca70a0327c92322d9e7776786a025b481e6ed92c6d3fbe939f218c8eadfc05c9fa09090b", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650651832, "uuid": "194be87f-ac6c-46ee-9195-5892dd71c4bd", "value": "T18B447D8EA7BC40B4E17BD1B6C6439B4BE6B13C458A75974F83B08B670B237B1652E311", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650651832, "uuid": "245bea38-3e78-46b7-8e92-0c4422fe2f7d", "value": "6144:aIH6bLB7+x29hs+qTQOZnkBLKhgvmgJ7IpNjNN17M:aIabL1+x29hs+bDBLKhKmCKzM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650651832, "uuid": "d5b2eba6-c0f2-4289-b2dd-583382611669", "value": 262112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650651832, "uuid": "832cec5a-c012-4236-897f-0f213a781e7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650651832, "uuid": "94582360-0f45-4425-84bf-bd0346bbabda", "value": "emotet_exe_e5_0ed01bbdd71cbcdcef8e01da6f1b6b4eee8466c5f5501bf37b248d795cc289e4_2022-04-22__182344.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ca0adf1-c24f-11ec-8e58-42010a9c0032", "comment": "Malware payload (GuLoader)", "timestamp": 1650640611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640611, "uuid": "a3601196-209f-471a-ac03-5d617687ec15", "comment": "Malware payload (GuLoader)", "value": "4e14c8b4fbeda50c2175d49930dfa42f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640611, "uuid": "3933240a-4fb5-4f83-baaa-6a37f8a1d339", "comment": "Malware payload (GuLoader)", "value": "0f65e4a9a6e0df896557ec1e72b9e378ce3fa150c4f8d1582e2fb49f3f9e49fc", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640611, "uuid": "091fd5d3-e576-485c-8cdd-a116acb6a1bb", "comment": "Malware payload (GuLoader)", "value": "9bda226e76999775b5aba10b08e2fabffc1d1bf0", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640611, "uuid": "38ff0344-58bd-4d9e-856d-ad09b6c44e3f", "comment": "Malware payload (GuLoader)", "value": "2b105065c51a4243be8c7154008235e65be6c5aaba9a68fbd9167c8263a52f6ead64d4334962c78fc9fff5c0dd0e22c5", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650640611, "uuid": "59639830-87e3-4431-b9f6-ded300404440", "value": "T1B624D8B4684F0872C309DC1E25A8B645AE79FEE374C1557223AFE434CF9AAF29EC4541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650640611, "uuid": "eec75e6b-ba2a-4e54-a038-cccc9a1c90be", "value": "1536:ia/bdh9fYPNnlr/giUrEJIb9oeDYUSN3dzFz76mAg5eeVhMDw5wfLU:ixPorJ6hdzFtr5RDAw5wfQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650640611, "uuid": "fb653585-d243-4724-ae4b-494bedf82d8b", "value": 223034, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650640611, "uuid": "9309ed20-be2a-4e98-8f65-c922618f6976", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650640611, "uuid": "c9189c1c-2dbb-4b76-8e2d-de4693f0e901", "value": "Payment Notification.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbb9ccc5-c23b-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1650632235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650632235, "uuid": "f37b4d65-d99b-420a-81f0-828f3cc4e2d6", "comment": "Malware payload (SilentBuilder)", "value": "042cb6af26fc965ffaf00d2733f03a01", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650632235, "uuid": "49520d7e-f7c4-48c9-b61a-224cec55153f", "comment": "Malware payload (SilentBuilder)", "value": "0f8330ea26ee3bcab4c05ebb384da5a60f9b10b421fbaa7660050fcc26fb9658", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650632235, "uuid": "e5d600d8-f72d-4d90-a4e5-b4175f5a6077", "comment": "Malware payload (SilentBuilder)", "value": "380786ef1c41b71df9b16d2d7e782b4846edc6a6", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650632235, "uuid": "a683040c-a214-420b-86b6-f3535d7ce2de", "comment": "Malware payload (SilentBuilder)", "value": "b648a0f5a56d54b0f4f80c227f7052fe7a77542205ee54da3029f28be81d32e6c4ad97e1955055dd131970fb2c65a70b", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650632235, "uuid": "49ab9b1e-0e49-4f80-84d4-832ad377067a", "value": "T18923B646BA5D9859E9258B7548E743E9B333FC201F6B0B833616B3257FF49E05A03207", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650632235, "uuid": "8f4ee58a-af47-4415-8d30-50759e8a594e", "value": "768:4DM52tfQXi8vgLZkTOHkQT51Vp6AwPdM8gQ6JT5X6DGwUdh+pqjeSLjcvLtzrxFG:462tfQXi8vgLZkTOHkQT51Vp6AwPe8gT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650632235, "uuid": "852bf00c-076a-4861-8919-46e85d06adab", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650632235, "uuid": "8de01b52-81ef-4423-929c-a56c990ee225", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650632235, "uuid": "971e9d17-4ad9-4b15-8615-3c31c7379291", "value": "Rechnung 2022.22.04_1346.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed8fe4e9-c23c-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1650632748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650632748, "uuid": "75c999f3-b852-48f0-b82c-6e87914231ba", "comment": "Malware payload (AgentTesla)", "value": "b54269e3e658a518369f2c6a23557181", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650632748, "uuid": "66f11ff9-09a0-4bf3-9fb0-1602dd7dc80e", "comment": "Malware payload (AgentTesla)", "value": "0fa663f444557deb62d634fb15b669c4aaaf7344eaa4428d9a5596b24c190148", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650632748, "uuid": "dddeb16f-a2b1-4a43-b5b6-0501f11597a3", "comment": "Malware payload (AgentTesla)", "value": "e432c5b60eb5c4de2bd99173d880c92fc04976a6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650632748, "uuid": "d5ca5ded-479d-4d80-92d8-db34b0d8d2ac", "comment": "Malware payload (AgentTesla)", "value": "eea35ac4833752b359cc6e351c15860b1c26e7d4689b141f74a6a8805f655718f86439bb1e555adc15e3898575d4177b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650632748, "uuid": "30685873-9a7f-446f-b13c-76a6a87ceb49", "value": "T1B3C47F6C3E454BAAFC1EC1749901CA08BB670F132A44E99277FB16CB879F1661D35CB8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650632748, "uuid": "988f200f-9dc7-4268-8832-c3d8af51d9f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650632748, "uuid": "3e96d4c0-6840-40c4-8fa1-d8d2c3c254a8", "value": "12288:JlKkfUe5kH1+ojeVRcXOlpg4RVnujtF8JgRaES++huTljdAjZYUID7b/0oVxWTnp:gOO+FkzBeAw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650632748, "uuid": "891c604a-ea62-41e9-80c8-8794ab4cb0d0", "value": 567296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650632748, "uuid": "9d7d315b-6c4c-430b-8015-b4f91935e903", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650632748, "uuid": "85683f3e-0108-4c45-83e3-ef066a465410", "value": "MV Queen V5 Ship Particulars.docx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b50c6112-c23a-11ec-8e58-42010a9c0032", "comment": "Malware payload (GuLoader)", "timestamp": 1650631794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631794, "uuid": "603816f1-b32b-4143-a6f7-09bc405fbfe2", "comment": "Malware payload (GuLoader)", "value": "fbb4da03391fe983873ac32519903d6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631794, "uuid": "bc83002e-6472-4092-b95a-42f2dc885c08", "comment": "Malware payload (GuLoader)", "value": "110f9f6e8ebd8769dac9f63661fa1ffd9b9471f43776ef3237aa5c0453c227cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631794, "uuid": "7d0db0d1-86ca-480b-b608-28109e902fe4", "comment": "Malware payload (GuLoader)", "value": "9b256da197bcbe8bcb1e691442af799274258c1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631794, "uuid": "5bed8370-535c-4613-bb5d-a6820dfcf332", "comment": "Malware payload (GuLoader)", "value": "6d620153ec715c2975e2141b18a36df56e38097d713eb41f16fbd99d6e0bb9a439a60950f98548aa82ee89ed78362283", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650631794, "uuid": "3fdc8e68-4670-4ce3-a896-7b573752f55d", "value": "T1DCB4C46E736096B8F45889B44937DC604A676C084B95C7DBB39CF32F147B9C9C20E8E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650631794, "uuid": "99bee50c-a701-404e-875d-5f1ef715e165", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650631794, "uuid": "d5c1191f-8466-454f-b0aa-1f4ffa268307", "value": "6144:XYa6OpR9xyBMc+6/FSU78YxjuEcspGz7pSQYq1ydAa:XYk/9xyBMX6/FSU78YxjuX1zQQYqWH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650631794, "uuid": "95e5a0dd-8303-4ffc-a794-9b81ce1049c2", "value": 536392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650631794, "uuid": "94b7815b-2a17-4e77-bec6-31ab5a849efc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650631794, "uuid": "63d53d92-61c8-4358-b4a1-0fd4c5b0ac83", "value": "FRACCIONAMIENTO 1722403906461L.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38b63e58-c239-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650631156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631156, "uuid": "975a9587-e503-4f83-88e2-aeb1a6b9e96c", "comment": "Malware payload", "value": "3118a6a63bf7d36b0f5ce439e6090bb5", "object_relation": "md5", "Tag": [ { "name": "83-41-130-122", "colour": "#41A215", "exportable": true, "hide_tag": false }, { "name": "83.41.130.122", "colour": "#E273AD", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631156, "uuid": "c953fc7b-8bf2-44ec-9013-9a64b547c182", "comment": "Malware payload", "value": "11ee64adb9d89b5edc898664c719486d0e7382ea9ac46f0c5213b5cd892161fa", "object_relation": "sha256", "Tag": [ { "name": "83-41-130-122", "colour": "#41A215", "exportable": true, "hide_tag": false }, { "name": "83.41.130.122", "colour": "#E273AD", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631156, "uuid": "41529927-7223-4de9-9809-a83dad164441", "comment": "Malware payload", "value": "b374198b11fa12ec6378f51658c7b1ad7fb81530", "object_relation": "sha1", "Tag": [ { "name": "83-41-130-122", "colour": "#41A215", "exportable": true, "hide_tag": false }, { "name": "83.41.130.122", "colour": "#E273AD", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631156, "uuid": "e4edb9ee-3e89-4744-9f61-1fc0f7fa1e11", "comment": "Malware payload", "value": "5431e123c45db33ce28cd60b4db4283a47c9c28dbc4b37d46720c9e92c77aeb2f3145de7142aaab92a2395aeaf7ce853", "object_relation": "sha3-384", "Tag": [ { "name": "83-41-130-122", "colour": "#41A215", "exportable": true, "hide_tag": false }, { "name": "83.41.130.122", "colour": "#E273AD", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650631156, "uuid": "3b47ffb5-6780-4ea0-adf6-9333cf8a8601", "value": "T11CD3D6459B2A6CA3CB07953EE593D483AB6B2C5316184179FEFC6610BF5A138C1F0DAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650631156, "uuid": "1827921e-06e0-4ff8-a475-bf142948349e", "value": "3072:a6HBs7cZE24/gzgXZZKvyPuI8+2JYd/Q2QCnYLG9wuYkkM69gWpjo:6SzgXZZKvyPu55CW2QDUwuYkkM69gWpk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650631156, "uuid": "6987563f-2635-46da-97f6-a9f422eeb93a", "value": 135940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650631156, "uuid": "855dda46-d12f-46ec-9fc3-a5d56b4de48e", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650631156, "uuid": "f98e5e01-37ea-476d-8fa5-bdca29e746c5", "value": "sQs.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c43c03f2-c23d-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1650633108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650633108, "uuid": "fb91c16d-8260-4d6d-99f3-8c0a93a2432f", "comment": "Malware payload (AgentTesla)", "value": "5a51b0129dc6aecff94997874b4f4ac9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650633108, "uuid": "f4d2262c-c9d7-4efa-9bcb-a382d217e09b", "comment": "Malware payload (AgentTesla)", "value": "124fdcda9e93230e3d8098baf4e575f9b820a51d12ad73644b729af165e259a5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650633108, "uuid": "7348850c-d1a5-4732-b8f3-bcedf0229f1e", "comment": "Malware payload (AgentTesla)", "value": "99baeae42169618ae71b41c0242254a4571aaf35", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650633108, "uuid": "500da414-f416-45b7-9662-a9671dc11126", "comment": "Malware payload (AgentTesla)", "value": "bfa6f95fa5778ef1d2ae4b446b89ccedee8fff3f36ab73f3d148ef4010abb544bc3630f169c3a4f7f187ab329852a558", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650633108, "uuid": "26ce5be5-b92a-4b6a-b965-b8750059d45e", "value": "T1F1D4121516A80291C8BFD7FDA8A3701197FDE81A3E13FB455E8968D7BD3B350C20662B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650633108, "uuid": "2571fc7e-1419-439a-9221-5c84b48970f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650633108, "uuid": "0ca65f33-a269-492d-a196-0b1b1f404d0e", "value": "12288:IaSpp/NmrNm2PXByumxcGLeA6pVxvJ5hBgOcpodZGHtwvNm:4wkccJcgeLVdgOcpYO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650633108, "uuid": "b5589287-9468-4c8d-a171-989555d62cc1", "value": 601088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650633108, "uuid": "60979320-927f-4b85-b620-ffd5676a91ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650633108, "uuid": "f42334ec-8aff-45cd-99f9-45d88c6a4616", "value": "mv TBN Inquiry pda Due to DischrgnPort Call_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cb041df-c21b-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650618251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650618251, "uuid": "b03fc8c8-105e-4af3-b839-ad12c76c07a7", "comment": "Malware payload", "value": "5917665657986fc2d52ec25e2b05663c", "object_relation": "md5", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650618251, "uuid": "3c548be7-e08b-4fa6-93ad-d7531f728421", "comment": "Malware payload", "value": "129851c7949aa484f9a78ed72d830e2782336583471f9bc027ea597c3522fda4", "object_relation": "sha256", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650618251, "uuid": "2e558beb-e368-499c-a989-573a02827b67", "comment": "Malware payload", "value": "3aabd9f7d634e0d20fafbab0eae3a2ef8819dd12", "object_relation": "sha1", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650618251, "uuid": "73450c71-9306-40e5-88e7-e20f038d2e4f", "comment": "Malware payload", "value": "908c29ece1589f9e9a2ff0e6536bdbf3e0b7fd02072e88ea5a59c1a384693b1c283a5b0063432cd0e471cea9c7fe17ad", "object_relation": "sha3-384", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650618251, "uuid": "a16133fe-0776-4bfd-a0fe-a58f0e805b03", "value": "T1B5D46C55BECA6EA1EFBF47BB8361D62D0226735D03A1A6CF360305993951FC2453EA03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650618251, "uuid": "2ae9d8ec-eedb-497d-9f09-4ccff13ba558", "value": "be710ba34b048ab0098050ccf62e369c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650618251, "uuid": "c5abea9e-5c33-4c7c-b3ed-597eff6bf573", "value": "12288:D0Ws7IMtR4yVld8bzbBSreShgFK/UqWZ:D0bdkX1qcL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650618251, "uuid": "70115234-f574-49d5-b8ff-d4f495bf0fe8", "value": 652288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650618251, "uuid": "0a1c89dc-daf1-48df-8474-d16afdd6f061", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650618251, "uuid": "c0110370-ddcc-40c1-851b-caabc7d43237", "value": "PO1.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d53f3c7-c20a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650611031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650611031, "uuid": "7d3660e7-b82a-4550-b5b3-1fda22874d01", "comment": "Malware payload (Mirai)", "value": "9cf37a915c08bffc68214350ff7f6f0b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650611031, "uuid": "8ff393d4-7c7f-4dd0-9413-add40bb6bfae", "comment": "Malware payload (Mirai)", "value": "12a82af4ac63689f8a9e5066661c287d992559d32ad64b31875b40bbb59c7715", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650611031, "uuid": "038021d5-8338-46e2-a794-99864d4d0705", "comment": "Malware payload (Mirai)", "value": "76ff8239d9cf1f7c69a0bc8af05a6c73f3c39434", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650611031, "uuid": "0fcc9838-3582-4e43-bfad-19398e329fef", "comment": "Malware payload (Mirai)", "value": "cc8b5750a3549c9becaa7135561fe3e50dbfb218be88de702b8e09491c8fa6a70877838032ba192efe8ef8d234c50788", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650611031, "uuid": "54eeb965-2565-4ee6-bac5-53db2bab6877", "value": "T106538D26D8799D64C04546B4A0BC8A302B33F408A6477FF59D578236A447EACB76C3FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650611031, "uuid": "85518f92-58c4-4c5d-9a55-512a4ce1b90d", "value": "768:CaGTAAeAqXeXe4eoe2fP2qhHVflmotQYsJzCHCRQHoKSj1P3CrcXiiW1:CaGEAJG6B5l+q13mTPgHrIKQP3CrcXi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650611031, "uuid": "4baaa8fc-96f7-4153-962c-45f415cf4955", "value": 62928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650611031, "uuid": "7c02db8a-0d60-4c62-b3ba-f9282513c23a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650611031, "uuid": "4c4fdc6e-b728-47a0-b6f0-a128c23c23de", "value": "9cf37a915c08bffc68214350ff7f6f0b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b176449b-c24f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1650640807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640807, "uuid": "9463979a-4ae8-4b1b-a40f-e83c976f08b6", "comment": "Malware payload (Formbook)", "value": "5e4be81a1175933f3c25b5e1f869c14f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640807, "uuid": "f41726ce-3dd1-4d65-a68a-b617ebefe07e", "comment": "Malware payload (Formbook)", "value": "13a6eed979dac3ff5533fad86535609bfbae22e56ab0440913b7f4ea2cbd067e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640807, "uuid": "2c3f6c28-5009-473a-a821-d964855b72d4", "comment": "Malware payload (Formbook)", "value": "62483d14c297f58200a7a8d412ecf17ca05b7a5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640807, "uuid": "5e3c681d-6424-45d0-9f8f-44b5264e03b7", "comment": "Malware payload (Formbook)", "value": "39e270057703f4fc9a6b2a7cb5dc6ee311d9d96abc7fb2c67deef0d7e8b25a93ae0e8f824f900a2fdffb74f8c0dcfbb0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650640807, "uuid": "7832fe91-a86a-4e1a-b6e2-d88b915bff35", "value": "T1FCB4124133A88F02DABC8BF98951180997F5B9AB3515F72C1CEBE0FB15327806785DA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650640807, "uuid": "357f1b2a-1db1-404a-b79f-4d0c5619cb09", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650640807, "uuid": "0402b51f-ee9e-4d40-95ec-af311d798a31", "value": "12288:QIAYtv/h/Drm/tmBgLjzWwrM3xgP88GkB+KROfOnU7HWzJoS82LO:dBdh7C/cezWww3OE87B+KRlU7H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650640807, "uuid": "797c9a20-3dd5-4383-8916-0bf303820b13", "value": 537088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650640807, "uuid": "77040a4a-2c28-4399-938f-09bd8d9e62d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650640807, "uuid": "e4e2173a-0cb3-45a5-b37b-745955db3209", "value": "Ziraat Bankasi Swift Mesaji.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eac851a-c23b-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1650631971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631971, "uuid": "46f5f035-f7a5-402b-805a-7f64ce69f060", "comment": "Malware payload (RedLineStealer)", "value": "bd52e4b3651f113562221ab6e8f907cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631971, "uuid": "c22adf7d-849d-452f-89cc-651b56bae0a2", "comment": "Malware payload (RedLineStealer)", "value": "167cda59342637acaca3c8762a29af09387f77242805c5ebb0dd92af81f684aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631971, "uuid": "8bb25deb-a5f4-4e52-a054-9fa9e2e4413a", "comment": "Malware payload (RedLineStealer)", "value": "d30e884fbea931147cc1371a5ee32af62d18b523", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631971, "uuid": "ad7570f1-8ec8-415a-8be1-7477a88799a1", "comment": "Malware payload (RedLineStealer)", "value": "792bef4751dabca17c6e3f17e9d74516592f57ead442a307a861a9afc6635adf4997985ade7a7b8b8cbd747661038515", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650631971, "uuid": "92f53a53-9055-4af8-a7a5-07dc81dadd6f", "value": "T1B094CF50BBA0D03DE1B722F47979D3A9642E7DA16B2451CB32C62BDE56342E0ECB4317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650631971, "uuid": "af85abd7-0e3a-4165-8ce2-579199daa4c2", "value": "a29e7e5480ce5490a8d3d2ff9482330e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650631971, "uuid": "cc6b4fc9-700a-4638-8a74-edb1cc4438c2", "value": "12288:IGHgyVtkq7bkOEYE2WAYKpvcPXjFrru7:b3tklQE2WHuU/5r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650631971, "uuid": "c0729d22-0528-42bc-b004-0ed86c68ec86", "value": 413184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650631971, "uuid": "053bdc66-e5b0-4617-bd4d-c5dae9ff1c60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650631971, "uuid": "5457522f-8003-4901-b87b-b5b621928b06", "value": "native.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "919cc72e-c202-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1650607683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650607683, "uuid": "b34706a1-392f-430b-bd49-79ba8f72bc1d", "comment": "Malware payload (AgentTesla)", "value": "0fe8b7ede72442bec0692cf319b417f2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r13", "colour": "#F07CDF", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650607683, "uuid": "e5083b2f-b975-412a-9e24-55659ae80ccf", "comment": "Malware payload (AgentTesla)", "value": "170639a769c2a8f15f21c800bb987dc1e635ef3713cc5e0a7a7f81df5a8e71ec", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r13", "colour": "#F07CDF", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650607683, "uuid": "bf56dc1b-eb7d-4185-b927-60340db3a61c", "comment": "Malware payload (AgentTesla)", "value": "db863a117914ec9a54820b4cb22e95a7a02ce5a5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r13", "colour": "#F07CDF", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650607683, "uuid": "677aa939-ab54-46b9-a51e-b74e40c5cc24", "comment": "Malware payload (AgentTesla)", "value": "5a061ecf8700562acf521db822771332202fb077db51d1794a7ea726e67303a810d17a148cd03ccc99bb889f8b30aa78", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r13", "colour": "#F07CDF", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650607683, "uuid": "bc1d9b34-b59e-4fa7-84db-158286de00cb", "value": "T100C42377954D171D3F9C7180B95F808AC1F95B8ADA731B9182E9FC90F248627B12A8CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650607683, "uuid": "732303b8-6be0-4995-9d78-0d8518511462", "value": "12288:mI9hiuQ4S5oaXLCQlGCOecPztxZqD/pVA+5xgBR5K+Zt:FbfqoaXmU9cM//dxgdrZt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650607683, "uuid": "4b461638-b845-4e09-96e2-c80433c147a7", "value": 572990, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650607683, "uuid": "15fc9cd9-a557-44ad-a6e0-aaf4e55ea452", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650607683, "uuid": "9a32197f-49af-4adf-be13-773de2570c0c", "value": "PO and payment.r13", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b51cc37-c1fd-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650605337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650605337, "uuid": "2f70bc99-e4c7-489a-bda7-eec924173621", "comment": "Malware payload", "value": "415485bbad16a886944cc164c39ee1b8", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650605337, "uuid": "929aade0-e27b-485c-93f2-03ffd002e7aa", "comment": "Malware payload", "value": "1878d067011a763e3fdf15143b9c407dca327ee1592830f0fed9b1f8d24bd7f5", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650605337, "uuid": "21b3180b-06d5-4677-907a-fec578ef5e3c", "comment": "Malware payload", "value": "c5c295b841513dd477c097c7da22b377a4b4d29a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650605337, "uuid": "ca0761c2-72ac-462e-a3f4-c5e9e4a7a4c1", "comment": "Malware payload", "value": "1933ba7c7b964d8e67cb17f8fc17f48e4510c851387bd510dafd710d9d5c17fa54a2ecf9de957d47e76f0ae5d925fe6f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650605337, "uuid": "5d6bcdd9-4489-464c-b1b5-fd270ead2666", "value": "T10BA5AFB876047DE6266F576BDA96ACDC03B617638ACBA4CD806477C305A3376FE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650605337, "uuid": "286561ca-a71a-41be-9c3e-6ef616dbb8c0", "value": "24576:MLt+BxZc+7d//PVOtk5LHW2eYkMq9Y96K/YgsZBDPwfWuDBYWY9J4WZHHdcWyx3t:r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650605337, "uuid": "7c0b9001-8298-4c4f-b830-598b9663c540", "value": 2106319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650605337, "uuid": "a8ddf7db-5f07-43c6-bc00-ad512701648e", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650605337, "uuid": "4a7d6fbb-511b-41da-bf2d-fac9dd830a3d", "value": "Purchuse Order - 4495077.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a1a11f5-c289-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1650665545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650665545, "uuid": "fdce5d50-2a1c-496c-a60b-3894b8c1f08d", "comment": "Malware payload (Gafgyt)", "value": "118538f650889b76fdd981e40fb5c8ad", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650665545, "uuid": "fb3b8b41-1ee2-4b1d-a7d0-959d6dcaef07", "comment": "Malware payload (Gafgyt)", "value": "193ddccfdb4e1bade3366bbde69143af8bf85b8e943b85891de76e8a41767129", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650665545, "uuid": "3d54f0d4-2281-4c2b-aeca-5c0c8b07cdda", "comment": "Malware payload (Gafgyt)", "value": "2f95ffbafb3b3e1689412e4005a07b2e85f7298e", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650665545, "uuid": "02f9d4cf-3a46-4db7-85bf-6f6f2f6cc001", "comment": "Malware payload (Gafgyt)", "value": "d9035896fb23bc35737031672ac86196ddb2391ab37f08f78a18ab6286aa6e7eaecacc2f7621f2b144a04433c4e18e44", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650665545, "uuid": "c0635ea5-cc14-436a-ba51-0a96ddb7436f", "value": "T189934A17B653C6BAC0874BF41BDB9A314923B8BD0B227206B3D4BCE67F165A61D19F40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650665545, "uuid": "589d505f-311f-45e6-998b-3793b4ee3e34", "value": "1536:p7rHXokXsWFVSzkfLEkZAT5ipG5v3VphauH/vPNlDDUg6I9um2Xj5YZb0e:pcCPOkfQfNipGdVphaE/9Vog99um2XFY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650665545, "uuid": "ac2f3efc-693a-463a-bbd3-4e55577605db", "value": 94012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650665545, "uuid": "f60c31c8-e378-4231-aff3-43d52c3ae5dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650665545, "uuid": "52ce6cb1-062b-4b85-933f-381207645add", "value": "118538f650889b76fdd981e40fb5c8ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c7717f2-c221-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650620988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620988, "uuid": "b5c60e85-621f-42f4-87fb-24fd03f49a4b", "comment": "Malware payload", "value": "d04d990cfbb83ebd5de83867b2740048", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620988, "uuid": "7063522b-0da4-4586-a309-bd3a158dd52f", "comment": "Malware payload", "value": "196d8ca14c3e00630e71c64fec800aaf81f833f5b932e3294e1c3eb5d1b09f02", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620988, "uuid": "b032a505-073b-42dc-a509-065a93c2ba00", "comment": "Malware payload", "value": "0a639959d9e8142ce726660514b62d83860544e0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620988, "uuid": "b142b0a3-0da5-4f49-b84c-86f171cc0801", "comment": "Malware payload", "value": "5b4b97099df0ffe339d9a749fdfb76fa3956ba715ae561996f3e2a66bd6706974b8ccdda82a8313797d5416965b25652", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620988, "uuid": "758c0435-1962-425a-832c-4c26f54f5e3b", "value": "T1F8467D16B644943EC0271A39682B9678587FFB253A198D5F7FF00D8C4EB5A40BA3B347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620988, "uuid": "dc799073-bbee-4bb9-b861-da1f79194499", "value": "8c168447d0786a14100d566538b8c1ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620988, "uuid": "37987cea-8348-438e-964c-07a22dcf1f08", "value": "49152:yE9xfwArGTGSztVPHjOWXTbP60qWFYbHfQ9ZHomPDD4D5H+f7WTrvUOm/iRBxN4t:y3AWXTbPVJYrQ/PDD4D5HWj4r4t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650620988, "uuid": "82710c1f-46d2-4505-a3c7-ce7160e13270", "value": 5490176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650620988, "uuid": "28c7845c-2fd9-43eb-8358-dd4d9851c5b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620988, "uuid": "7d41ab25-93b7-4901-8b3a-76e76476a403", "value": "SecuriteInfo.com.Trojan.PWS.Spy.21535.14573.14549", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77a530eb-c221-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650620953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620953, "uuid": "20d219dd-d2de-4f95-b836-44a3bed3fe3b", "comment": "Malware payload", "value": "e71b198f99c04bd42569b5c25b37faf3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620953, "uuid": "a7669e9e-831a-43b2-bed8-2a5bd287ad49", "comment": "Malware payload", "value": "1a4088d3b34b80c10668f12ffaf6b09d31f292e4922b3622dd88bfffb7e6e850", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620953, "uuid": "0f685798-7a86-465e-a339-e89612559067", "comment": "Malware payload", "value": "49c572cb52842dc6cf4679ba2e7f7b6f23603e2c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620953, "uuid": "bde44ab0-ee0e-437e-8a5b-376173a24715", "comment": "Malware payload", "value": "65c03148834478d1c57ffd0501b2d0fe503084f362fb8319abb990c76cd105a36b2a657b85d116d575535b44c1443cd2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620953, "uuid": "a993dee1-ef9e-41fc-9712-6b4327a4ae50", "value": "T10A162A36B245663DC79E0A3A553FA6189ABB777229128C5747F4CC8C8E364802B3F5C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620953, "uuid": "4f34ee83-b15b-4645-bf2e-309392e6b53e", "value": "2fac9340ee687fef190ac72917fe27ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620953, "uuid": "880dc6c6-5f58-4cea-a886-5aa3a05c1a11", "value": "49152:hLnqP4FmKBiBISGALrzFA3DZrTPgKZTT/XKjoV3E9:hTRPyglrMKdXKkhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650620953, "uuid": "fe5ef6bc-fcaa-429a-8fbd-48ed8d41355d", "value": 4244992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650620953, "uuid": "519d31a6-e844-4fd7-bd8d-8b4852476c94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620953, "uuid": "49929ccd-421f-40d9-b82f-fe1a53640602", "value": "SecuriteInfo.com.Trojan.DownLoader44.46911.15223.4123", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bedbcc53-c204-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1650608617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650608617, "uuid": "86ebe8b6-644e-4652-b2c5-5040da636dc8", "comment": "Malware payload (SilentBuilder)", "value": "a80757b0dfbf98df4bf13d26b97ab0d4", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650608617, "uuid": "cfb799b4-9269-48cb-99f9-36bf3746bd5d", "comment": "Malware payload (SilentBuilder)", "value": "1a8ab522f1ed45fa306a1e4e77502c9daa5e2328ba3bbfac067434ede3828bc0", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650608617, "uuid": "df109635-a9e1-4f50-8d28-54ebac530391", "comment": "Malware payload (SilentBuilder)", "value": "42e7a62fc9dd0355d6749dbf44db4d805e7c29aa", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650608617, "uuid": "44eff27e-3091-4827-be9b-1162656f7082", "comment": "Malware payload (SilentBuilder)", "value": "a1254fafc9646bf4c9275e4d4e49d3f79781ea76834f9da827bc1532a350938b19ac3626fb930a627ee7b116d9c72a1b", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650608617, "uuid": "ab240732-8874-4ef9-b0a3-f9e09898020a", "value": "T1F423B646BA5D9859E9258B7548E743E9B333FC201F6B0B833616B3257FF49E05A03207", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650608617, "uuid": "27740613-2d38-473e-a64a-3bc6760b185e", "value": "768:4DM52tfQXi8vgLZkTOHkQT51Vp6AwPdM8gQ6JT5X6DGwUdh+pqjeSLjcvLtzrxFa:462tfQXi8vgLZkTOHkQT51Vp6AwPe8gf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650608617, "uuid": "d1a07058-bc52-42f3-bd52-e9d1cb59f73f", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650608617, "uuid": "120ad10f-8dd4-46a3-8988-65945a948f9f", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650608617, "uuid": "82171d3b-127f-473f-bed5-201a3e54cee2", "value": "2022-22-04_1128.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "957d7d3c-c221-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650621003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621003, "uuid": "e920b59e-d5bb-4d61-91ae-798c8f500041", "comment": "Malware payload", "value": "376773514dbe991fe071ee9a8830b7a1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621003, "uuid": "829650b9-ebb0-4a14-8578-23b7bac5181c", "comment": "Malware payload", "value": "1a8ac3c391de25910d6307238a39b7841dba638734b2e5909a4bf8609f3e8624", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621003, "uuid": "c68eb04f-2cae-4311-af8a-f0b5c0f0d259", "comment": "Malware payload", "value": "e07dda3930a089cefd14be4b0d6b430ff891e6fe", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621003, "uuid": "c75f8fad-3dca-42b1-9de9-a9ca1ba05973", "comment": "Malware payload", "value": "846ffe2ca96328cac0f942aceeada09343facf898d948e19522da8806d1a1b5d52d664c6cb7ccbefe6756fc6601e8819", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621003, "uuid": "0b7afaef-7606-49f4-85ae-c7f1132e5681", "value": "T13BD60162B284503FD0BB0A379837E650A83F77712A12CD1F6BE4895C8F356416E3A75B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621003, "uuid": "684f15bb-ce3b-41ab-b51a-677ed414834c", "value": "0ecec953eafd56fe81f95a57f3aaf9fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621003, "uuid": "2df1f162-a079-4f4c-a083-42bef6ee336f", "value": "196608:bQ8EPbOmGouCMWQRlWh7BvPp8mEdB1x3T336eu/8B9PEpilwnp7IoX:bQ88xGOMloh7BZ8mEtIf/khEpbnpko", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650621003, "uuid": "8cfe6218-2fed-48e7-96d0-6409ac0e39f4", "value": 13357568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650621003, "uuid": "227adf8e-c42d-4569-80d9-124bb9f4aa7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621003, "uuid": "a99bc371-e092-443a-b475-6924973ee938", "value": "SecuriteInfo.com.Heur.8281.23753", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "711bf6c4-c208-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650610205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650610205, "uuid": "b5342946-290b-455d-9b16-eabb3e3283c5", "comment": "Malware payload (Mirai)", "value": "304d92394aaebfbce4d787815b8826c2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650610205, "uuid": "b5c16b36-31f7-4dd3-85fd-d357b2e5f380", "comment": "Malware payload (Mirai)", "value": "1b5c4f84e28f5fdaa7e7969475ad82a48c44d9580af6b3bd177182c11e8cd88a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650610205, "uuid": "2c15ac6b-0dca-4dc8-958b-b3178237bedb", "comment": "Malware payload (Mirai)", "value": "3eb5a2fd27dd5cfec2e8d71dc070d9d9aae0caac", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650610205, "uuid": "f4f41a6a-cabb-494f-8d50-b464961055bb", "comment": "Malware payload (Mirai)", "value": "6d3d0e22a6540f583ef7d9b0415b5459807595455caa070faff641a07082992d0de26a03dc76e3940f952fa29adba782", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650610205, "uuid": "b160d808-ceeb-4113-bf3f-a89feb4e6538", "value": "T1F862D1D7E52320AAEFAD35B114A92FE0221C55BEC6EA13073D23458104E770E920FEDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650610205, "uuid": "64211652-3084-4bde-8221-6f9ac4e67a7e", "value": "384:PDa1W27hicU+sKfDQ2rajgN4NRUG+xSEjst:b+UgsKs22giRSHst", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650610205, "uuid": "5f5921a9-d476-41d3-be54-acdb71984316", "value": 15584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650610205, "uuid": "d9d480ad-3bed-4d22-a83f-180bbf400e28", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650610205, "uuid": "68c52fad-d12b-4f9b-a6ad-459cc31a212c", "value": "portlordarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "911ab4c7-c290-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650668670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650668670, "uuid": "c0c474b1-62a0-482b-804a-69741e708018", "comment": "Malware payload", "value": "d2caca33655478f0adf2d4150c549d1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650668670, "uuid": "2320bd0a-4274-407e-b152-051d05976457", "comment": "Malware payload", "value": "1bc85cc3d89ac4f04f858ab49c586f06f69767b2304cb9be9ecd2c6cac4a74fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650668670, "uuid": "8c3aab39-c9fc-4ef5-86d0-6ac00bd174cb", "comment": "Malware payload", "value": "7a53df8d377e29ea4e06b11dfd8b97b168a76790", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650668670, "uuid": "04a5cafd-3808-4667-b17f-3181bf516268", "comment": "Malware payload", "value": "47d547ec9028732020af48b4011856d799fb57dec8c33fd2962bae88bda917e0db1104b2b4ae81d756cf3de76eb6363d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650668670, "uuid": "3c2e6fd6-c850-4e09-8c98-d7e05dcf07bb", "value": "T1A6D49D11F6AC80B5E07BD13DC9A3875AE6713C9847B943C79255EB2A2E736E05D3E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650668670, "uuid": "9f047950-388c-44e8-b71d-b2a89da42f76", "value": "6ba79cbed2acbe9b8ecc8e14a572f100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650668670, "uuid": "e757a6b9-8ba3-4b96-92ca-b99e4d3faf3a", "value": "12288:C1FIcocJwMTHzXO7N23BHiyzskF1CubVnmn:tco9MTHzXO7NG/115mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650668670, "uuid": "f2a12c39-605a-4878-aa38-f4c8e935087d", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650668670, "uuid": "f4219c3b-ce8c-46a3-821b-43049353076b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650668670, "uuid": "58d92e30-4d7b-4703-935a-ac20fc266901", "value": "d2caca33655478f0adf2d4150c549d1b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a1f9d87-c23e-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650633359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650633359, "uuid": "c346a46e-8b5f-41c3-9c0b-fef8d3b2a0b8", "comment": "Malware payload", "value": "6f915d61b3de967bf1d14d733307b36e", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650633359, "uuid": "896a23c1-e463-468c-970c-08bde26d7967", "comment": "Malware payload", "value": "1c4e5a51d9446f3fefd6366a1d7a536c873c518e82db3291a17802609c340d21", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650633359, "uuid": "0e894213-6414-4f6a-85a3-85b8c4bd76e8", "comment": "Malware payload", "value": "5839ed9516f6d52df1dc1a15b44b393cf21e8b56", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650633359, "uuid": "203b4221-e746-46d6-b19e-5d2559a5b718", "comment": "Malware payload", "value": "be66524bacea147e37ab2691fd6e8189c6391c2b8236b8d0ca9edd915e5d041e9ba592e6ed48b3148fa7af4942cf2720", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650633359, "uuid": "59f48f39-8779-4d99-82ed-6f202e22e358", "value": "T1D4066BF69CC8A15BFC54ECFDF736C570009BAD09F9DF880789A4162B5884139E79E688", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650633359, "uuid": "84b8867f-f271-40ce-8d66-1824c1b7b21c", "value": "98304:hZo5q0spyUTJkqVnIY0z7ceiVNhPvpx3:hZwqlp51krrz4vp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650633359, "uuid": "b6989018-2e9c-451c-a482-9beaea3eae30", "value": 3901440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650633359, "uuid": "c7c1c0ca-ef51-4c3c-818e-6ff1348c818f", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650633359, "uuid": "23b9192d-762f-4e69-b974-e4ac7bab2a1b", "value": "documents042115.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f082b2ab-c207-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1650609989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650609989, "uuid": "02f54382-7334-4e20-b04d-d2b24df5ec52", "comment": "Malware payload (AgentTesla)", "value": "d069ef35da0ba0c21863fad4e722f3d2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650609989, "uuid": "5376b203-d184-4ff0-9d59-96429b23b268", "comment": "Malware payload (AgentTesla)", "value": "1d9c52f0726c9514e0051e033ec7259daa42d1876503aa79f6ec37c5de41f2be", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650609989, "uuid": "3cebf2fa-0041-4f17-92ed-0deead8cdb9f", "comment": "Malware payload (AgentTesla)", "value": "d251359d27b745c5a85bd2cf0903d93104fc7e51", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650609989, "uuid": "ead504a7-62fb-4de3-bcca-30d3ea3eb704", "comment": "Malware payload (AgentTesla)", "value": "0faf5d4d41ca1adf87bcb70e7a562643dd55c438caadcb3e798822958f6f03a28fd09808b9ba108c7adccf08eae9a739", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650609989, "uuid": "d60d2285-7213-4266-957f-942023831ce7", "value": "T1FDC4125E2BC41FB0C2BD57F9A6A012854BB0805AB966F14D9DD170CF2DB7B4C7810B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650609989, "uuid": "4e35ecb1-6ec5-4a44-8164-39fc867ac991", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650609989, "uuid": "470fb4f6-2e5e-404b-8116-b9e7eb3e8847", "value": "12288:FztW3cQeUAgLuNI/B4kDDNpoHKTuBEHzPCF4ReGTuUe/hSdqD6:FBWsh6A8/5WHK+ErFs/RZSd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650609989, "uuid": "485d2cd1-5250-4c70-8873-bf9208c7481f", "value": 589312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650609989, "uuid": "51a30959-779d-410c-aebf-994f4644649f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650609989, "uuid": "a0013f47-acad-4b1d-8f1e-64482b414076", "value": "APRIL NEW ORDER 2022.gz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5061d158-c20b-11ec-8e58-42010a9c0032", "comment": "Malware payload (NetWire)", "timestamp": 1650611439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650611439, "uuid": "61cfbd8b-9221-4ec3-a957-8b8e7b5df7c3", "comment": "Malware payload (NetWire)", "value": "24e2eabeea1477f9e565e30709d5bebd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650611439, "uuid": "0f258c62-cd97-4631-a8f9-78209a999b5d", "comment": "Malware payload (NetWire)", "value": "1e1598cc98aed52a46c1e28d2bf775232d01d6698eec3d3eadbc3a039167ed8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650611439, "uuid": "4d76487d-189a-44e6-8dd6-d7cc85271f72", "comment": "Malware payload (NetWire)", "value": "dc701de083f206107d9fb097a1ed25b726315e6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650611439, "uuid": "62d359a9-5005-41ea-b80f-3615b7475fc4", "comment": "Malware payload (NetWire)", "value": "1ad990a923ae9125568874bda3cfbddb0a236c349b3ea18c909e7a9085a3dffde5f2250ec8af324a9acb80a40cd2c84d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650611439, "uuid": "a39c9bc9-4545-4763-96d0-aec89ebd25f1", "value": "T12EE412927BD8C0A0D87EE37568D7044B53F4C647A30D671A488796B72BA03912B5BFCE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650611439, "uuid": "1c5b3eb9-5d0c-403d-a11b-f886ca72f7f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650611439, "uuid": "7f9ae612-9986-495b-b284-12be7fed53bc", "value": "12288:S+hUKgN3/IMiz9mRPq8pIa+jlYPQQN2v4lRGe5uPCamWwnhhAYtv/h9:sN3v3RPxpIzjeFN2v4Se5uaaehhBdh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650611439, "uuid": "2c2fea95-9cd6-4978-9a89-6bf6ed9e98c9", "value": 667648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650611439, "uuid": "c1335294-72d3-4cc9-8024-7c754118766b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650611439, "uuid": "6d5f0326-8669-453a-9fba-8178d392be67", "value": "PO-0867-XDS1047597-Order pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71341ada-c204-11ec-8e58-42010a9c0032", "comment": "Malware payload (GuLoader)", "timestamp": 1650608487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650608487, "uuid": "5ed92a76-ab9b-45e9-9644-e28f59d05611", "comment": "Malware payload (GuLoader)", "value": "416f6b8ae20ec94653ec23b926e7ac2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650608487, "uuid": "6f61a484-6c40-4cb4-9991-65f7ba5692fc", "comment": "Malware payload (GuLoader)", "value": "1f29f7f7b9b1f6969a3a33ab0b8c649a22f523d2da63bee39e5eb60cdcfc1ded", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650608487, "uuid": "df8303e6-b42c-4224-ac0d-e21fa3d0a3ab", "comment": "Malware payload (GuLoader)", "value": "4c592dab52ed07e44f394d2e00b4d07dfbf46d59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650608487, "uuid": "8eac8d7f-c507-4746-a81b-1943c4ad276e", "comment": "Malware payload (GuLoader)", "value": "5c60e18655df2d0321b48009bc2a256a6865f7401f66642879f07123ca720b9cbae6ccac315563ea1640f017acd1b8eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650608487, "uuid": "caa8ee93-965c-4c64-aefb-7de4b1abc02c", "value": "T13EF423443234F493DE471970ABB3CE2A7C70DE649ED1556FD7E07B8EB861390CA186A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650608487, "uuid": "773322aa-3e01-427b-8379-f7a164ec88b5", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650608487, "uuid": "c436d6ce-faf6-4739-b4fb-f94209b863eb", "value": "12288:iYWU1IORT/rbDkKTXBqhSvgTLOF7E15+nKnY+rKhrT9zopEh2PcZrm:iY1PjrbDDTx3YcE1QeINloOh2kZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650608487, "uuid": "c49e50a0-349c-4d03-a2ae-07d034095601", "value": 780664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650608487, "uuid": "d517be2e-b5a1-4ce4-8c7b-a1a7caea7414", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650608487, "uuid": "b3eafb11-fd92-4929-a6c9-db8823197e2b", "value": "ORDER INQUIRY_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b158fd73-c267-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650651115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650651115, "uuid": "9776af5b-fbc1-4161-a11c-751e2b13dd1a", "comment": "Malware payload", "value": "780190f24c3ec8795f9a29fe933ea268", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650651115, "uuid": "4cbbbf33-fad1-4356-9965-0c98587daffc", "comment": "Malware payload", "value": "1f871dd7afffac397882b6044e966aef944fdd2acd1b4a351f0ffe70bb236499", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650651115, "uuid": "247d51a9-a7bb-421e-988f-8d571968cb46", "comment": "Malware payload", "value": "9b07f6c9d0a342f4a1091b29dbc22055ad1b7d70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650651115, "uuid": "546ecaca-b976-4429-8299-0b58947b51fe", "comment": "Malware payload", "value": "2ffa89ad74c1bf0444127e1d811e583df167a21952b5cfb41f09869a7473b0872001ceb89e15b516e9bab64a3eaed011", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650651115, "uuid": "63985b21-9b9d-43bd-bc47-fe8433135984", "value": "T11D048ED076D85CD7EA449B7940D7A221333DBBE0D7538B13A65066320E13BD2AEC7B26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650651115, "uuid": "e4a532c5-a15a-412a-9cba-fa9246ef0a26", "value": "588ca9f8c5244db23a68165b188e927a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650651115, "uuid": "74379f1b-128b-4db7-a0b7-ecbd242c8afa", "value": "3072:py0Wai62pPHynsb5VmZHoGJskQCDGZ3E5x/KtNdwKA/nOea6xfwWBHUWq+9yN86v:Y0DgpPHVWoGCNotx/Kt3wKmOea6fBHUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650651115, "uuid": "db640275-2810-44d1-87f2-5b8640074141", "value": 186268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650651115, "uuid": "c2e179ba-d1f4-489c-9a62-44021f571757", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650651115, "uuid": "32be69b3-baf3-40eb-ba2f-7e5dba143690", "value": "780190f24c3ec8795f9a29fe933ea268", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbf7d159-c243-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650635698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650635698, "uuid": "e3594401-8631-403c-9c23-bf8b2e75263a", "comment": "Malware payload", "value": "af4cbe02279b19253b86486cfd649f29", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650635698, "uuid": "77010bbc-a2ce-4725-8498-74697c017d10", "comment": "Malware payload", "value": "1fcbc975d28b5d18c51cd18a63526ca1c9aa68859d84a13eaec382add75cd3db", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650635698, "uuid": "afe63066-694c-420b-9c4b-a6a1177a4b4f", "comment": "Malware payload", "value": "cd355f0ba157a298995aeee6bd2ece8efdb76f59", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650635698, "uuid": "359c43ec-7dcf-400d-b12f-96baf88cbf21", "comment": "Malware payload", "value": "ea833ea05b771e5006c41328293132da47327b8c0caba371da311fae1dc9812326c21490af5353127d127da1af7f2934", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650635698, "uuid": "e3997044-0b5e-4689-a313-8380295e1e8b", "value": "T148D49D11F6AC80B5E07BD13DC9A3875AE6713C9847B943C79255EB2A2E736E05D3E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650635698, "uuid": "40743060-f410-4e44-9595-15c808ad7f20", "value": "6ba79cbed2acbe9b8ecc8e14a572f100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650635698, "uuid": "b9e727fd-47b9-4a3c-ab91-1c4787cc730c", "value": "12288:C1FIcocJwMTHzXO7N2xBHiyzskF1CubVnmn:tco9MTHzXO7N8/115mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650635698, "uuid": "cc4316e1-810c-4deb-bfd2-beee43ab3e6c", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650635698, "uuid": "67b23fe2-2567-4358-89f6-03b70514dacb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650635698, "uuid": "118170a7-a5da-4a84-b55e-6238a8967d3a", "value": "7rq8RVycuKp2leRnmjlCUrFp6OvpysHrnFK.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36c01ff1-c213-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1650614832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650614832, "uuid": "3112db26-eb42-4509-9859-8a0aae570d6b", "comment": "Malware payload (RemcosRAT)", "value": "dfdbae39231a255063e4eacd5b6b5b2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650614832, "uuid": "fee3d50d-884e-413d-a50b-2faaad1fdabb", "comment": "Malware payload (RemcosRAT)", "value": "20e92104d49fd474c19bc82c30d999c13a3a036cbc852eb013e4512ba58d8696", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650614832, "uuid": "3f225c38-3bcb-4ada-a45d-e4502edd45c0", "comment": "Malware payload (RemcosRAT)", "value": "641c56485d1a108772d6a2f0281b3bcc6e12f60d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650614832, "uuid": "6878058e-5615-4407-9015-89e7fba1e1e1", "comment": "Malware payload (RemcosRAT)", "value": "1717aa438184329b51e7c0796e705f8ebd6fc75346d9e298f4d63a4176876350596a14b257de7c296bb7394d823826df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650614832, "uuid": "85998a40-2b7c-44ba-a034-cf49fac22fdf", "value": "T11F52E726BBACCA37D8750F77081212804632E706B832FF4E5896155E5EB2744CBE2B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650614832, "uuid": "7781d271-a023-4c11-9e36-f5cfdfdd7ec1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650614832, "uuid": "0f3049af-b7c4-440f-9831-01866381fa79", "value": "384:BePXamIaNFfffffyQOqBKHTidJuFQOoTi8:ByXJpcQOtFQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650614832, "uuid": "fdeb32aa-1854-4347-b946-d6cb3d563a04", "value": 13824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650614832, "uuid": "eec96d60-487a-4f5e-ba9c-e07f81f782cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650614832, "uuid": "0783e9dd-737a-40a9-99ae-22703d16dab2", "value": "New #PO4503980.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f219c49-c239-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650631247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631247, "uuid": "56c5596e-1a31-414c-bd99-3913cab2543d", "comment": "Malware payload (Mirai)", "value": "11f190e00dd4869d5e930dbfc0257c02", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631247, "uuid": "84280c1a-9b49-4c4c-b5cd-a4d47ffef341", "comment": "Malware payload (Mirai)", "value": "20fa296742a24c2bc8c1e2f83b63445fe2546f9c623b1bd9c2f6905af558b4d2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631247, "uuid": "453a3264-d86d-4a24-b9a3-d6926e247d99", "comment": "Malware payload (Mirai)", "value": "ce31291523f497df8ffbc8387705220f29d1eb95", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631247, "uuid": "3983f4a6-e7ea-4e7b-8140-ecd9cf32f1f3", "comment": "Malware payload (Mirai)", "value": "7d8bbf4029f52e46c66c82b140152d357860090cd9885946328408b8865ece1cdbf67e17483488bc33a278beca451054", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650631247, "uuid": "4fff2e09-a7da-4361-beba-8f112e77c602", "value": "T17ED3A62E7E12AFFEE668823107F75F70879521D637A1A381E26CD6181E7128D1C5FB90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650631247, "uuid": "f8df81cf-211e-4590-acb3-9d3f00b7e5fc", "value": "3072:VnTnObxp+wY0Obxp+wY/iAOKbv1z1ZOzwU3Z723aHaJ1X27lTT5hL5siuu/GrmWv:t+JUJP5hL75/GrmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650631247, "uuid": "17cefd3a-b5e2-46af-997a-e65caaccda0b", "value": 134327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650631247, "uuid": "58cbffc4-1d4d-48ee-84ea-3ac0826e5e0e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650631247, "uuid": "d757daf5-b4d1-4f0b-ac83-93e31e9c33b1", "value": "11f190e00dd4869d5e930dbfc0257c02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97c4353f-c233-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650628738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650628738, "uuid": "81ce6268-cd0e-4ed4-80c5-d94db3a2bf6d", "comment": "Malware payload", "value": "f288d69c9284bc2590bb8b9cb841ec3d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650628738, "uuid": "2e00f959-7a49-4960-abb8-04239af18250", "comment": "Malware payload", "value": "21e282f0541b15e409dd8f2cee7d1bc2844cc47115873d6cc074b5d0e4163bf6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650628738, "uuid": "f2d81e8a-51da-4ce2-8d40-d9003a09804e", "comment": "Malware payload", "value": "7a22abb42e06867e170a1ccaf7ab023634c05f3f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650628738, "uuid": "55932e60-ad79-4c44-b464-6f750f137054", "comment": "Malware payload", "value": "ad0c45bab3f8a2fba1b2e4faf8c368ce95afa7d8fd3a8f52173ed6cd63dd2801608fa2af558cb9971adabc288c9e3a63", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650628738, "uuid": "2a411752-c5cd-4444-963b-0661fd8b996f", "value": "T138C3505B6E609F19F658573009FBBC29835A13AB36E5EA4AD18FC2006E7131D5C0FAF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650628738, "uuid": "f8268c90-c603-45ca-8533-d4fb2396187b", "value": "3072:QISPhPh28cVCSIdCve0uPgrUiyeVKfj/GPIBWhFb1lqQl:QIyhPh28cVl4PgrUnas/GPIBWhFb1ltl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650628738, "uuid": "bdfa9589-20e9-4f6d-9d17-3a58af285580", "value": 127632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650628738, "uuid": "a06b10a4-07ba-4bad-ab3d-c6213a743599", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650628738, "uuid": "29c49e71-c8c0-44fe-b4af-7c10c72f6310", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96873d4f-c290-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650668679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650668679, "uuid": "afe912a1-948f-40a6-a43b-83ea4c1db496", "comment": "Malware payload", "value": "ba09b01d60609ba45066dca18ed0bada", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650668679, "uuid": "611190d8-f5a7-4ead-aebf-496cf34b6df9", "comment": "Malware payload", "value": "21fa60c2ffe39c39844b76b4a2ea35a7fc5fec600b93e405bca11013b0993108", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650668679, "uuid": "203b86ac-6c8d-4900-8bc5-9a297c1e3097", "comment": "Malware payload", "value": "9b6656cc3a8e25f3aa9894a5ab0c7faab9861354", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650668679, "uuid": "2cc17d74-115b-4d91-b3a9-36c450f5149f", "comment": "Malware payload", "value": "c9000531b07fbbc5d04788caf412810f03c1cfda0bbc30f7cc6fcdc84d44ce6c0f95143ef2b5bf4a15d963a082c15a01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650668679, "uuid": "a47b4d49-53d4-4574-9b32-29c6617a627d", "value": "T1A5D49D11F6AC80B5E07BD13DC9A3875AE6713C9847B943C79255EB2A2E736E05D3E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650668679, "uuid": "44d840dd-a2dd-42e5-ad03-7ebe0deb8a56", "value": "6ba79cbed2acbe9b8ecc8e14a572f100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650668679, "uuid": "4ce66635-0644-4bda-aed1-6df67ed2f41c", "value": "12288:C1FIcocJwMTHzXO7N2MBHiyzskF1CubVnmn:tco9MTHzXO7Nx/115mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650668679, "uuid": "8fa27803-895b-41a1-81a0-44566cd0eb14", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650668679, "uuid": "b1030c01-47d5-418e-9d7b-e20acbbe66e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650668679, "uuid": "b32f8a84-52e8-40ff-8cb1-305acb460205", "value": "ba09b01d60609ba45066dca18ed0bada", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f4c75b3-c221-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650620993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620993, "uuid": "481b9549-8eab-4bf8-ad10-f4b98e193998", "comment": "Malware payload", "value": "e8998e89dd38cec07ac7cc261b73d7c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620993, "uuid": "d00fa658-5309-4479-9473-f19e8750e94e", "comment": "Malware payload", "value": "2264e5ceb8921e27454e17524b09476bfa7a3bc0c41d64ab4e435e8e87755efc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620993, "uuid": "34b32c8c-dd91-45ca-853f-626ff2f41242", "comment": "Malware payload", "value": "fcc1c99a7e4ff02c337e8bee2ddc308c0a235d0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620993, "uuid": "87e1976c-1931-4504-a361-23f27db25d83", "comment": "Malware payload", "value": "fdace4e505496658f5c73f94caad5cdea7b37d7c3da19ea9562453ed2dde9f0c12e6bdd71bb77b486ab84a50b6632c98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620993, "uuid": "9e9639bc-cdb9-47d2-878f-d0f96451e22c", "value": "T12AC56B13B244A13EC06B0A3B593396589CBFB7626656AC175BFC098CDF351813F3A64B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620993, "uuid": "945a0c91-a37d-472e-b8ee-56426a431028", "value": "274b2dc147734c8a2ea7981185d2b932", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620993, "uuid": "8dc2fdb5-5f21-401f-b9aa-1a8c93021c64", "value": "49152:eamNPbqnBhV6S6WCLlhrFA6C+qTqhHN48:ea10nFAt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650620993, "uuid": "3a3a7ea9-da2a-4bf1-9da3-7d0fcb449137", "value": 2706944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650620993, "uuid": "25398ff9-a371-417d-837d-5802e7f85fd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620993, "uuid": "fb451d65-3bec-4fee-8a57-c06efd5de0ef", "value": "SecuriteInfo.com.Trojan.Siggen8.36802.7719.5712", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abc839dd-c236-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1650630060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630060, "uuid": "24c4c7a1-f715-4916-91de-14a7f414021b", "comment": "Malware payload (SilentBuilder)", "value": "98fc7240798fd27a98b2da12ddb69706", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630060, "uuid": "44c59f39-5ce5-445e-843c-29a5c3ab2c92", "comment": "Malware payload (SilentBuilder)", "value": "226d9af0e7a3bce674cf24f67942bcf41d418d843f531596ac28027dc0d0815b", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630060, "uuid": "c0c88fb0-3e7b-4cd9-a11c-67c79f0470ae", "comment": "Malware payload (SilentBuilder)", "value": "ad58482c18b17bc22089442bd4f7c48fa5d2000b", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630060, "uuid": "d0bf395b-0091-4302-ab0c-32921bdd926a", "comment": "Malware payload (SilentBuilder)", "value": "0420bd046ca945cfa5ce4cf16c5ab67dec53de5814b05766f773903ba27a2f9f2a97275056da2f6b0f5fe50c48794202", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630060, "uuid": "952e9ec2-c0cd-4fc8-9bec-f470847815f9", "value": "T10223B646BA5D9859E9258B7548E743E9B333FC201F6B0B833616B3257FF49E05A03207", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630060, "uuid": "c862cc51-c495-4fb6-a832-ef15597d82fb", "value": "768:4DM52tfQXi8vgLZkTOHkQT51Vp6AwPdM8gQ6JT5X6DGwUdh+pqjeSLjcvLtzrxFW:462tfQXi8vgLZkTOHkQT51Vp6AwPe8gD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650630060, "uuid": "f238c8c5-ce49-4646-90a0-08ae39da833c", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650630060, "uuid": "f8df07bf-4109-43bd-8ca0-5ce406ffcae7", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630060, "uuid": "2d9dc938-2f9f-4904-b45b-137222cc74f3", "value": "Insight Medical Publishing_2.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbc8ca21-c203-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650608210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650608210, "uuid": "3c6f7010-4f94-43a4-8baa-ca40e5e914b9", "comment": "Malware payload", "value": "a3998b70c94dc3da40917ca939e58ba4", "object_relation": "md5", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650608210, "uuid": "936d6ea5-1bd3-427a-a722-09584dbb1988", "comment": "Malware payload", "value": "22f9548cf783470175601b96c0d4dc374c0f7834a81430d01b9c5c4c65ccacc3", "object_relation": "sha256", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650608210, "uuid": "82c8cf1f-4b29-4d89-bb93-58204c52c882", "comment": "Malware payload", "value": "d015e1f2aa35689cb84173f37a9a0ed03ad7d1ea", "object_relation": "sha1", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650608210, "uuid": "156b1abd-79f5-443a-874f-46d9b7cfbac1", "comment": "Malware payload", "value": "b687844f97ea7aa847366d85ccb683ed4ea4fc80091fd3698b43ee9c2d88324462598f5b6eb8302817cfec044685aa4b", "object_relation": "sha3-384", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650608210, "uuid": "68050f36-f634-480c-8e07-4397d626f4ef", "value": "T13F62D06D017520D4C22C7D7E30AA1F1B56A3E2C6D1C18D846D8A744FCCE3DCAA5BB1AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650608210, "uuid": "80fc9e93-356b-42bf-b90b-1f714530f195", "value": "384:0M7uEFJxMmbzL5w+v/vmTgvLPwjys5eTs86/Uom:luiLL+6eToPW5eYVI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650608210, "uuid": "d8772845-42db-4c3a-9d05-05dcd252927a", "value": 15774, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650608210, "uuid": "24f59db9-2287-4007-b011-b0ab02edcf42", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650608210, "uuid": "e0540baf-27b8-4687-ba2e-b9f331dbc2cb", "value": "no. DGBM0052U12187DQNAWS220405859.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1e6ee5c-c1d1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650586665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650586665, "uuid": "835311c1-1934-4e15-a5f1-fbdabd0d8c66", "comment": "Malware payload (Mirai)", "value": "53a1b31433d7933a50f4d75d32306cb6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650586665, "uuid": "cd84e9f2-fc2c-4840-9ec5-25b02b3865c0", "comment": "Malware payload (Mirai)", "value": "23354c49f80f700bc33ec13bf5850fec544abc0770357d4bebad61c8a9e045f0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650586665, "uuid": "2893f73f-fc08-4aba-9f43-96013b04fdbc", "comment": "Malware payload (Mirai)", "value": "e9ffac9b56e9fb2f60bd2f31a9739addfe3742e0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650586665, "uuid": "2c36ca75-520d-439a-bd40-2ac97fb85f1b", "comment": "Malware payload (Mirai)", "value": "2567c7b40b3a88cbe2832fd73c423133265b71b76155ea04dffa33e144948b0b165b3e1f79aab7f827aa2a023e3f0115", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650586665, "uuid": "ed119431-664d-4123-aefa-c73797531d61", "value": "T1BE53C68B84B29FF7E608B0F0B4257974A719E000759F0D9AE86486D1758F9DFB18F2A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650586665, "uuid": "48c33611-7376-4221-b21a-89f988886f0d", "value": "768:JsKiWXSwhXoO97Pgvm6bJDVPpLT7Pi0pQpDKTChnBaKokmSmtQ4xVfvNGAgCi3mo:JEOXoTLpLT7PaKTChMtkit7NGTCi3mo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650586665, "uuid": "65e7544c-2006-4f9c-b94e-3258d8613c14", "value": 62440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650586665, "uuid": "52708c27-e3f2-4cb5-8fee-f0d34dd41a15", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650586665, "uuid": "553510c6-c1c0-4824-a850-77b61a1ca3f6", "value": "53a1b31433d7933a50f4d75d32306cb6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3c1cb59-c257-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650644247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650644247, "uuid": "fed9756c-57ab-488d-b561-9bca86315a66", "comment": "Malware payload (Mirai)", "value": "0e79bc1395166c9c4d11ee4d85d64a95", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650644247, "uuid": "74ef20e2-0364-4ec1-b458-33003786d4c6", "comment": "Malware payload (Mirai)", "value": "24d4b5733a914703ea32504b0bd286f8d153b727b5fb1f2fecf127dfa8d8a2fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650644247, "uuid": "781915fc-c5f1-40e7-95a5-e9ef0a450970", "comment": "Malware payload (Mirai)", "value": "21c9de0237c069d0c0ab8801ebde760800a07b50", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650644247, "uuid": "2ecfb9f2-3d98-44ad-9e36-cf6ae29d3609", "comment": "Malware payload (Mirai)", "value": "ce38148543a63a3094eda7358d6ba41a3d413eab82ec7c579a21f3139558ac4bb4dd619431f297ca158dc90d930ed1fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650644247, "uuid": "5abef9e9-94b6-47f6-a3a4-8d5c7a20118e", "value": "T13C64D08AEE00AF25E9C026BAFA5F034973774B6CE3DBB111E610D72936CA55B4F36045", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650644247, "uuid": "aafcbb0d-48af-4a9f-aa0a-61ad9a3467b5", "value": "6144:p3lOYoaja8xzx/0wsxzSi3SDP99zBa77oNsKqqfPqOJ:p1CG/jsxzX3SDP99zBa/HKqoPqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650644247, "uuid": "e8a11be8-af75-4446-b328-fddff84cde1b", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650644247, "uuid": "1166309c-86cb-4255-9028-d6f8a824b0f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650644247, "uuid": "a2dee89a-7638-47d1-ace5-fd7c6a607cab", "value": "MIPS-2.o", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f7ce389-c225-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650622685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650622685, "uuid": "0d52e319-5e60-46fc-a3cc-591f7c500584", "comment": "Malware payload (Mirai)", "value": "235a8ad43b68efd32b268f230bb514a7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650622685, "uuid": "17e906ce-f724-43f9-a552-7ffbc4777ef5", "comment": "Malware payload (Mirai)", "value": "2531c7e7808b3a362a2e8d19c40dd2313d1dc82195da501bb01cf5a60bca62c4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650622685, "uuid": "fd566861-4ced-4332-a885-273b61995587", "comment": "Malware payload (Mirai)", "value": "de3b16ae1ad89a880bc8af4a9876b06b2d03888b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650622685, "uuid": "b5f1a2d7-2356-461f-a53f-98ea4d29e8bc", "comment": "Malware payload (Mirai)", "value": "a3826834f60552a8c6b1a1134169f143c215fc31b802db4c48bf5c6ec5c8f8b1551b9ea3f1581a764d0e4d5405e59822", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650622685, "uuid": "2cbe2af4-f064-47a4-baa3-f66cab52ca0e", "value": "T1FDB2D1FC6F0004D5DAB9D17C0F760342FEE40B966443952624C5F8EBDE1A68634879BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650622685, "uuid": "94c7d158-3a85-4e3e-a21e-75f293e143b3", "value": "384:nzM1iCAndJJpsOh84qh6ILK3hgQjob8R/OJbfJgGlzDpH7uNj1Jha:zM1iCAkOh84EZLK3h1obe/OFJgGlzDpN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650622685, "uuid": "a1f80333-d433-4eed-9aa6-ca48c0121e82", "value": 24040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650622685, "uuid": "575609e0-8ee4-43e5-82d1-16ab07261d73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650622685, "uuid": "04471c66-9f08-4d09-b4a8-af798aefd07f", "value": "235a8ad43b68efd32b268f230bb514a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23a11cbd-c21a-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1650617806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650617806, "uuid": "5add4fd3-947a-4f1d-9f18-22b9a7ef835b", "comment": "Malware payload (SnakeKeylogger)", "value": "e1e75bf68ee5e06fa1fdc7d72ec07b56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650617806, "uuid": "526b529c-7149-4422-9820-b290b048d0cf", "comment": "Malware payload (SnakeKeylogger)", "value": "255cd6a9826c8923061e167ffd97cb4412c77dd454e80ff8c448f2818beb3cab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650617806, "uuid": "44621761-53b5-4c7f-b745-351f2eda81a0", "comment": "Malware payload (SnakeKeylogger)", "value": "41bf246ca53aac6015171a454c2bd6c73087828b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650617806, "uuid": "f120309b-3b5d-4915-a77d-7a8c0de96cb7", "comment": "Malware payload (SnakeKeylogger)", "value": "5a52414b6fbd871ff92ea93aedc239dc46b61a63a5c7c82b07b8fa2f6038929a68fc20e7cb754ab67533519e3146f1e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650617806, "uuid": "a9faae04-9afc-4b13-af90-bcf632e1c8be", "value": "T192D32451E6852232D507BE7563392B31C1724E8A7C6FF2493D44F92AEA73CE3A7D0606", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650617806, "uuid": "a295cdab-2fed-4976-8836-c07bf9f085bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650617806, "uuid": "0a7dc432-14a2-4046-9d12-5dadbbcc2ddf", "value": "768:hCOKEWFMiTxhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhQ:hC5EWFMvMx97FjAsOn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650617806, "uuid": "51d8424f-e39f-4725-86f3-452629252fe0", "value": 137216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650617806, "uuid": "e830aa1e-e7f4-4362-8054-e9a1dbdf3642", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650617806, "uuid": "e216b303-2759-456e-8bf1-1feb80196ce0", "value": "12240322409_20220422_05482267_HesapOzeti.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00eb01c4-c250-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1650640941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640941, "uuid": "06657c23-2189-436b-8579-c89666e7d421", "comment": "Malware payload (AgentTesla)", "value": "99bc406aa092898a86753ae31470fc03", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640941, "uuid": "ff639d2f-b550-4ebe-8eb0-45f7fb34e9b4", "comment": "Malware payload (AgentTesla)", "value": "258435af9b5281169b504c977c99f056047ad11a6473da4050e5ed96ac2fae96", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640941, "uuid": "9910c769-59d2-4e0b-97a5-ee869a45cd7d", "comment": "Malware payload (AgentTesla)", "value": "39129c8cd9902813269813bf5571bcacc14a047b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640941, "uuid": "e8b3e8d5-45ee-4191-bbee-d02021aa479b", "comment": "Malware payload (AgentTesla)", "value": "989a23f2a1ef6735e6524de79dc1eea0628e9e82b886abbb5a4dd1b834a4b0693336cc3cfbe957344785a5943c92834b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650640941, "uuid": "34c715ad-0c69-4b24-98e1-9157c52c22a4", "value": "T1F6C4134072A8AB52C27DCBFC4564290A57F4A1DE3A14F34C4CE6E5FB19123516B9CF8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650640941, "uuid": "8ae3c5d0-9d11-4c45-aeaa-8cedec165bf2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650640941, "uuid": "a2afdbac-cca6-40e0-81db-4d556fee6731", "value": "12288:BiAYtv/h/n93yqbWnMH6GoJQ9i3EOCy/qyaBGH+nOj+q5kGNpD1mVVIoX:EBdhtH6Gk0OCwEBGX+qZNpsVVv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650640941, "uuid": "87acc5ed-2e54-4890-b889-fca796ef098f", "value": 580096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650640941, "uuid": "9c24e829-2311-4324-8b90-4e072af0dd16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650640941, "uuid": "f46ce99a-f8d3-4989-af30-fb7c8d426301", "value": "Dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eb1603d-c25a-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650645447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650645447, "uuid": "f1681722-1f5f-4798-a24e-e94ecd2db9fc", "comment": "Malware payload", "value": "1c6970ff5c73c586182bb776bd568f93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650645447, "uuid": "6242584c-d786-4e73-ae13-8a736d6da762", "comment": "Malware payload", "value": "25f2a8a5f9bf8f3229e64eae7e95ffc36547a365a6f11117e1ca911e71c8f85e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650645447, "uuid": "c958654a-1253-46cd-bbd5-226a271b4774", "comment": "Malware payload", "value": "601f96708ce2826aecd8acffee0bf78d184a9bf9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650645447, "uuid": "007b623d-fc3d-40f2-8697-411183be498f", "comment": "Malware payload", "value": "e4b8325091e377d1232c8e4ddf59241a2db1d528f9f93254f10fc1f514a8451d61b04c17109c51a3cf3b593dd09e69e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650645447, "uuid": "e034788f-3e72-4453-80ca-c1154ec33428", "value": "T10DD49D11F6AC80B5E07BD13DC9A3875AE6713C9847B943C79255EB2A2E736E05D3E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650645447, "uuid": "80e9b8a8-7f6a-41c3-9425-8da4838b65cc", "value": "6ba79cbed2acbe9b8ecc8e14a572f100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650645447, "uuid": "0de1ff84-bf44-445b-8921-e0dfd73ac4e4", "value": "12288:C1FIcocJwMTHzXO7N2RBHiyzskF1CubVnmn:tco9MTHzXO7NY/115mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650645447, "uuid": "0135bdf6-4716-446d-b9fa-350f89d6b797", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650645447, "uuid": "9d0d8673-a61c-4e3e-a299-0f6bb1a887bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650645447, "uuid": "7477d3d3-7468-4e9a-b0f8-ccddb53d3df4", "value": "1c6970ff5c73c586182bb776bd568f93", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3848b8d-c1fa-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1650604357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650604357, "uuid": "622466c6-f0b9-4ec0-877e-24dfafb88a3a", "comment": "Malware payload (AgentTesla)", "value": "028987dd7412603b8a4edf3784f77fab", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650604357, "uuid": "97e46652-5f74-4c55-bd9e-5df386a24b42", "comment": "Malware payload (AgentTesla)", "value": "2601cab85eedb62ae3a381a08296464f6889b1e7efeed6af8687302d9ff4b2ea", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650604357, "uuid": "2de2af67-9816-4e0e-ab6e-a8d64ce18c56", "comment": "Malware payload (AgentTesla)", "value": "15b11946d79fea005a189e6896208aa4ca7ba3bf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650604357, "uuid": "5c060386-d5e6-4f9b-b455-e7de549db83b", "comment": "Malware payload (AgentTesla)", "value": "72d8299a05fc138a2cca86283b912db5dcb2ef8e68355d11cac561f73c9574824175b34dfda6aff4d57d1252e9e8180e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650604357, "uuid": "28bf2799-e253-43a9-abe6-727c35dfc1d2", "value": "T1C7E4F0DC326031EEC867D076DEA82CA8FAA5747B431B9607901B159EEE4D997CF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650604357, "uuid": "6b09d9d3-31fd-44e3-8487-748d123d1afc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650604357, "uuid": "45bbb50d-8f38-48c9-aac6-0d0956c9bf32", "value": "12288:UCuN+HiXD8luZ7EdndMMqNWb9AappNmrNm2d0wjjb4h7OzY0C2JhzJUNORmfKBg1:xHiXcuUAMaka0wjjbI7SLRmcThhg5j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650604357, "uuid": "389390e4-24ea-4825-a056-822b69538d32", "value": 714240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650604357, "uuid": "0d7ae04e-cbe4-4b39-bd7d-071c27bc7b18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650604357, "uuid": "ccd78690-bc48-4d1b-a44a-6fd15c34fa40", "value": "Preventivo-22612.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeb8cb9f-c296-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650671404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650671404, "uuid": "9ffdfcab-87c5-44ff-aa28-e0a091ec939d", "comment": "Malware payload", "value": "63a50d14dc3357c2b8307677b1a4c1ec", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650671404, "uuid": "4e595765-2fb2-4288-a6ed-472cde32ab77", "comment": "Malware payload", "value": "261ab474c1ab614df007bcdba34c155394e5d6d6b9892cf716eb980aa1da8fce", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650671404, "uuid": "b068cc87-af97-46f6-8f27-5aca7cf7c5aa", "comment": "Malware payload", "value": "cbc7b76a4465c4209cdea5c2d56a7825029b1574", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650671404, "uuid": "cb0ce10d-39e4-43ce-8095-85e6243e7059", "comment": "Malware payload", "value": "58fd89d7447aea315b38a3897753b7e84784389895f72f2daf65f9b38cbb20d82fd7e0209eb6a7e96b180384cc247806", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650671404, "uuid": "8113d9c4-7982-4665-ad8b-2e5f2af5291c", "value": "T12EB3952A7E22FFFEE168863107F35F7087D521A226919385F26CE6181E7128D1C9F764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650671404, "uuid": "519ed866-7094-4125-bb63-c487122617d1", "value": "3072:R/4tNF9U4vveKw6J73x8UmkiSFxfKxbXe:BUNFK+e8T8UmkiSFxfKxbXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650671404, "uuid": "ce240865-a620-4d29-994a-30087741f430", "value": 113275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650671404, "uuid": "7eda77b5-8502-4704-a0d4-4bb0b64d5d85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650671404, "uuid": "0baded60-dbef-43da-988c-9cc5cf8dbf6b", "value": "m-i.p-s.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "962436c0-c257-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650644197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650644197, "uuid": "514790cf-73b1-44f1-9cce-eb18688cd799", "comment": "Malware payload", "value": "8a17231d7932355003e1df12b4c3ac72", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650644197, "uuid": "a44069dd-66c9-4cbf-8fb4-30360a273d61", "comment": "Malware payload", "value": "2674cbadce008309bce1759f4f1846cb8d1e9571087dee8e3a069c768ac21278", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650644197, "uuid": "50656606-8a5a-447b-96f7-d4c41dca9c73", "comment": "Malware payload", "value": "982e0b96078a16df0af7e1f819fc70253d43fa6e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650644197, "uuid": "b9da8e01-562c-49be-af82-88bac1642299", "comment": "Malware payload", "value": "40ca142ea531f3e8a928323ec02fc1870d92683b7e1902ba82dc87a0089dc70b83112bdc81e533e8eb56cef7f6e448ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650644197, "uuid": "8cc4c58c-5fa6-42e9-8fa4-eed95c2c069d", "value": "T106B33801E4518727C1D2277AB79F865D37322BA893DB33215A347BF82BC279D1E39921", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650644197, "uuid": "5ac190f6-bf6f-410a-adb5-0d3dc5ea370a", "value": "3072:MPkl1NaxGMgTt9Ov1/B+YBDWs0bmTQOWsXAOn:zl1NaxGMgTA+YBDWbmTQOWCAOn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650644197, "uuid": "a8332b3f-0f41-4b0b-849a-69e5a0f42953", "value": 115105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650644197, "uuid": "0ed73b7f-0021-46ff-b80d-bd3d2faf9023", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650644197, "uuid": "0904e3e0-88e8-467f-aab3-31c3c077fe0f", "value": "shirt.o", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a80ac265-c236-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1650630054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630054, "uuid": "d3f74122-0bfd-4de0-9286-6fafd34f4138", "comment": "Malware payload (SilentBuilder)", "value": "799b103b9bc97fe17bf030a119293472", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630054, "uuid": "3250ec1c-1bdc-44d1-89a5-15200aa24983", "comment": "Malware payload (SilentBuilder)", "value": "26d2182b088d11325dc40f46d71710c6c9053f248d81ad36cee4e4e5512dde1f", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630054, "uuid": "53bdbe20-0cb1-4262-90f2-a3abdde806e3", "comment": "Malware payload (SilentBuilder)", "value": "f72be4ecdfc30a8c929c12f02360107c8e56fe36", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630054, "uuid": "b3f7d6e1-0df6-4b54-a37a-bb70fb2ac235", "comment": "Malware payload (SilentBuilder)", "value": "dbb9b14049bcc132014f3ec14ea2538ea43f95607bfac74061f172219568c96eac3c0b6ba20f285875bc3cd6b57ae48a", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630054, "uuid": "78249f0b-e070-4073-802c-5d5fd1da6f1d", "value": "T13823B646BA5D9859E9258B7548E743E9B333FC201F6B0B833616B3257FF49E05A03207", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630054, "uuid": "91d070a1-a5f3-46e2-9201-57f3fe45d404", "value": "768:4DM52tfQXi8vgLZkTOHkQT51Vp6AwPdM8gQ6JT5X6DGwUdh+pqjeSLjcvLtzrxFW:462tfQXi8vgLZkTOHkQT51Vp6AwPe8gD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650630054, "uuid": "2da15646-cd26-4f28-9ab3-887e481a55c7", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650630054, "uuid": "6f3aa740-2c33-401b-a693-77161d02f168", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630054, "uuid": "8b589f50-efec-485b-a2e5-f2dfba643387", "value": "Form.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af5ff8f0-c246-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650636938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650636938, "uuid": "d2de6d1b-3a4e-4cdd-abec-75a157fddff1", "comment": "Malware payload (Mirai)", "value": "a7d3ed837bfb49074ce6ae332a903218", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650636938, "uuid": "fb67787c-f6a4-48f1-a673-f4aff47484bd", "comment": "Malware payload (Mirai)", "value": "27c5fe98d5d65ace56804aaf66dca67e4c7371f15fea0558685317be4e7a15bb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650636938, "uuid": "73a18b9a-ce2d-4b66-a829-e12fba99c8a7", "comment": "Malware payload (Mirai)", "value": "6767b30df9e770dcdb36e513076fcb4b6879c330", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650636938, "uuid": "18d90e54-35d7-4e1d-af8a-dbaab36bf506", "comment": "Malware payload (Mirai)", "value": "05bb457af7e54403c55aae5479d4c112df656405faa9345ca23333f0c4b7457d13858d9a850942c89e7fd94ccda6c64f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650636938, "uuid": "d5d5c33d-1daf-478a-b7ec-3c27b9687f62", "value": "T1E2833B47E9A19FB7C0866A7565AB5E300B13E9912B4F1A4A303CA7F8434F4CD790EF64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650636938, "uuid": "b1dc6a7e-f493-4560-bc8a-4fb573944ebf", "value": "1536:ClN9YyOXmMSr4k9dgGwKGg0CfjGJCBdojMyTRLmkxVqOEeofzee:g7OXmMSr4krG3JGBQLmkxVqODofzee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650636938, "uuid": "5774abda-1112-40eb-98a0-d6273119274c", "value": 88733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650636938, "uuid": "bee0c17e-f985-4365-8142-331b0fc20817", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650636938, "uuid": "8318de8f-c52c-421e-a0ae-d91290de7926", "value": "a7d3ed837bfb49074ce6ae332a903218", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52955169-c20b-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1650611442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650611442, "uuid": "c284527f-62f9-4f3f-85f7-cfbff666ebfa", "comment": "Malware payload (RedLineStealer)", "value": "0e1d185ed9ecbb967da2c740f4729f3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650611442, "uuid": "6a157e56-5681-4e91-8d91-50107afeac23", "comment": "Malware payload (RedLineStealer)", "value": "2820b5e29c90ad346bdb8715eb94fa8d63864f51d677a9740696b000a34f87cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650611442, "uuid": "e1ec2646-7e45-4bab-99da-9db84713d1b7", "comment": "Malware payload (RedLineStealer)", "value": "07239d77664e4363e00ec90953b25e12f0b66684", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650611442, "uuid": "93aa4545-ea6a-41a2-a02b-da4c33d9ab42", "comment": "Malware payload (RedLineStealer)", "value": "66b765a051e8614c74bdd7145417a14cda415c8f662dbe266097fc96f41097d0993421634b2579b9c6d58c2d2028a991", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650611442, "uuid": "e5c0ea86-d3ab-4bb7-96b3-5bc89ae26b6c", "value": "T15104185863D90A15D5FECA7468B1E2B147F0EC516C12D75B0EC4BC9B3B3AB80EA526F0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650611442, "uuid": "c8b0784a-c298-416d-ac1f-d45a390275c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650611442, "uuid": "bcae8035-0318-488d-b3d4-78dba164af16", "value": "1536:pRxIkCrrQ2IRArcG9pPXotZ8xvhrZTMf8HqH53teSbuZglZ7J00wuei6SLoNk:tCrrQ8hcChrZTMf8HM9NBhJ0hIki", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650611442, "uuid": "ad412915-1646-47a5-8cc5-f79a3d3b27c7", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650611442, "uuid": "2f1f25ec-9ed9-4e69-be23-e9e8e7819934", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650611442, "uuid": "07951eeb-40a6-466b-a21f-111613ae354d", "value": "0e1d185ed9ecbb967da2c740f4729f3b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89bc8fe6-c24d-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650639882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650639882, "uuid": "569652ac-5c30-4d06-a333-cc5974794a4b", "comment": "Malware payload", "value": "332a2ef65b891172b7805555633aaedc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650639882, "uuid": "e3423f40-ac96-434a-b58f-1cad55bc8c1a", "comment": "Malware payload", "value": "294836a728846c0e2e6e49bf001e4b0d605fa1db9626cf15d1fdc9ef4ff1fb23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650639882, "uuid": "dab11dfe-0cdf-4fb7-bf5c-0aa636ac9606", "comment": "Malware payload", "value": "023a7f6dddc4d8bc3968b115005565312bea16cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650639882, "uuid": "bc018a42-1d18-4c5b-8131-0aef5615e131", "comment": "Malware payload", "value": "48854071952b555a10b3a80d5c6d015296f9c7e679c5afb79dd72ffe58927d2686554c8b10f33916e9c0ea5e77c4b10c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650639882, "uuid": "0363019e-4e02-4411-9b39-b8282ae621fd", "value": "T1C8D49D11F6AC80B5E07BD13DC9A3875AE6713C9847B943C79255EB2A2E736E05D3E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650639882, "uuid": "dccb7ddd-a082-4d90-926d-d5e95b753730", "value": "6ba79cbed2acbe9b8ecc8e14a572f100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650639882, "uuid": "9a7a0578-941d-4b79-8560-c957e93cc522", "value": "12288:C1FIcocJwMTHzXO7N2lBHiyzskF1CubVnmn:tco9MTHzXO7N0/115mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650639882, "uuid": "da1564ae-d58c-4606-9127-9633b2bc8b10", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650639882, "uuid": "09d9df75-7a15-4008-b8ad-921278ee1974", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650639882, "uuid": "45121f42-411f-47fe-93f6-eacae32364f0", "value": "332a2ef65b891172b7805555633aaedc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "834cbb30-c254-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650642877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650642877, "uuid": "fbe906dc-9a29-49bc-bec9-b697490f004a", "comment": "Malware payload", "value": "bf5ec27f0d59a1152274e6e4a1544a90", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650642877, "uuid": "bf812916-8e20-4238-82e0-953fb698f811", "comment": "Malware payload", "value": "297a118a1bc6946255fdb5ec70c5faa2717704a8ad1a439afa581606e3ae7c46", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650642877, "uuid": "b9f65fdb-685a-4f6a-b8de-abc2fc19773d", "comment": "Malware payload", "value": "87f2a93e724f09973c08c1a7102c3acd8125eeb8", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650642877, "uuid": "59eb27c9-4cd5-4670-97c2-0a0d2449f9b1", "comment": "Malware payload", "value": "a3539387357d619891a08a35230b67f314e47d5045135dcf1cdcf1be4e739c7e506eb1b38eedbc346b215b9a54023f1f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650642877, "uuid": "5c116817-3e4f-4899-be81-a6ebdb4d4d42", "value": "T139F48D4BF77C84A6D16AC979C5639A8AE6717C454B71C34B4360FB3E6F337A05A2A300", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650642877, "uuid": "7a5b179a-10dc-4bf1-84b5-0dfd053fe7c9", "value": "57b460f7cd0fab28b120cd121cfb7f9f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650642877, "uuid": "6fb81896-7d1e-49f4-89d1-733ebcbf2652", "value": "12288:aIabL1+x29hs+bDBLKhKmCKzTrj+i0I8PxiGhWzx+o8/NQfN7IT5p:XabLXhs7AZKzvjLT0hWzP8/yfRIT3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650642877, "uuid": "7e4c79a2-8746-4e72-8532-b85d8dc3a683", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650642877, "uuid": "32e9c965-d144-4c49-a65b-c4eabad2573a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650642877, "uuid": "acf6a7fd-b162-4b10-b539-de44a28737d5", "value": "emotet_exe_e5_297a118a1bc6946255fdb5ec70c5faa2717704a8ad1a439afa581606e3ae7c46_2022-04-22__155432.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37448471-c211-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650613973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650613973, "uuid": "36a151b2-810f-49f6-8fbe-0c6a4d849e0e", "comment": "Malware payload", "value": "c400c6ae4aa9de6a07e526bc9daf14ac", "object_relation": "md5", "Tag": [ { "name": "LazyScripter", "colour": "#6D8205", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650613973, "uuid": "2b01cd02-20f5-4f0c-8baa-5e18170ea6e2", "comment": "Malware payload", "value": "298328079e138c29ffa2bc4de60c0a91c8e74037505d3f3b928c10d3cc84ab4e", "object_relation": "sha256", "Tag": [ { "name": "LazyScripter", "colour": "#6D8205", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650613973, "uuid": "b3f8a192-ffbf-49f7-9320-3859647dfa77", "comment": "Malware payload", "value": "7430f3bb939fcf7843a415b3b4fcb0fa4e326b6a", "object_relation": "sha1", "Tag": [ { "name": "LazyScripter", "colour": "#6D8205", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650613973, "uuid": "50c568d9-57bb-46b2-b548-6c9949c738b9", "comment": "Malware payload", "value": "d8aac33bab4cc18f7d8ddb238288647110ea194820cc4fdccfcb6591e1cf64bb5b53dc4096ab788e76996762d367dd86", "object_relation": "sha3-384", "Tag": [ { "name": "LazyScripter", "colour": "#6D8205", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650613973, "uuid": "7a86c766-5bc3-4e58-853e-51b22039c2af", "value": "T17AD1B88075EAD5DC929273EC427BF69CF008461B00698C49F5FDC0CAAF650ADE2B57B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650613973, "uuid": "3cf5126c-40ed-46b8-8f68-89f67b122ac1", "value": "192:yj9K7lNi+H/tikQWKmAlR9vKe/VsxEG2weaLubhIAShy:UK7nH5QWKxLORyWM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650613973, "uuid": "ca56d40d-0ce7-4b03-b2b9-6781b81bff9b", "value": 6521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650613973, "uuid": "a4b12b15-4c34-4355-bc1d-88b29c0031d7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650613973, "uuid": "a9c7f2e2-7ba3-4132-a430-f5eef2518800", "value": "lazy.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80a14e8a-c21a-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650617962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650617962, "uuid": "40b71487-6e5d-4cca-8360-4620d1dcd95d", "comment": "Malware payload", "value": "fecded91f24a519ba4a7f4d48db35b07", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650617962, "uuid": "0d0730ac-c8b6-4829-acdd-a2f21ddaba0d", "comment": "Malware payload", "value": "2a2d53f3af45ed2d87b66d1acb0dca912f1a747a101e0b59c24dda4456ab0cdd", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650617962, "uuid": "c062c07e-742b-4f72-9c9c-044c52916c14", "comment": "Malware payload", "value": "2b4fd2cc8e39f6059b5be47d9f84c34f7e930c6a", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650617962, "uuid": "9cc9ccdf-639f-444e-afba-fd8c2d7a5565", "comment": "Malware payload", "value": "195e4873eec59e2c0f29b3ea3ccf3a0c60baac9ac5ce1c1e2f0d18c5790d42fb4e8980bce36fafc6112fd90c21e8102b", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650617962, "uuid": "97d11258-2539-46df-96cd-3940beb6be6e", "value": "T1298422B03F42474BE0A3AB35159F972A5F35ED760B61E67758E1388D6C38F8606026F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650617962, "uuid": "3ac91b51-f945-466f-82b8-f8663687d05e", "value": "6144:mDpVUq8aXUO4OjdldGAJtsdo3nTgdhODUP5nveoPMHR8SK0uqn0oiqcCUoHTm5hm:SypBO4OjdDTsxdhuwveokx1JuqeqcCUi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650617962, "uuid": "446e0da7-34b5-45d9-808a-5e8b13ccf6b8", "value": 392704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650617962, "uuid": "51acc873-acf3-4573-a953-948d4833d417", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650617962, "uuid": "401401a7-387b-4040-90d8-7a87ee98d013", "value": "Scan copy.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "952ebff5-c221-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650621003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621003, "uuid": "78346aec-31c0-4776-9a73-a44ab18dd13c", "comment": "Malware payload (Mirai)", "value": "ee9d24a11185267497a5f048f501abed", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621003, "uuid": "e48d6bf3-de5a-4551-b109-7539e542afbd", "comment": "Malware payload (Mirai)", "value": "2a945feab855dacbf26b7c154c88de4bda43805103e8c76bf1c40c04d92b853a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621003, "uuid": "faceef42-7153-499f-9783-923f2da8869e", "comment": "Malware payload (Mirai)", "value": "df9f5a355705b32c45db431877d835c2d8791466", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621003, "uuid": "d65a7268-07ac-46eb-9046-c1fbc62e4e1f", "comment": "Malware payload (Mirai)", "value": "b6ad965460546cc3bb88a93a6834f1d1f2eef29663bc4e29b1d6cc366fee6973d08e6814e6d16357baae51deac935372", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621003, "uuid": "02469f03-5df5-4190-9f1c-cb1492d35103", "value": "T13C23F19033469867D6B32C7BC54CBB0F672F853CE0D12753627A6378ADA1A0A676301B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621003, "uuid": "68dd82ad-05f4-4619-8bfe-f595e905fc2c", "value": "768:3PcbqDstD/IeoWv8n2MqT2KGDx6E8kJyz9q3UELCnJuqam4Jar:yxtk3Y2KG/8kJyyLCnJ9aTEr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650621003, "uuid": "2edb8a4f-dd63-4219-ac3a-7152ea66677e", "value": 46772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650621003, "uuid": "03d4f1c5-ca2c-49e4-8063-6ff3e5f00f55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621003, "uuid": "2030fd17-c5a3-49bf-9d6a-442015a46ba8", "value": "b3astmode.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a614b563-c1d1-11ec-8e58-42010a9c0032", "comment": "Malware payload (AsyncRAT)", "timestamp": 1650586672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650586672, "uuid": "2fa73f24-1b5c-480a-8a86-ae84c39263ca", "comment": "Malware payload (AsyncRAT)", "value": "cca5df360b5df8058739f12dd2ffff86", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650586672, "uuid": "f649f4bf-cd35-4888-be23-5cc661bd7469", "comment": "Malware payload (AsyncRAT)", "value": "2af61f931dc2506cad5886bd31c8d30a5964ac35ad143ffe25c23e862c46855c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650586672, "uuid": "f9d8dde3-cdd7-462f-a295-9a86e9bd11c2", "comment": "Malware payload (AsyncRAT)", "value": "a65ad81582fbc80b9a624b2e5c5f429d578aee1f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650586672, "uuid": "1e125f52-210d-491b-9542-c00e87ce1ace", "comment": "Malware payload (AsyncRAT)", "value": "389840620123834bb777a443cc95aa4e56df7a1df487c131f79da2dec1454f53d40e7173d7b691cf2ad14c49a561ee62", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650586672, "uuid": "852d115a-566d-4a00-916e-8752d95cdd99", "value": "T15684121F32E82B32C9FD83F9967141981774654ED926F116DC8271CE2863F489D23BAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650586672, "uuid": "38dfcb1e-5370-4b50-a6c3-e348cf42765d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650586672, "uuid": "d4762438-6c05-4a17-8981-4a45551f4b84", "value": "6144:geljGGChqkTzkm/G7VAArZukBth5IWASTYtCnwqgh+/AZ3j4ZI3FjYaean:NlgzRG5A5+THvRnwrhGAZTb3Fjte", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650586672, "uuid": "f315981f-2cad-45c8-b1f4-557541c17609", "value": 400896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650586672, "uuid": "61afc232-739d-4afd-a6bd-73cc5a301257", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650586672, "uuid": "93c279cb-4563-4630-b7b9-94c18c5b01ae", "value": "April P.O.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97cf6c68-c221-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1650621007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621007, "uuid": "90e05df8-6596-467b-8e61-26bbbcdee7e0", "comment": "Malware payload (Formbook)", "value": "093402d3b822ae3e3da71c362a6b6be0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621007, "uuid": "45b42fc6-e119-4b05-8644-3557b979cbe6", "comment": "Malware payload (Formbook)", "value": "2b5733ced58258c63aeb893b78e80ef9b7171b8188b69a9d2ae19e76abbb9f1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621007, "uuid": "519e3558-1df3-41ce-b0eb-c48bbe1e346d", "comment": "Malware payload (Formbook)", "value": "9209d8fe5a1c6ca212a1f249addc94fb253b8142", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621007, "uuid": "2a819fdf-aab6-41c6-ac89-e138dab038b6", "comment": "Malware payload (Formbook)", "value": "18c8725b0b903acffc5fdb59d7ab26dcc5073a97c15584b68b397ce13c12d17a4125ff04256eee2820b492e7085d10f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621007, "uuid": "820175f8-fe10-4d01-9761-c637f33befd2", "value": "T159958D32A3E64E24E6FB333854B90A638275FE425B65D39F827960AD14E7750CF12363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621007, "uuid": "c9973b1c-f618-4df9-b9ef-ae8fb1c179f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621007, "uuid": "b2e5ade3-e446-4e2e-ab6e-5d19e3d87cc7", "value": "24576:uuCrmGVi5pGDZY+OOMBESGOdHBzb7uNaWTSHB1CskA5:bCr3iHGGNvBE/OSaDnrf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650621007, "uuid": "f9324f6b-ddde-4dc4-b807-f09b04aaf8e7", "value": 1880576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650621007, "uuid": "2a85ed76-91ed-4a5e-9aab-1114203741e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621007, "uuid": "5db269be-ead7-48a4-9766-8f9155d97f29", "value": "SecuriteInfo.com.W32.MSIL_Kryptik.EOQ.genEldorado.30986.13091", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b753098-c257-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650644179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650644179, "uuid": "869f5e64-d2bf-4154-a615-ef71598a49db", "comment": "Malware payload (Mirai)", "value": "32da7eb5dff51921e9c74bf2463afcba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650644179, "uuid": "8951878f-71f3-4fbb-b799-cab90c9a2331", "comment": "Malware payload (Mirai)", "value": "2b7388d77b41b2a660c23b580c13df87a3895d88be5d6fc09b5bcc02c008d4a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650644179, "uuid": "51be7b66-60e2-4270-87eb-986011882cd8", "comment": "Malware payload (Mirai)", "value": "2a0ee38d2ea1541cf1863eb10a8d5d80766e341c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650644179, "uuid": "fe0c2e51-90a0-4452-9480-6164163142ac", "comment": "Malware payload (Mirai)", "value": "75db035087d55167e5e5679d742a073ededf16c10f6a1e86158a25dbb0da9c14888d1a4ee9d7a86d57e891b94d9a8079", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650644179, "uuid": "9bd1b940-7190-495e-a5a2-654d186c0822", "value": "T1B7A3B644FF55971FC6D2B2FAEF5C028D373A0F68B7FA382695357A9423E4BA02525120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650644179, "uuid": "82652682-165d-4a56-b13d-361a6145140b", "value": "1536:WifbhZpM124ND4nP2fuxU4pT4hHp5bowrd3hipXXko6XEuWO3vKv5b:HZpX4G0AU4pT05bo6hyXuEcKv5b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650644179, "uuid": "334a5142-fd9b-455c-8800-28f64fe3e24f", "value": 106980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650644179, "uuid": "81a9df73-72ce-48db-bc67-d8fca1d7e856", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650644179, "uuid": "26a354f5-1e44-473a-95f1-989f044ebaf7", "value": "hoot.o", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e235a05-c206-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1650609234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650609234, "uuid": "c7403558-e23b-422a-8aab-7a39f8989ec7", "comment": "Malware payload (SnakeKeylogger)", "value": "a3fa97cac9d497cc105fdc8720566070", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650609234, "uuid": "795ffb6f-c6a8-4d42-817b-a2d43dacb09a", "comment": "Malware payload (SnakeKeylogger)", "value": "2cc1604a149d9359d4674e672c82f2724da013bd029d62a100165ea8ba9cd7dc", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650609234, "uuid": "0314291f-d37e-477d-9c15-82f53c2ee293", "comment": "Malware payload (SnakeKeylogger)", "value": "9993f304102a6df97ce14dea702968bf77a5b0e2", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650609234, "uuid": "b5656c98-e51b-4fa3-ad6d-071c6c4a68a2", "comment": "Malware payload (SnakeKeylogger)", "value": "569b01dc37c997cba3f6d9852cfda786098cafc5c144ed985f80f88e4847c090f41364769d497aea2fccde30baa9f3c3", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650609234, "uuid": "d509ab28-987d-4c8f-b13b-e3a5f732ed0d", "value": "T19F45126616A84B36D9EF1BFA957122091734B2866213F3483DDC31EF1F127C49A11BBB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650609234, "uuid": "2ac37780-9138-460f-b8e0-5d47b68037ca", "value": "12288:ICdbzmcpnjtV43OMdnB1C9XSi0iYxne1:hb3dRV4+MRBgno", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650609234, "uuid": "740ae385-6418-46e6-bb5e-0f35e12cda76", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650609234, "uuid": "7fbff76b-bea9-4c95-8902-a1482e3b7d41", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650609234, "uuid": "9d1feb7c-ba25-4ec9-8fd1-90b2b730e1cd", "value": "INQUIRY-DRAWING.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88915dfc-c221-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650620982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620982, "uuid": "db43e08e-feef-46ac-9214-be5e3a9862e8", "comment": "Malware payload", "value": "23114784af9ce4912d9f7e672517a31f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620982, "uuid": "65f1c327-46a5-42c5-acb4-951a8c3a49e6", "comment": "Malware payload", "value": "2d2767aa4be3510115fb29060ddc9ac3df3036dc8fbb43aa17481cfd958a8d17", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620982, "uuid": "a8076a1e-2ff4-4fa8-94de-9c70e970095f", "comment": "Malware payload", "value": "88fda91959bfd18a88f8e833c66ba15f66c2e085", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620982, "uuid": "911dc439-8d10-43b5-9d66-c10abe46974f", "comment": "Malware payload", "value": "3399dbfb255913d6d6bc822fa651a141fe80dffa6cbc418d81deaf6aa78ecb6ec1af92c7c3ff68088a231a205c15f8a0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620982, "uuid": "99ef041e-e186-4242-a916-ee0302c50a62", "value": "T13E264B23FA44773DD47E1A3A4577A618993F67722922CC5B5BF4088C8F368606B3E607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620982, "uuid": "233b29df-367b-4e80-84a4-82bf6d10d267", "value": "d1a37ff6ba55f62796defb7bdd6090d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620982, "uuid": "0f0255e9-7539-411a-8da3-fc4fea1a0818", "value": "49152:bcK0/TAmZU0ArR1WI5KSC3/ImAe1RSSSyr+hjYT4TVE:IPANUMeDSPyEjl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650620982, "uuid": "a202f37b-3d0b-4f56-917a-52c08bd1f679", "value": 4592128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650620982, "uuid": "0432db41-5d67-4dd9-b0e7-a699e4f4b14b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620982, "uuid": "cb96ee3e-e875-4322-b25b-ae51b25a57ba", "value": "SecuriteInfo.com.Trojan.DownLoader44.47620.31238.4522", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a91ba94-c248-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650637682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650637682, "uuid": "54fdbdbc-0854-4f58-8ac6-cd201e4352ee", "comment": "Malware payload (Mirai)", "value": "02a2cd9a026b9404e7e5101b16ec6582", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650637682, "uuid": "96cc1cb6-965a-42ad-9c28-fab4059a50de", "comment": "Malware payload (Mirai)", "value": "3083574cb42efdc7bd5c36eb5a61e27e6f269fed5e8db4a20443b835fc2f0b3b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650637682, "uuid": "b8c58bb3-6dc4-45bf-af0f-74cca6cd2ec1", "comment": "Malware payload (Mirai)", "value": "7b4c93d8069e0dd3b7caaebcaea60368650cf798", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650637682, "uuid": "9905a939-be0a-4a0f-8496-e0bfa321a213", "comment": "Malware payload (Mirai)", "value": "b67e3c159503908d241c3ab1ef4caba4ee4566ed32327f378b15d06df3407bc625bd40a402604b8789df2e099474fb1d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650637682, "uuid": "81c5fa09-5b8e-4e11-a4a6-18f2784841d5", "value": "T137C3842E7E12BFBEE668863107F35F70879521D227A19382F26CD6181E7128D1C5FB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650637682, "uuid": "7f86f2ff-a2c6-46ee-a299-f12a69cc1dd0", "value": "1536:M7je1TMGq+f+AQ2rK7zeXeReXe8V2rK7Ie+u60GAzQj1l72HBemEdWfRZrmW+IFj:Ted0W0MZQHcd6RZrmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650637682, "uuid": "015d4f50-1c49-4c65-b9c2-6af25b4c723c", "value": 125962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650637682, "uuid": "40fc9fcd-0e93-4e91-bbdf-c9df50159630", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650637682, "uuid": "120fe34a-e9a4-4274-ada9-bd7ca34803d5", "value": "02a2cd9a026b9404e7e5101b16ec6582", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab6fc098-c221-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650621040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621040, "uuid": "40c76067-be34-40b8-af1d-a312790f6a6f", "comment": "Malware payload", "value": "a3ac359ae523598719c8b4c8371a634a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621040, "uuid": "0fd701bd-de8d-4974-8e4f-a8b29ce6a242", "comment": "Malware payload", "value": "308a90a99497522753620fe97d876e533d50db76417919db9e8bd92414c8a254", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621040, "uuid": "d471dc7f-a6bb-4f1f-947b-efbc29a57949", "comment": "Malware payload", "value": "70ac24cd1a26092fa87f428d7273db05f6e966e6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621040, "uuid": "6ea5d3c8-47d2-4048-a15e-869aa497135b", "comment": "Malware payload", "value": "7371b4a694dfc30eef7b9cce6dfdca3cf28d8acd3ac1f1f0dd88c465bced928ba6dfaf785e5934846ffebcd9f26dc77a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621040, "uuid": "eace4b56-6ca4-4228-b2ca-d4d9d054c342", "value": "T11CD55B33B245B53EC0AB197A963BB75C993B7A612622CD5B57F0098CCF355802B3E607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621040, "uuid": "293c4d9f-1eea-4734-a4ef-c8b2d2c560e0", "value": "6b5fa3fe4fb76af7f62b44540e533bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621040, "uuid": "c5f14364-9b6d-4f2d-9e6b-f5de2efe596d", "value": "49152:l1BMUy7zcotBJyJnhpSwCaDlgB0qMTjTOKz:l1BMjRyDm0TTv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650621040, "uuid": "7c74e354-bfbd-48b7-b242-2331860fa631", "value": 2941952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650621040, "uuid": "1b463b61-0871-4f46-a139-698f271daded", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621040, "uuid": "d0a1836e-271c-4b79-85e0-daddc48743ab", "value": "SecuriteInfo.com.Trojan.DownLoader44.37160.12970.31193", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc68c5a4-c246-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650636960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650636960, "uuid": "81e7bdd9-4112-4ad9-ac08-367761792068", "comment": "Malware payload", "value": "696c7b9f8e98ce6fa002d5d3797aab9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650636960, "uuid": "f3bb45a5-ab80-4ece-8909-0737261b6e2d", "comment": "Malware payload", "value": "30e11f5b4f71921b67e8e8153740335cb76fce7ced4ed130b0ecbcb5882d25a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650636960, "uuid": "558df8a7-02fc-4dd1-8543-c3d93705422f", "comment": "Malware payload", "value": "be38a4edf1cff7baca1fb6c5c3c72cd9bd4042f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650636960, "uuid": "d0db2b52-1dde-49e1-9aaf-a720c6932d0d", "comment": "Malware payload", "value": "01f82233c2e879e89359659d4d9c751280b2c4716c1154f9883aad3f8a1aa0dd100d6878e71aa8a07a260e92b42c904a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650636960, "uuid": "05f4b0f2-dd15-4bcf-b36b-90c532be0db7", "value": "T130D49D11F6AC80B5E07BD13DC9A3875AE6713C9847B943C79255EB2A2E736E05D3E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650636960, "uuid": "66491aa0-9ae4-486c-ade7-a5995a719897", "value": "6ba79cbed2acbe9b8ecc8e14a572f100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650636960, "uuid": "b7c13392-2b90-476f-aca6-0e703e690a6c", "value": "12288:C1FIcocJwMTHzXO7N2HBHiyzskF1CubVnmn:tco9MTHzXO7NG/115mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650636960, "uuid": "27bb55d1-6265-4ca5-a4ea-c69f69daf570", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650636960, "uuid": "28d9ed20-5d7b-483c-a653-711ae7dc3998", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650636960, "uuid": "c860b34d-bdaa-4c54-81e4-7aae5cca7db3", "value": "696c7b9f8e98ce6fa002d5d3797aab9b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a9bf9e4-c275-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650656929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650656929, "uuid": "7a5feed3-3ec3-4e93-ae58-6bfe1c08254b", "comment": "Malware payload", "value": "88b11f04b08addc94cd6cfccc225e482", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650656929, "uuid": "a185d58d-f7e0-4a4a-b94a-9b7480b6c38c", "comment": "Malware payload", "value": "3134c9e10ca27acbdc41a0c58952a4130fae143250b2e24910f2643c2d155059", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650656929, "uuid": "5c81ed61-f57b-4081-b682-ca41b11a4fb4", "comment": "Malware payload", "value": "c253a22b3430d5e6c6cee551b680a74e4345a868", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650656929, "uuid": "40602932-0aa3-4660-9540-c747e347fbed", "comment": "Malware payload", "value": "1d5e40bcc3ac2ac2bc203e568bf1b01fab96cb9f5bf6c128537c3a9f1248f64bec6e506bd1f4d8a1f6b857a80299fffa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650656929, "uuid": "83766a2b-56ab-4ef7-ae6f-ae2b002a0e49", "value": "T103D49D11F6AC80B5E07BD13DC9A3875AE6713C9847B943C79255EB2A2E736E05D3E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650656929, "uuid": "a9998cfa-6253-488d-85c1-024c7d0c15c5", "value": "6ba79cbed2acbe9b8ecc8e14a572f100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650656929, "uuid": "63454c3e-84e4-4fbb-94ec-ca88a6e1630e", "value": "12288:C1FIcocJwMTHzXO7N2dBHiyzskF1CubVnmn:tco9MTHzXO7No/115mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650656929, "uuid": "1a7f1b60-ba4e-4cbf-97ca-4c35164f65a8", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650656929, "uuid": "e99230c3-ca7a-41b2-8576-d5f86b513960", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650656929, "uuid": "2785e622-02db-42bc-b48f-4fc628da5daa", "value": "88b11f04b08addc94cd6cfccc225e482", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43e98c42-c1fd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1650605405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650605405, "uuid": "88f2ea3b-5c29-4aa2-a078-d3ca81e642dc", "comment": "Malware payload (Loki)", "value": "a2268faf7816e05e2a45473e1af2becd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650605405, "uuid": "1b070ed2-3b67-4368-bbd1-92a04361c7a0", "comment": "Malware payload (Loki)", "value": "32f4ed2758d54d89b86ead83702e718d654e1fa6c78b4b46c4ca6fb25077d699", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650605405, "uuid": "993fc8b5-00ce-4f76-ab65-e0e9554e4a57", "comment": "Malware payload (Loki)", "value": "1fb369b649823ab9a6d9705696127935364e6798", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650605405, "uuid": "6c48076a-dc70-4280-b3d8-306bfe0d3f9a", "comment": "Malware payload (Loki)", "value": "f9bc9ff5e15b16188ce1f665f61524a1e79103c16c1c9a7e26ec263d38c048bac3822f3d7a20f3c0e3507455c99c8206", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650605405, "uuid": "12be9dc0-34f0-42eb-ba7a-a9c1674c0e71", "value": "T1D1A4021673A4D161C4BFB73525E2814B83F1D9236618D75E0CA762BB2F61391238EB8F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650605405, "uuid": "b0b72fe8-7751-4a62-9ed2-faddd0d356f4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650605405, "uuid": "a1260a45-7222-48a5-af42-fa67a7ecdef4", "value": "12288:jDfHKJzmKSj0wz0PFFSXYF6r84064/owSc6AYtv/h:Pm6TAiGF6Yx6mSFBdh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650605405, "uuid": "ae3a6ddb-a3f1-40c9-a43f-50bd702b2230", "value": 472064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650605405, "uuid": "18e4885f-2ef1-4e0e-81c0-16807087b222", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650605405, "uuid": "f0f91503-c0a9-4753-8e9d-470d2d9076eb", "value": "SecuriteInfo.com.W32.AIDetectNet.01.28480.9814", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4775358-c20b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650611633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650611633, "uuid": "2fdd6d5f-f662-463e-bf85-25722930dc1b", "comment": "Malware payload (Mirai)", "value": "d59d106bbd5f2498236121c96ad10cb6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650611633, "uuid": "f93d63db-ec4f-4cad-afc9-f1fee486de07", "comment": "Malware payload (Mirai)", "value": "3475afdab8347a903c74efa6aef89d2f6037c523bb9241a5779bae27ffba6fb2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650611633, "uuid": "95944b19-92cb-41e4-b740-47ae5e39c8fb", "comment": "Malware payload (Mirai)", "value": "2199fd065a6d59aad883d7bc71299cfd1dc93c07", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650611633, "uuid": "de35f2f0-69f0-4791-8130-8c4ea18925d3", "comment": "Malware payload (Mirai)", "value": "d16c52e02f9571f706d9abf1baabbf5d49975e85d818922452a8d13b34120afc76e809198444f5d443f84cbb24e15a5c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650611633, "uuid": "aa80d7a6-7ce6-4748-81d5-b8a3912c5768", "value": "T158733925BD7A2D17C0D5A93B12F74754B2F2A34B35E4C60E7D620E0EBF20904A2636F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650611633, "uuid": "a10a170e-d2a5-4d18-8875-8fee8b32e422", "value": "1536:dKQ40gc+VN/veP54uHEf1ApQIgV/Lx6UOkwiLRi:oQsxVqDEmqIqFNVRi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650611633, "uuid": "03a0dc67-72e9-47d7-8f8c-2c9b26ad96a7", "value": 75236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650611633, "uuid": "695ce4b2-425d-4427-8404-22ef98f84603", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650611633, "uuid": "4aba72f7-d9be-43a8-9ec4-4f80d62794c5", "value": "d59d106bbd5f2498236121c96ad10cb6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6c2a601-c205-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1650609007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650609007, "uuid": "80164d38-e9ec-464f-9c9f-a70df74d4bce", "comment": "Malware payload (AgentTesla)", "value": "897a693beb5562b7ea51560db7c01a5a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650609007, "uuid": "78cfb1dc-d00b-431c-9e38-b3a19f915d65", "comment": "Malware payload (AgentTesla)", "value": "35fc817e28e7d4490f85e283b947337b7e92485c7eb26f88b139d717ba8d3f73", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650609007, "uuid": "25097472-98ec-43db-aa09-06d1867d5c5c", "comment": "Malware payload (AgentTesla)", "value": "5cab631c9d2f9aae706e62581d666fd62fd6fa1e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650609007, "uuid": "71ce5283-baac-4822-a1e3-d67e9d40bdfc", "comment": "Malware payload (AgentTesla)", "value": "f92324f8126a0232127fcf0f78f298a61b8708333c56c1d067674103d89ba2f09840f95921416227e6df07ec189928bc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650609007, "uuid": "2fedcc0c-2372-4d37-beb7-ed7a47332570", "value": "T14E9423D9F82033BC985B5078D158D7EB91409D492B8F1CEC3612A8CF7AD6AC5631BC6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650609007, "uuid": "e2de7a8b-3085-4a23-82c2-3b4d241a0820", "value": "12288:Su2PX8lrA2V/W6rI6paxjVSR1kwSTwW7b:/2sr1Y6rIyIVSXkwSlb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650609007, "uuid": "079adce5-1217-49bd-9f64-da207c4e5ac9", "value": 412314, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650609007, "uuid": "05ff389d-bab0-490e-bf63-dc68334b8c70", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650609007, "uuid": "b3a948db-3554-43f2-bae6-ed311a7a41ec", "value": "DEBIT NOTE CURRENT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eac75c1-c258-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1650644561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650644561, "uuid": "c42b5503-93b3-4dd8-b445-1c59b494277f", "comment": "Malware payload (SilentBuilder)", "value": "8f6fba3aca83dd4f971380855c83f281", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650644561, "uuid": "c09de96e-5c4c-4295-9744-6c0ff1f693d0", "comment": "Malware payload (SilentBuilder)", "value": "360cf9e5ef0a5fd454dd48fbb70fbbfff60a1654d8e3f878cedb472e8ab7c514", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650644561, "uuid": "33ff6417-a0bf-4d33-8f33-4d99bef2c451", "comment": "Malware payload (SilentBuilder)", "value": "6b16504ab2a74b21e9909575191db4964941053a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650644561, "uuid": "754db798-695e-4e87-bbae-d8c70662cc20", "comment": "Malware payload (SilentBuilder)", "value": "cfa9f0525d7defdd4296b3fe7c05c286a62632514ba1a81208ba9137e737ea3d38cd4620af5a5e76a8592b2e8d9bae84", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650644561, "uuid": "8183acfa-d6dc-4af2-8d30-9c1c58c6ced6", "value": "T1D6633B477549B86AE916CB3D4C974B99B613EC104B960B83BB09B3597FBA9B04E0310F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650644561, "uuid": "cf9bac84-ece4-4165-b362-4acd3185103a", "value": "1536:tOKpb8rGYrMPe3q7Q0XV5xtezE8vG8UM+1YW/ESKQHS1yXJFa5etWv:AKpb8rGYrMPe3q7Q0XV5xtezE8vG8UMd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650644561, "uuid": "7f17b7ef-2601-4603-a803-6c75944efc92", "value": 71680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650644561, "uuid": "6c21aa75-ae09-4afd-9b89-849bbe90511e", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650644561, "uuid": "6a3d5165-5b37-4897-8be8-b81aa3f4fdb4", "value": "untitled-0422.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4321db41-c1fd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1650605403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650605403, "uuid": "c51a5adb-e79d-4095-a8fc-757beee8197e", "comment": "Malware payload (Loki)", "value": "701e60cb0f475a5ffcec0890456ae806", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650605403, "uuid": "686adfc8-edc7-4d57-81d6-a93a7153a54d", "comment": "Malware payload (Loki)", "value": "36292b95e0ed9f03e572e60d83801bf7818d85f9e607bd6d396bda9e82d6e803", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650605403, "uuid": "a62d78dc-b84a-457d-a37f-f983f4da7f86", "comment": "Malware payload (Loki)", "value": "523a0712363d8f446e2debfc8c73d69dba033e2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650605403, "uuid": "3c0f06a2-38b8-4904-97bf-70c9121203ba", "comment": "Malware payload (Loki)", "value": "9201ea14a45ba4469320d54deb1b415c8581d675988861d46a289304877856a3072ccab8b23690ecd87061b95bf693c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650605403, "uuid": "ddd9d155-654c-496a-b9ec-65cf901a0d3d", "value": "T15AA40211B6A0D2D1D07EAF7A24E1058F83F0D45797099B8D246793BB2AE1381670FB9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650605403, "uuid": "a7ab44f2-b092-4be8-ad43-4880e4f1a654", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650605403, "uuid": "a6fa9aba-6e8d-45a8-ba45-8971e8c16b6a", "value": "12288:NvzVrNwBT+zIf+icPBokOY7bablGHpehKc3swvAYtv/h:dVrNST+Ic6K3pehjsABdh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650605403, "uuid": "184329ed-e634-4057-9ff1-e466dadddfb6", "value": 466944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650605403, "uuid": "2290b4b0-042a-4e18-b349-c3539559927c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650605403, "uuid": "05764df2-0dc9-4aa7-83ba-ef54713734a6", "value": "SecuriteInfo.com.W32.AIDetectNet.01.14251.10986", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab2d54f9-c236-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1650630059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630059, "uuid": "a9d044be-484f-4747-a785-982ab082636f", "comment": "Malware payload (SilentBuilder)", "value": "299b45654a93a3611cd463422f25600a", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630059, "uuid": "dcae5f7b-4375-4ff3-80ac-c017553cbb8f", "comment": "Malware payload (SilentBuilder)", "value": "37021b5d920816701062f7fa5e7d874250994d1ca45972a20714b5346bf937e1", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630059, "uuid": "ab43b23c-2f67-4b62-9261-6fa585d19306", "comment": "Malware payload (SilentBuilder)", "value": "7bec50ec2460d21f7e2ac4072bf304babf2ad1d7", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630059, "uuid": "2cfe3c6c-d5e0-44d9-9a89-0ddc430360c3", "comment": "Malware payload (SilentBuilder)", "value": "c16b84ac29d5bc4880385eb2e16a448e0981c48ec49559857b53efd7b53c0e868fef800eb9457acb065a04468f5562a5", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630059, "uuid": "ddc654d9-e9c2-48c1-8df1-47874baff8ec", "value": "T1B623B646BA5D9859E9258B7548E743E9B333FC201F6B0B833616B3257FF49E05A03207", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630059, "uuid": "e36973bf-7c9a-46e4-a643-4b643120f1da", "value": "768:4DM52tfQXi8vgLZkTOHkQT51Vp6AwPdM8gQ6JT5X6DGwUdh+pqjeSLjcvLtzrxF2:462tfQXi8vgLZkTOHkQT51Vp6AwPe8gj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650630059, "uuid": "17e046be-500f-41fa-9438-0e4bd4bb8112", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650630059, "uuid": "858f6340-9e12-40e6-9c3d-0eb183696f84", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630059, "uuid": "e0f0b4c5-e33e-40b6-a3fe-20c55a535ea3", "value": "Insight Medical Publishing_1.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "335c9f9a-c229-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650624275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650624275, "uuid": "72245030-1bc3-4ced-9298-8c91d1de6e6a", "comment": "Malware payload", "value": "a9c6473c5433bf0773dc8fc6ed4936f5", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650624275, "uuid": "abf7db44-6929-4361-89b3-5017fa83bdd8", "comment": "Malware payload", "value": "3708edcc20d6efd30589ee53373502d016ccbf3be52638b820f8bcbddfb7c6fb", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650624275, "uuid": "0cc2a869-1b1a-447d-99a6-a66fb36005d3", "comment": "Malware payload", "value": "ede014284791a9fc16d90f6b72de25207415a8b1", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650624275, "uuid": "989840d3-8737-4af2-a62f-3bd8ab7c571f", "comment": "Malware payload", "value": "db6defabcfab2b3d897e4f4218ddd10f889c83d08242e0ca4497323477d06ec5885e2886b7d0b8748c5e3c958baa3037", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650624275, "uuid": "bd4ee012-6885-42f6-aa07-09a063f96d7b", "value": "T168450243F269E92BC472C1762645133B11065D1ECA42F78A3E493BB978BBEEC4F846D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650624275, "uuid": "db417004-d4b6-4f3e-b561-a6670c866147", "value": "24576:SKK48kbCIYW7PtwkodVxIlrSiUUcNrN2s8d:r8kbCw7FwkodsrSxx8sw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650624275, "uuid": "94272088-545d-4ef3-bed5-730296aa8657", "value": 1192461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650624275, "uuid": "3c300a31-f33e-4f30-8898-bb563255bfc5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650624275, "uuid": "9b3d9551-10d6-4808-9e92-94ed9580bd60", "value": "3708edcc20d6efd30589ee53373502d016ccbf3be52638b820f8bcbddfb7c6fb.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1e3e444-c242-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1650635198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650635198, "uuid": "cb29e3c4-ff9e-487f-947f-c28bbbdc9fb6", "comment": "Malware payload (AgentTesla)", "value": "a9f513a451b75605c314cc72e7e51929", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650635198, "uuid": "47fcf665-1c7f-4b11-bad2-cb4376ea0e3d", "comment": "Malware payload (AgentTesla)", "value": "38ca85dce6d78cd31902c6f56c2a8972b0d7d7425c584c98b3210a5c75e3c84a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650635198, "uuid": "f1be3cf5-a3ee-4a68-afb4-114e19ed0f3f", "comment": "Malware payload (AgentTesla)", "value": "13d4467b7edcced16139e3c9c01d333f58d19af3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650635198, "uuid": "888c0cc8-c79c-4c67-99a8-067756075afe", "comment": "Malware payload (AgentTesla)", "value": "408faeb24cd78d1ce3a04c3058b7c295d01a5b97a3e67e475dcbbf213cbc1639b0d6f8db204934f42070e677790f99c1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650635198, "uuid": "f0d9a30a-99a5-4c4b-8840-e70dfa03c548", "value": "T1B9C422567BB4DB30D9BCC7F92461058447F1657E6A04F7248CEAD0EB2E32B840E96D93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650635198, "uuid": "c4b719f5-2764-4824-ad3a-d48123e994ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650635198, "uuid": "b4b39197-b307-4430-a8a1-527bcc65a471", "value": "12288:asAYtv/h/9ajQUICNgKfag/YcDOsFV5H0QoOZKRPDtb:nBdh1sdHNgK7/Yq/cGc7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650635198, "uuid": "082a51fc-9437-48b2-9edb-7b0726e270e4", "value": 565760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650635198, "uuid": "4996f118-3421-472b-871b-496b42e5784f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650635198, "uuid": "b1d53cc3-849c-48cb-852f-e8de35a0ebef", "value": "PO121879.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a309b86-c25c-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650646137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650646137, "uuid": "0aa453ad-e4e8-4f21-8aa6-a38b680872ae", "comment": "Malware payload", "value": "dd7dc45de8376c2698113dbd4be04871", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650646137, "uuid": "52eaa1a8-192d-4a48-8f6a-c0507287bf16", "comment": "Malware payload", "value": "394798d971fa676764778cb7bbfd9cc61d9ebe66cf11f7189f19d07cdaac6ee2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650646137, "uuid": "b066713f-f117-40d4-9a67-a50636b5f9c0", "comment": "Malware payload", "value": "e95b756f8fc3aaad93fbb69780ed2facb7b1a2fe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650646137, "uuid": "3f0ce224-f233-481c-8ecd-cb142180ab7c", "comment": "Malware payload", "value": "cb8d28c242362eb001472595039fa9bebeba015d55e58111d53fa7c13327567e71ff06d1de46c5260dafa2a2442525c3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650646137, "uuid": "5168d9c5-5409-4a6d-8b37-a453f936465a", "value": "T10FC412D5B720A197C839013AE8EBCE620731EE275646594363D4BF8B3C73146E92772B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650646137, "uuid": "265335f4-ad92-41d5-b7ac-bc891d899ceb", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650646137, "uuid": "2b362a40-0d75-422f-b337-4257654a9cbd", "value": "12288:wY0FNITxII6IhJJFA35tAkXbmlNKwvJEL7Wwi5Rwb15GFI:wY4gIIphJg3/Aq2NVxMqwi5mGK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650646137, "uuid": "25b40850-5b4d-4775-98d2-85736b8544b7", "value": 557115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650646137, "uuid": "705bc19f-1059-45a2-b64f-43ca733074aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650646137, "uuid": "661b3ddd-8d7c-42f3-962f-f896d1feaa2e", "value": "dd7dc45de8376c2698113dbd4be04871", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f29ea6b-c24d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650639676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650639676, "uuid": "deb25702-8ff4-47d8-9b79-4e65f1d4d4fd", "comment": "Malware payload (Mirai)", "value": "ac837c0dfc81bab1f99af25a6b63f4c0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650639676, "uuid": "e68bd71b-6f46-4783-9c1e-865409a8adbe", "comment": "Malware payload (Mirai)", "value": "399e606265432055158061369ed56ecaca725bb344d4863b3a994d7b81e1cbb8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650639676, "uuid": "cbd6e2e4-c31a-422b-a305-3b2a5980c7f5", "comment": "Malware payload (Mirai)", "value": "36cacd06735f7475d4a5ee4b152c4e63d9f92566", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650639676, "uuid": "d9cc78bd-295a-404d-b425-79c351bf1289", "comment": "Malware payload (Mirai)", "value": "c62c6f33fd7e48b2221e38f83d4e54a5cac365371dfe131f9db9677338ea88791b7899a24038481fab92bef8f63e0c26", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650639676, "uuid": "a5d06977-a7e2-4785-9e59-4564179d2811", "value": "T1B203F18FC0D41D19CFDD4C7D046587A5364488DA2EEF9B8E6344E2CCAE7D20A798D0BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650639676, "uuid": "a6be8d82-1aaa-444f-957b-f7bd6f74222b", "value": "768:ujmKg98v+Aj1Sckj+saDauEe0HBtwg5qMFaplnP4eTUPV3x+fWMg:ulmApSPjvaeC0HrXwsaplweT4+A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650639676, "uuid": "624298e0-8166-44ce-8840-fbf4276f8843", "value": 39896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650639676, "uuid": "8a5deedb-a1df-4ee7-b6fb-5bb6796b2bda", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650639676, "uuid": "d25d4278-e8bb-4d36-9019-80722e0efba4", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a60dd248-c221-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650621031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621031, "uuid": "6aef3924-d070-4b74-bb29-e8fdacf693a0", "comment": "Malware payload", "value": "56894a31ca1b71c612de27e60e84d0a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621031, "uuid": "5619a8ea-a644-4d04-a1c6-dc784792356f", "comment": "Malware payload", "value": "39b7e459e209035e4e6903e31363881cd2439387ccc6df0e48a55b7ea01d8fe8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621031, "uuid": "eb0ed0de-080d-4f5f-97cf-6cc9b13483b6", "comment": "Malware payload", "value": "b24b4db9cc596b0bc652239ad41dfc899a205c0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621031, "uuid": "5aebd406-170b-4573-9994-c230a21d020b", "comment": "Malware payload", "value": "1c858fabebf85f6d6602104e65a3753c8c4785f2c262c4dc89b3b164b1ae045604d71cc38fc2453b024f27e681d5a239", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621031, "uuid": "988c4dfa-5f01-453f-88d4-e755246b1667", "value": "T1C9C54B22F344683FC06F0B3A05A7D6589D3FB7616A568E575BF1184C8E363813A3BA47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621031, "uuid": "5c1252f0-a5a8-4858-867e-cd1190490afb", "value": "36bc2f18c5155dbc981052c93e36f054", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621031, "uuid": "bd3d2ff7-ea42-47ee-8785-152364266a84", "value": "49152:4FEFJdx8qVw9Ak2u1sSpD79xsG1/v19Tu9rlE0x+:4LPAtSHli3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650621031, "uuid": "4af5008b-729d-40bc-a83b-e3a2305b0499", "value": 2599936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650621031, "uuid": "6f5d7bbf-7d3a-4da2-b53b-94e76392e6e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621031, "uuid": "97f932b8-882f-48ec-bb6e-ad1a543b2969", "value": "SecuriteInfo.com.Trojan.DownLoader30.7093.11752.28978", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "061190e3-c250-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1650640949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640949, "uuid": "cd5130f7-5891-46d6-8aa4-32d3ae26c135", "comment": "Malware payload (SnakeKeylogger)", "value": "4eccb5d5dcdbd0b1e19a06a2a3cca3f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640949, "uuid": "3863600c-85d6-488e-9e52-458d9ff23d90", "comment": "Malware payload (SnakeKeylogger)", "value": "39e88a95b6e8f0d336bd95b7c19b66f2a259e05b0aaa71a559db42ebc02e9ef4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640949, "uuid": "03a13d4a-0144-482b-821d-ecdafa80fe92", "comment": "Malware payload (SnakeKeylogger)", "value": "d9f00b44344d42c7d3a96ff145dd80c2676a2758", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640949, "uuid": "eb05bb5e-c484-48e8-ab73-3f1b65399c73", "comment": "Malware payload (SnakeKeylogger)", "value": "ac8e984a727b77be4d8684ab13af7f949e6e220396ea9b536d84e64a972ba801f479a04f1026a536ad2a061aec56e3f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650640949, "uuid": "635cd70c-8920-49e7-bb67-7130f5ed7258", "value": "T1C8F42CD1F15088DAED6B4AF1AD2AA53014E37E9C54A4810C5AADBB1776F3342309FE1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650640949, "uuid": "27dc4673-637b-401a-8871-773bf4279b33", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650640949, "uuid": "18c91e75-622f-4add-8837-9d26a14b6fda", "value": "12288:teAYtv/h/mPmjURI7oEnNoQ9eyq1R/Xqq94qC4e86AY:cBdhuPmeIVnNoQ9eyeVnyFAY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650640949, "uuid": "ee9e1fc1-5d92-4277-a20a-4052d483a106", "value": 768000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650640949, "uuid": "6d68191a-8ce7-480d-a237-431cce17ab9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650640949, "uuid": "0f546682-c7e9-406b-8a2b-1bb410d7885b", "value": "CSAN \u00d6DEME DEKONTU 22.04.22.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "916e7cae-c221-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650620997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620997, "uuid": "e9bfbf29-3368-4267-87ad-cd0aad4e4e0d", "comment": "Malware payload", "value": "3ecaf68a364a7108ad4fc4907cab8801", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620997, "uuid": "8bae75dd-bdd1-4fea-a51a-d8ddc83eced2", "comment": "Malware payload", "value": "3a52555e656384240b4acb103a285c27aae7e575f237f8b6ce14a9a58e600248", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620997, "uuid": "4456c9c3-4eb6-4f70-9d6a-fddb21341ee6", "comment": "Malware payload", "value": "0ed912f6571525fd33358993a3802bcf6fca1a77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620997, "uuid": "016b38aa-3453-4a12-bc3d-e955c398b0d2", "comment": "Malware payload", "value": "94dfa6361552496adad013851dc747b09e660ba2fd00222c1a8dde5a4cdfadb307c3ddc009082350f46f62cfb040fc70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620997, "uuid": "f0368b5e-f52f-493d-a16b-6d2391ad8148", "value": "T13BC54B13B244A13EC06B0A3B597396589CBFB7626656AC475BFC098DCF351813F3A60B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620997, "uuid": "92f44872-bbce-4405-b10d-47e073006d38", "value": "274b2dc147734c8a2ea7981185d2b932", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620997, "uuid": "0dd4a10f-378a-48cd-bb59-0fcd38a0bfd3", "value": "49152:eamNPbqnBhV6S6WCLlhrFA6C+qTqhHN48:ea10nFAt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650620997, "uuid": "f5c19dbd-ed5f-43be-9080-2d12362bc6bd", "value": 2604032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650620997, "uuid": "7b71e4aa-8b03-4a93-815f-cc376519f9a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620997, "uuid": "59c399ad-ad60-41d1-ac74-f33bc3008bc3", "value": "SecuriteInfo.com.Trojan.Siggen8.36802.10104.26783", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "830c2267-c221-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650620972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620972, "uuid": "d269f517-10e5-4af3-b5d9-ff6c99c3e856", "comment": "Malware payload", "value": "fdfcbfd099a9d6a2de4d50feebf7c2d9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620972, "uuid": "6d94407b-b948-4b93-9699-73e500985f16", "comment": "Malware payload", "value": "3b0e865648ba891122bd10d286964a6d355c69cc1b5086eb8fc47121e5ab2ee9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620972, "uuid": "09a4a9be-194b-4140-b63e-627b7910c02f", "comment": "Malware payload", "value": "fc892e1b38db867769bff736ac2d3b8be93c4d11", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620972, "uuid": "4b9bd5e4-0e7c-4c8f-9dd5-0a73bdda94d3", "comment": "Malware payload", "value": "42254e157125eecf28a5d86a2af554e9e53e0b243355c7c24d89ef8b62d6d43ec581dab328f7a099f4bc29ea7d8e54eb", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620972, "uuid": "365ce49d-0a70-4a43-baaf-f0086d30fcc8", "value": "T1CC064B23F248653ED4AF5A3E4977A258993BB7722D238C5B57F0088C8F394416B3E647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620972, "uuid": "58d23997-546c-4885-ace6-fdd66e786974", "value": "b3da988a833ea84edf7f6632a86e7fff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620972, "uuid": "fbc6af9a-d698-4499-b232-b4abdcda1754", "value": "49152:4lAbcS8EvZYSGZC7IeLkNVp3Mkn6KEMBSw+RUecT7uQH1Xl:48DYt3bn6KZDcA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650620972, "uuid": "cdc1fbe6-b485-471e-8dc8-02c374308e89", "value": 3743744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650620972, "uuid": "c257f231-c61a-4839-b87e-18559cab0f69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620972, "uuid": "5cd48c82-9118-4968-9690-c7dfaf8e05e7", "value": "SecuriteInfo.com.Trojan.DownLoader44.47434.13400.2973", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1209cad1-c20d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1650612193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650612193, "uuid": "fe56bb55-cecd-4cbb-8b32-cbe297dd952a", "comment": "Malware payload (Heodo)", "value": "777638447ab65c4e460eee688ca0e861", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650612193, "uuid": "cab382a6-d55d-484e-b6ea-9635c3ce92f7", "comment": "Malware payload (Heodo)", "value": "3b304b5f778d7df3146ac41a15fd2b0607605d9e93a9ab5726fc7aadccfd309d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650612193, "uuid": "e9ad0fa2-46cf-42e3-a572-bce7033a8172", "comment": "Malware payload (Heodo)", "value": "9bb029100f77781dea1465c757040f7307acef85", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650612193, "uuid": "a06b1fbf-228a-4d66-bdb9-7761dd311308", "comment": "Malware payload (Heodo)", "value": "6747674ac6f4b01e6ef66ead13beb078c4697dbe9ecd429c2d39a4dd0191fa4aa54af84bf34c7c0051decac4c04b156f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650612193, "uuid": "336fb7ce-8890-41cb-b441-b140ab0e4611", "value": "T165F4AE123193C075DEAE02744A526BAC6AE9FE145B319DD3ABB0E73CCD319C68B31257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650612193, "uuid": "10499d7f-2635-48ff-88e5-33530bda0882", "value": "078cf8e17700d87242408b8588acd2dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650612193, "uuid": "48b01a63-e785-4d28-90da-388b2ea6e96c", "value": "12288:y7pLgbqIjZbLqHUMYbwyYdrYj2azO8BOg1s3F2r/:y7svq+rAYtzbO53F2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650612193, "uuid": "b38d32d1-4bfc-4169-b144-b2d3c330b22a", "value": 786432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650612193, "uuid": "5772b606-fe7a-4b99-b9c5-4276018295fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650612193, "uuid": "ee5c5fb1-7ceb-4ad8-9392-909725743c8f", "value": "emotet_exe_e5_087b78e00d06e2427331ca5a34f0f1cecc64bcf91a1f8b116cf2f8a08ddd9055_2022-04-22__072308.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "840607c3-c221-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650620974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620974, "uuid": "18fd6e35-b858-4bc4-914a-cfe2ea7b303e", "comment": "Malware payload", "value": "fadfc8130cb6038b6a51a3a7dca8b78c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620974, "uuid": "53958207-bf56-4675-b9b7-d0c3f67ed938", "comment": "Malware payload", "value": "3b33fbf2cba1fac1702e93a2b881c109466b749211cfcd491b81fc488b4952b9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620974, "uuid": "97eadef1-52de-4c50-9d53-89c5a3717836", "comment": "Malware payload", "value": "a91b5e30dbff2f3ae142ef353508f5baa0bb20f0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620974, "uuid": "3fdf686b-2211-4c1d-a136-a2634d9815ee", "comment": "Malware payload", "value": "04113772be2639c295b7f21a6461b1c939384a0539a2e7002a12863cce5d801658c4932d0be27140fe5b379e79653d16", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620974, "uuid": "aaefbfff-79cd-4571-bda0-7b7785072255", "value": "T1BF566C13B384753ED46F1A3A4A77E654A93F7BB13912CC5B67F0088C8F358816A3A647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620974, "uuid": "32a6e8a5-e4a7-4f03-b7d4-088aa6de9311", "value": "7d0b3b4b3ad6e9c730c97c285f4f23cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620974, "uuid": "45e5eb7c-e884-4c67-b113-fd2d46504562", "value": "98304:FS3gdtuydiQEurXgpJRHvzqRFeUNdbf8:YgdBrbRFemFf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650620974, "uuid": "a8752fe1-411e-4e92-acc3-9effe8010db9", "value": 6019072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650620974, "uuid": "45f3a294-ad26-4eeb-bd8a-df3b748a6d19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620974, "uuid": "12861061-f17a-4094-803a-a6cb49f2c8e7", "value": "SecuriteInfo.com.Trojan.DownLoader44.48340.22294.1964", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb847f2e-c258-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650644716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650644716, "uuid": "d127fb41-45d2-4bb9-9e5e-ef3d69616c22", "comment": "Malware payload", "value": "9927bbd57f2f01134d858fbbbdfd5de2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650644716, "uuid": "ca1d8c54-567e-4623-8f72-dda78640571a", "comment": "Malware payload", "value": "3bfed4fcb6b7d3d18285938b2cd00c8a5462931dd29d6e18c3f35e54dcef431e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650644716, "uuid": "c80dfe4b-c867-46e9-9548-f2d30569c49b", "comment": "Malware payload", "value": "4f412674635a51d254ba4a5b1fd325d7f8384425", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650644716, "uuid": "d6f22f42-4f50-49db-9f8c-f283c268c9b7", "comment": "Malware payload", "value": "b3cde02fc9c6071a687d4ce0a3245188302d9c7336d18cb26d91595cf9e0533c138c75fa195ddb6ab5b54fd0766afaa2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650644716, "uuid": "e455dc4d-0611-421f-953a-243a9950cced", "value": "T17CD49D11F6AC80B5E07BD13DC9A3875AE6713C9847B943C79255EB2A2E736E05D3E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650644716, "uuid": "0825e212-a7cc-414e-8750-f7338631ba7d", "value": "6ba79cbed2acbe9b8ecc8e14a572f100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650644716, "uuid": "dc5f69f4-5b85-4c1c-9f5b-44408696a07e", "value": "12288:C1FIcocJwMTHzXO7N2NBHiyzskF1CubVnmn:tco9MTHzXO7Ng/115mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650644716, "uuid": "53c2c5dd-8308-4d90-9a82-f8eca5dd68cf", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650644716, "uuid": "4458d88a-b9b7-410c-886b-e86ef8faadd8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650644716, "uuid": "990c4d34-bec1-4ecd-9335-a3af163b2469", "value": "sample.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a65710d-c239-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650631212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631212, "uuid": "b2b80ec3-0b78-464d-adbd-68fbeba5b0c6", "comment": "Malware payload (Mirai)", "value": "b3aeaaad617449890812520059243d00", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631212, "uuid": "021da7be-56fb-479d-ab72-789cb812f2b9", "comment": "Malware payload (Mirai)", "value": "3ccdf2519f6477d5739d2200f3ad12a6bc09111087cc0b5ee33124baf56af731", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631212, "uuid": "96f97d64-5adf-4c08-90e8-b49fc155c637", "comment": "Malware payload (Mirai)", "value": "9853f3a9309f2fa5b4da0d08aa58e89497520d30", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631212, "uuid": "7a4a2ccb-63b8-4d75-b421-f963cc6e85a0", "comment": "Malware payload (Mirai)", "value": "a01b172ace5f364c75ee5558714f4b6e25b04c9fe11dbeef565aceec37c35ecf6927eeb4fb1b8d07033b913b453b8792", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650631212, "uuid": "ed4a8d1d-a222-4350-8a62-50336a76fb30", "value": "T1A2933C42E602C5B3C8430BB2029BAB565931BABE4D6B9F46F32D7DB0AF124D53117F91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650631212, "uuid": "81525c26-4c8f-4ce6-a324-ad6ace0693f8", "value": "1536:Ftwaqefv1DlHmrMQwxQPecwWK8zP4x5hunC9JrmF+wVOz+sXcfW7k:5qefv3HmrMNxQ39hzM5huIJrmEwVOz+V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650631212, "uuid": "6f5095eb-94bd-4a36-a668-1277ce5a3eaa", "value": 89376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650631212, "uuid": "5076fa56-246c-481c-ac08-53cd7bb83829", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650631212, "uuid": "ed443fff-9d86-45d0-bbe2-6917a65b0488", "value": "b3aeaaad617449890812520059243d00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "380b15b1-c1ff-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1650606244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650606244, "uuid": "7f1fbcd1-dfb3-44c7-8c39-1e306baf77ba", "comment": "Malware payload (AgentTesla)", "value": "6dbff15fa47b414f237b69e25809ef44", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650606244, "uuid": "edf1a65a-a40b-494f-81f8-3f2a250208af", "comment": "Malware payload (AgentTesla)", "value": "3d1384e2e34bad9fc2a6d1d18db8be4392fcec732a92be164c1f23ae18a00a21", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650606244, "uuid": "e08f5835-7a1b-4a2d-981a-eaaba7cb90ba", "comment": "Malware payload (AgentTesla)", "value": "a8beba2362ec66943b23bd1a25c4ebb9d1f21287", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650606244, "uuid": "effb79c7-1385-418d-8e2e-415e589a500d", "comment": "Malware payload (AgentTesla)", "value": "a26b5b1cbead8e467f0ce72e48d2a8ade78784f5b6d416c855689c88a3026d6bafc057e59b00f83d8805bfdc2483a8f3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650606244, "uuid": "1a9a641f-ee63-4307-8633-01c5b1184d24", "value": "T184B47C9C395171CFC49AC972C9D5DDB4BA6074BB470BE387B0834BAC6E8D496CE006B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650606244, "uuid": "dafda159-a7e6-4852-8dc9-730fac6feff9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650606244, "uuid": "5de77b33-ff0f-4390-91f0-0beba6a585f5", "value": "12288:MmX9acfC0KB3FsBw249L9q9owpLqKJChjzp70uhP7Jrx:MpslgKh4hPoqKJ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650606244, "uuid": "d06c772b-d5dd-4028-90a5-d6c60d688fbe", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650606244, "uuid": "4b96a7e4-7ac3-4353-a089-132caf495625", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650606244, "uuid": "493f155f-325f-4b83-8b8f-97ee7776306b", "value": "updated SOA[K9DMVRKF].exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "221e48e8-c207-11ec-8e58-42010a9c0032", "comment": "Malware payload (BitRAT)", "timestamp": 1650609643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650609643, "uuid": "d7b15066-f57e-4561-ba46-a2c623b13919", "comment": "Malware payload (BitRAT)", "value": "5273640b8fde26a5c33388c7ab1aa8ae", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650609643, "uuid": "ee1f12f6-a69e-4c1b-b6d5-166ae98e107a", "comment": "Malware payload (BitRAT)", "value": "3d5194f12c6b21b79d636f65e29f308aad0bfdd1cd7e00c54cb8488b1867ff9f", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650609643, "uuid": "d7342864-4783-4d22-a45d-a87b75cad578", "comment": "Malware payload (BitRAT)", "value": "baa1ebbbccc04e740024222633115ff465ab9105", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650609643, "uuid": "8bed8e71-adaf-464d-ba0d-d2537da9276f", "comment": "Malware payload (BitRAT)", "value": "0a71f61529835a77ed8096829bb459138ed7aed44a856c02004123074113c5d10bf0aba6b518c1ad02a74d3de05b37e3", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650609643, "uuid": "fcc733a1-00f9-4df6-a7e8-08fd2e4ef4b7", "value": "T14223DAB1F208A291C61B8BB3885A9D2056B37DDE98F0C91C34DD71596FB33960097E5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650609643, "uuid": "e7bd9d16-acd7-4bf3-aade-4dabf81ca45c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650609643, "uuid": "0766ea99-56b8-4d81-b2a1-e38d19b5b109", "value": "768:kM3w8LeuBWTJiqrmehiVqrmaB33LV98tYcFmVc6K:XgNkqjhvrmK37XAmVcl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650609643, "uuid": "05c94395-e352-469d-a6b8-06984cfb792d", "value": 49664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650609643, "uuid": "206f2dc0-4293-4ac0-b77d-379eb3c57a0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650609643, "uuid": "4b128b3c-97a2-4c67-aba1-1e7dc41c1504", "value": "3d5194f12c6b21b79d636f65e29f308aad0bfdd1cd7e0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3d14791-c236-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1650630047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630047, "uuid": "74cc3220-5a01-4561-8832-174c7c280fd3", "comment": "Malware payload (AgentTesla)", "value": "951ac550bfdfcd7a16f05d8945734081", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630047, "uuid": "4b43d9bf-8895-4df5-bea6-09335d71b4d2", "comment": "Malware payload (AgentTesla)", "value": "3d63473d091ac6b7175c649799be9a47632995f4993bb2af3c30630cafff6fe3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630047, "uuid": "4358db9d-29aa-4761-a4d0-ae1006551afc", "comment": "Malware payload (AgentTesla)", "value": "4f916051a5a1fcbeb36f7bd2e85c967424690aa0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630047, "uuid": "18044f32-4b7f-4646-a97c-f35c65a2ab21", "comment": "Malware payload (AgentTesla)", "value": "17e2c7605a5edc862d0e9de2b18d5d1d6709c1f5e4bdae905dbebe79c3fc03146539ca453a35bac5afc822dfd66df3ce", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630047, "uuid": "75904b34-4af2-4a72-8e4e-eeaae37ee73d", "value": "T190D4121A32D48B28C4DF17FAB430515B577AB713A123EB089ED025DF6C923C1A625B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630047, "uuid": "fa8bd0ab-b0bd-4b08-84b3-207d2bc683cb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630047, "uuid": "d8aae211-1cfb-4b61-b792-bc6acba27d14", "value": "12288:50ju3zlFnUKkhaegnMADlwkfDh/59vyKKB7:cu38Jgn9DlwkfDheK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650630047, "uuid": "d90a651a-b0e1-47ca-afca-64b5e500a01e", "value": 624640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650630047, "uuid": "9fdda77a-59fa-4209-bfae-67b4f0c8e735", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630047, "uuid": "852021f0-304f-404e-9cad-cfd5286b390d", "value": "ATXMEGA256A3U-MH.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e8257d1-c205-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1650608858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650608858, "uuid": "5d170657-f9de-4060-9d1c-4796a62f855d", "comment": "Malware payload (SilentBuilder)", "value": "007a0b580a37ea63301802fda0892664", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650608858, "uuid": "4734a846-b686-4b46-8d86-d6cdbcdd8668", "comment": "Malware payload (SilentBuilder)", "value": "3d7dae39c614549ee1d8f8e6907316cdf8bb2b7af9993aa23fe2582b68522833", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650608858, "uuid": "085ebe6c-2d9a-4ada-aaf3-4c4ea04fd500", "comment": "Malware payload (SilentBuilder)", "value": "8aca1bd1719e8792f451399270d0348a2cf9eb5b", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650608858, "uuid": "aa8623d0-c9ad-41a6-9e87-f8f9f76bacbd", "comment": "Malware payload (SilentBuilder)", "value": "e5ca49dae9c779e68f7bd5e224ca9d33aebb7ece267a542806ab30e7c38d653919740559a0363078e5f758d6c5cc969f", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650608858, "uuid": "bbd56bfe-2cc7-4e27-9e43-3f82275560fa", "value": "T10C23B756BA5D9899E9258B3548E743E9B333FC205F6B0B833616F3257FF49A05A03207", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650608858, "uuid": "c624ddca-cf82-4131-9b6c-6d9f31bbbc1c", "value": "768:yDM52tfQXi8vgLZkTOHkQT51Vp6AwPdM8gQ6JOiX6DGwUk7qHDSEuRZjiBp5X:y62tfQXi8vgLZkTOHkQT51Vp6AwPe8gl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650608858, "uuid": "a4e711f1-6aee-4046-a330-70b1f5812edf", "value": 48128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650608858, "uuid": "96db403c-aa6e-47f7-ae6a-9bc1e7e3492c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650608858, "uuid": "a73a88d6-c5dc-47fb-badf-e3652aac2b3d", "value": "919313759226634,XOpec.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73087cf1-c248-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650637696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650637696, "uuid": "7d66013c-dbea-4dad-b0a2-eeee39a4a4b5", "comment": "Malware payload (Mirai)", "value": "48699c0880d8496682855cebb78c0335", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650637696, "uuid": "4f2b3144-088a-45a7-9173-92ccb05fefa3", "comment": "Malware payload (Mirai)", "value": "3dc0abd20e11339b087ed1d5517390bd41c58d8aac84f6ce27ba0e67dd442195", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650637696, "uuid": "ef33a24a-1532-4412-8b18-92935d17cd05", "comment": "Malware payload (Mirai)", "value": "138b6efd76e1d7c95e680c0d71ed8a7afc62f16d", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650637696, "uuid": "f95d7ca9-683d-4b59-b457-349ecec5e010", "comment": "Malware payload (Mirai)", "value": "35aa75eac538c73eb659bad9b6b4dde3c437f2dce19055ba717c2387dfd4426f058275d1b7dca217ecdf9acf7f38234a", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650637696, "uuid": "4bf04a0d-3b91-421c-b52b-9d59909f27aa", "value": "T1A0935D27B552C6BBC08752B42BDFEA615833B4BC0B32720B33D47DA52B259D91E6DB01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650637696, "uuid": "ff213828-62ea-457a-808d-3f4305a8807d", "value": "1536:W7uJtxNeVE8zV7aDlvhE1hmkJ0S36W6bWjK3DyPXfH0mA+KWOXFseaZYxe:4SsVEeVMlpmXJ0O6WpjKzifUm/KWOXFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650637696, "uuid": "4f91327b-836f-49f6-815e-e01d44b73d69", "value": 94679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650637696, "uuid": "1c1b1578-d9db-4694-86ce-b03694d3c4b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650637696, "uuid": "d1f9413e-9828-4c73-b8ec-fc51578e5453", "value": "48699c0880d8496682855cebb78c0335", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51a004e6-c204-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1650608434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650608434, "uuid": "55323396-979d-4c83-b08c-89ba7d1922e7", "comment": "Malware payload (AgentTesla)", "value": "7422efc54172b8dfcca9bab5888b6c98", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650608434, "uuid": "19efaabe-966b-48a4-a24a-912bb46b8527", "comment": "Malware payload (AgentTesla)", "value": "3eb56ba8a7d8af945a67bfa7549469e488fd43b2bda1f8c271ac10d64a17af66", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650608434, "uuid": "0ec28022-4c8a-4e82-a075-a79c3d29bd94", "comment": "Malware payload (AgentTesla)", "value": "031d66270a8eab2524909053cbe931a0930ed019", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650608434, "uuid": "a2bf8b8a-90b3-4fad-96c3-151dca95b521", "comment": "Malware payload (AgentTesla)", "value": "19c73284d800067558d4fac5a433a5de34d5a9643769e3d173fad144161b2bd9f38047b80a85511197f9fe1c8e06bf71", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650608434, "uuid": "b5733bf8-f71c-47ab-9251-5c1984934453", "value": "T186C42383CCEDE8C9E115FA9752004E58EA68E9DE23337205D4E8FF559525B2C0627ED3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650608434, "uuid": "49b40285-c64b-4ffc-9662-c1a39034dc6d", "value": "12288:TACm0Q1SwgSAWZWWhrmSgnjVcYheP5bQRKUki3w+lbne:jQ117HWWhrCnZpHRKUki3l1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650608434, "uuid": "dbcad46c-73d7-49f5-9756-17d4ae6b6337", "value": 563114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650608434, "uuid": "fc6fc31d-7aed-4465-b0ac-8a54e0845199", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650608434, "uuid": "95d68a37-5537-4ecc-9159-4e00ddbd1593", "value": "payment advise.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85beaf7a-c221-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650620977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620977, "uuid": "b95301e4-5896-4bcd-ac33-fd6c4e4984e6", "comment": "Malware payload", "value": "97ac9dd54e23dbd11b70957299bfa880", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620977, "uuid": "394310ab-7655-4a47-9067-1d312ee628b8", "comment": "Malware payload", "value": "3fcdfbab84ee1f633f5bf3dbf71b3d0e067ef2eacd980b1262ddbd754a7bb7bf", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620977, "uuid": "af9b16a3-0bca-4f20-a36c-d34abf22b919", "comment": "Malware payload", "value": "5c88271e280940b4f0b846a8bd13218f4a6b927d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620977, "uuid": "f54c8d7a-891f-4cc2-8f4e-072195903a36", "comment": "Malware payload", "value": "797da1affa4f8c0d378c0d006ca309b1fa49d166050e4c5cd94512c7d5d4a9f25128bb93e201605e325fd992e69d5f33", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620977, "uuid": "69dd57e3-13e6-46dd-a9bc-1b0c76110324", "value": "T1DC066E23B284523ED0AB2A36497795945E3F7F7139168C0F5BE4394C8F35A406A3A73B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620977, "uuid": "bfa28cc1-f31f-4d2e-9475-1461c8934130", "value": "754e31f3b1866bfa1bdd824e474efe9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620977, "uuid": "53f6b06c-8bcb-4dac-9a41-62051d857b32", "value": "49152:0/9WkVwumQ8D3ZjUkKd3ho7XapMd9YS/cebslHxra2BO10XUTPzBzL7+KD0TTpyL:0/97Vw9aXRraN0cCKDi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650620977, "uuid": "c4689e9c-79fc-485c-a4b6-ddaad6ae16f1", "value": 3863552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650620977, "uuid": "17b9396e-493c-40f0-9da5-49eaf43764b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620977, "uuid": "2b969005-7486-44a8-9d30-d4eaa556a9d3", "value": "SecuriteInfo.com.Trojan.DownLoader41.15076.16474.21723", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd69d0fc-c236-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1650630090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630090, "uuid": "758292b5-e7d0-4cd6-96da-25979f63d5be", "comment": "Malware payload (AveMariaRAT)", "value": "660e336ae15461b2b78318e1991c2602", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630090, "uuid": "f6b4d9a4-9075-4a4e-8aab-2e59ed906d89", "comment": "Malware payload (AveMariaRAT)", "value": "3ff19b47194fe17cb6ca63ffb6b2f30e27b0c306d6645c0b9fcb8770bba157ab", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630090, "uuid": "6dd6abce-a546-45f2-ad5b-59c0569681d7", "comment": "Malware payload (AveMariaRAT)", "value": "0a7f25058b2f65fa900febc6b57f6e6dbb4bffd1", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630090, "uuid": "4772f4c2-37f2-404a-b589-764da41ab8b6", "comment": "Malware payload (AveMariaRAT)", "value": "97829ba1535f7a8ebb7a1b7f147f13b2bd3242fc53b0378142e718d3e9de8ad61ce9029d7b09fd1736d6355023617d47", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630090, "uuid": "16eb027f-ab33-4916-a7e4-72a3ef0065ea", "value": "T113358E12EB485433C4321E789D5F97B85826BD01F92494462EFA9D4CFFFA7C23929683", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630090, "uuid": "1f4c7d7b-f2e9-4e92-aae7-32b46b05a806", "value": "d4cf2d38c8388bbe93ed7c0af7fb2d41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630090, "uuid": "3de3e929-cc2a-4d75-a09c-87c3545c3d5e", "value": "24576:NODWeYzvYu8Qtm12YI/vrnqpM5mxY5pIOBz:NSWNcY3tl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650630090, "uuid": "13c52b9c-03b2-4cfc-80a7-0236823be1d5", "value": 1064448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650630090, "uuid": "84074fa8-b703-4ce8-aa1a-e05ec3dcc99e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630090, "uuid": "eccd8463-98ca-4dc6-99d7-ff4bb7f140c9", "value": "Popis narud\u017ebi je u prilogu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "952dc0f8-c214-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650615419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650615419, "uuid": "200af2a4-eac2-4969-8d2f-18ba73d1acea", "comment": "Malware payload", "value": "7757acc1ed99ec1b849790770ee31e32", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650615419, "uuid": "c1918c66-e87b-4d92-b735-69699b6714a7", "comment": "Malware payload", "value": "3ff71627a708bf44e55cbdbabcd86dfaa631ae040466d7dfb6cda0fa2afe41d9", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650615419, "uuid": "6cdf19d4-66d9-4637-bb58-6be9a97ca6c8", "comment": "Malware payload", "value": "3050253c1e2a31f24915c29cff62ce61ef64e2f0", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650615419, "uuid": "dc90ef77-7280-4577-88cb-3d36e24d235a", "comment": "Malware payload", "value": "6549fdf83edd3523859e443330921f06b2a163bdc3f8aed0707d9ce95b022ab8268aa4c780776afac0a61b648e44f652", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650615419, "uuid": "420773ed-c424-4601-a82f-ea4f62dd0afd", "value": "T14D55E05DEA58A633C2EB0FFCD2E3824446AC5FE16550D31579983FCE3E33B846861A16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650615419, "uuid": "ab770e7b-b5f5-4b9e-b3fd-301e40dc9593", "value": "12288:+zvVliPFrR5OwwxRnhoFvvW5PFK/f6C6r6u0tqtIFrIq0:+zqPh2wwrhoEFK/iC6GujtI2j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650615419, "uuid": "db829d22-f21a-48ad-ae2a-6f73ffe297aa", "value": 1310720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650615419, "uuid": "e5ba8e46-8fb7-4cbc-a520-5d41a9766f73", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650615419, "uuid": "8fbfb13f-ffd5-48d9-9419-7699e58a4bec", "value": "20220421_NEW_PURCHASE_ORDER.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf6153a7-c236-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1650630093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630093, "uuid": "8d3eb00b-31eb-48e1-945b-8451a2660249", "comment": "Malware payload (SnakeKeylogger)", "value": "cedf8b47c23062eeac8d79151135ccba", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630093, "uuid": "41fca034-f025-49f6-b706-47d3a83791d4", "comment": "Malware payload (SnakeKeylogger)", "value": "3ffb6e1dd7e1032ef2515b30455a9b2ed1f01b5db8b5f464a1e5afc68db95477", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630093, "uuid": "ace03038-f8a3-44c5-b4cd-d297df23fcbf", "comment": "Malware payload (SnakeKeylogger)", "value": "f2a185c33e2e85676f7cdb1cbf1d6e8b79cca667", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630093, "uuid": "69c163ae-268f-41bb-a8cb-b649a710b264", "comment": "Malware payload (SnakeKeylogger)", "value": "abebed2fee2c160046c897dbc532e61c5f34eb5d134acf3ee59f4ffde9ac26d6799dc7ecf15d55983393ba8cbae08fb5", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630093, "uuid": "fe56f5e9-4aa7-4f22-ad7a-92cc24dc08ac", "value": "T1C6A423A40FC87EC950776F393C4EDD8A62A75C029604E4C6A1C6953C6700FBDAADC6ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630093, "uuid": "210fe45a-2a54-4284-affc-02e57a328623", "value": "12288:gpmmIgG78ea+si5Tx6FrIY43MnIS+NlVk96Oy5Hcj:gkso/sQ74+NluwOeHm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650630093, "uuid": "c4dee19a-1a26-49dc-b9a9-d8572b29f159", "value": 481395, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650630093, "uuid": "06829d12-c36d-482d-ac92-0ba362ec773d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630093, "uuid": "f8aceabe-d625-4962-bfa0-a168ac633e87", "value": "Ziraat Bankasi Swift Mesaji.r19", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5166a5d-c236-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1650630049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630049, "uuid": "7d7bc17c-a81c-40b9-b613-159db58d2f07", "comment": "Malware payload (SilentBuilder)", "value": "13f97d640e7278c655896f450e26268d", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630049, "uuid": "7d7fca4a-7433-4792-a9b0-f5bd186661bf", "comment": "Malware payload (SilentBuilder)", "value": "401c195e8bc844697a84cf7f13982b4626d64647e6c6d6128e8b09423f678293", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630049, "uuid": "24160054-a621-4da4-923f-6dab00bfcd9d", "comment": "Malware payload (SilentBuilder)", "value": "b146575b2b1953c12d9463932d43a9b1847792b3", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630049, "uuid": "71618e29-76c8-4718-b23e-b086485a8818", "comment": "Malware payload (SilentBuilder)", "value": "5bd658883c245f40f74ed5bf0923537986996afdf25538613019823446e4951089646b9eba3847aa5116aa1d06ed11b3", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630049, "uuid": "1433913a-f47c-4fd4-8838-ad8c20f24593", "value": "T13223B756BA5D9899E9258B3548E743E9B333FC205F6B0B833616F3257FF49A05A03207", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630049, "uuid": "95bc6f8a-9f07-408b-b903-5c5e7e556c2a", "value": "768:yDM52tfQXi8vgLZkTOHkQT51Vp6AwPdM8gQ6JOiX6DGwUk7qHDSEuRZjiBp53:y62tfQXi8vgLZkTOHkQT51Vp6AwPe8gF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650630049, "uuid": "e744df93-bd7e-4c5a-b3bf-caca17824c50", "value": 48128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650630049, "uuid": "4831e270-5453-49be-8118-8d5b39f2b976", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630049, "uuid": "00feca73-5a8e-48c0-b344-e0b436376f29", "value": "Bill address change.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b385374d-c1db-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1650590989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650590989, "uuid": "89c89a17-2c68-43be-a099-c80856b27ae2", "comment": "Malware payload (AgentTesla)", "value": "08f915901007f0f7418870ef3fc0dd11", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650590989, "uuid": "aa9d0b8b-d885-4218-bce1-e223c19e1435", "comment": "Malware payload (AgentTesla)", "value": "403eb94810bc19fbfa5e8e54e5c9ca8c78138e3622f1bf760f350f5d9c8c6594", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650590989, "uuid": "76594efd-f26e-4b0d-b14c-7dae3a139894", "comment": "Malware payload (AgentTesla)", "value": "d73b9d685fc4d006e554ae0bd88a29f1b5fb9aeb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650590989, "uuid": "bfa243da-0e86-497c-8dcd-d57e0f9a2ec5", "comment": "Malware payload (AgentTesla)", "value": "92867d0734145c87c0be7e856cd63647b224651cc1b26b8ccddb985abaeb3b279fe7e0c0079de2849580915143be9e45", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650590989, "uuid": "09499996-c9ce-4f8c-8185-bb0da617ff64", "value": "T1B193D041AB944569EA3F037704174B418332DC3B6A6AD67D78AEB45A2FB334201B7F1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650590989, "uuid": "7d14e5c1-3e48-46ff-a534-32c59399f12e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650590989, "uuid": "7cbd7304-962e-47f1-8733-a7494721614e", "value": "1536:Ln7neb5ozkdGVzZhq3bC2aTEW1MDEFSAY1JjAxqydqSz0tO702OI8fXgUmVcl:PnUWwdeI63MD/AY1Jjwqy/kX258IU8Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650590989, "uuid": "a7996d7f-77b1-4714-9824-74f9627faf93", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650590989, "uuid": "76d65ada-717f-460c-bc67-c37ae7fc7e83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650590989, "uuid": "08c12b76-c267-435a-8819-c572c834d543", "value": "SecuriteInfo.com.Variant.Strictor.271466.18986.25316", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ff6a90c-c272-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650655703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650655703, "uuid": "98826a55-317b-4902-8a40-4284da60d7d5", "comment": "Malware payload", "value": "b91005dd28754d3acb5525def8baec5d", "object_relation": "md5", "Tag": [ { "name": "ContactForms", "colour": "#70123D", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650655703, "uuid": "b17b5f40-38ba-40a2-8cfe-0a2146b7be1d", "comment": "Malware payload", "value": "4074e1405cb68cf9a598de8e801259705249ee0386c4cd87f9dffec90dd0bb7c", "object_relation": "sha256", "Tag": [ { "name": "ContactForms", "colour": "#70123D", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650655703, "uuid": "8f1cad1c-c29e-4a2e-b4d7-657ea32d0a6b", "comment": "Malware payload", "value": "d67af7cb18b63cff5cc5355d57e4435c4a1cd987", "object_relation": "sha1", "Tag": [ { "name": "ContactForms", "colour": "#70123D", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650655703, "uuid": "a4d7af9d-7e83-40e7-a841-6de6746b851b", "comment": "Malware payload", "value": "3a264536dfeea70b4c24f5562474d44d75050ae4ebbe510ad33c62b301e4dfc81b80a6d4675a0495834bc172e11593f3", "object_relation": "sha3-384", "Tag": [ { "name": "ContactForms", "colour": "#70123D", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650655703, "uuid": "b3e05e35-7ac5-4bf2-ac35-2d5ef7290602", "value": "T1A4659E7CB60069D2E56F437AD99B7CE923B277529B8798C841B46BC20DB3331FE1A504", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650655703, "uuid": "762244fd-0601-4b81-83b6-408d2cc82857", "value": "6144:YoV967Vth96kGrMVpdoJqAIc4gJmaAqTc5YnEVwM8JBjqACgYZ5g0:Jj0Z48pd//emaAl5YnawhBO3ZC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650655703, "uuid": "7c63ac64-6916-4fe0-9e30-d138d98c69e0", "value": 1507328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650655703, "uuid": "2331b993-0ae0-41b1-8215-a45642ab75e9", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650655703, "uuid": "fce7ecee-cc1c-4fb0-8b8e-14aa857ac03b", "value": "StolenImages_Evidence.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e30a4e3-c260-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650647862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650647862, "uuid": "62a1e962-5379-426d-95e5-732d1b99cc7f", "comment": "Malware payload", "value": "7201bcdd4d7b48fbebe2effeec5ef469", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650647862, "uuid": "3be0a39e-b2ec-4644-a506-865457f83a5f", "comment": "Malware payload", "value": "40ad70f485c5cebe087a1413137c2e461a328ae5d4ae9b39110a049b80836a67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650647862, "uuid": "3fe8d1bd-539c-4eca-9c4a-c773e23f67c4", "comment": "Malware payload", "value": "ca8311f8a53583cb1246904210dc8f5960d691c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650647862, "uuid": "75ba1429-fbc9-4975-8d3d-2c058aa06fd4", "comment": "Malware payload", "value": "227f5ba8fdab2ba6bea74f3d08c1bc652a1ecaeee9f5cb4ec0a7b9009f59fe02756d928652591450cae56325ec0dc315", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650647862, "uuid": "d00b8c22-de17-4f61-a89d-fa27df66fcb1", "value": "T126D49D11F6AC80B5E07BD13DC9A3875AE6713C9847B943C79255EB2A2E736E05D3E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650647862, "uuid": "3e12afb9-db01-49b0-9193-8ae06f99975b", "value": "6ba79cbed2acbe9b8ecc8e14a572f100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650647862, "uuid": "b2347c44-c76a-4eff-80f1-d9f18f230c8d", "value": "12288:C1FIcocJwMTHzXO7N2IBHiyzskF1CubVnmn:tco9MTHzXO7Nl/115mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650647862, "uuid": "5272219f-a234-4323-9286-0058e64bdc32", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650647862, "uuid": "d609fea3-5723-4d99-a4b3-7f5d3b942f3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650647862, "uuid": "b0210a36-6ca4-4a97-83cf-e0b889a29838", "value": "7201bcdd4d7b48fbebe2effeec5ef469", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee6fbb97-c296-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650671404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650671404, "uuid": "33c277c8-704b-426e-9ffc-f817c9b5bd09", "comment": "Malware payload", "value": "520908c9764af4f0aa9b267480693ae6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650671404, "uuid": "0e9ac097-c341-4014-9db1-30fe03d06c3d", "comment": "Malware payload", "value": "4196091dcee41ccda5b9470397fce891153039993ac60677f9200b7c196808a7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650671404, "uuid": "e5b79d61-bf05-4c40-9ce5-c028d23d2328", "comment": "Malware payload", "value": "9b0544b83ccc2927d2624f2817a860fefb86d2dd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650671404, "uuid": "aa8eaf5c-1bb4-4cce-bc49-bf5e768e3937", "comment": "Malware payload", "value": "30e9bfdd173f5b4aa63f614f520a297793b15b36fb8e668d5b76c9fe88056aec76ee535c8837e58284ed8a066f842e16", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650671404, "uuid": "14cfc868-15c0-43af-9811-4c7a074d2412", "value": "T126931A41F9408B27C2D227B7E78F439D37366A54A7DB330269257EB42BC279D2E39520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650671404, "uuid": "08a7da41-aea7-4835-8f68-e90790d7bfd8", "value": "1536:EIkg9VQPAWeMTEb82Mm3xDKMsF0rOLcv6NPzRxQMpy2SjmokCmCVrQAFW9OXkYe:dQaMTDWWFG6NPX5SmCmCVrQAFiOXkYe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650671404, "uuid": "7fd9bd60-f039-447e-8a26-0a17cb4b224e", "value": 97538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650671404, "uuid": "fc3f0241-6370-4dcd-94a8-20576eb6b790", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650671404, "uuid": "30e341ad-0032-4b9e-a4d2-f305718f420f", "value": "a-r.m-4.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "993010c5-c231-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650627882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650627882, "uuid": "b30ac144-21e6-48a4-838b-b8cef80c7334", "comment": "Malware payload", "value": "b31c558b018db1694765dbcc5ade7855", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650627882, "uuid": "c42ceeef-caf1-43f0-9a2d-62baf39dc408", "comment": "Malware payload", "value": "422c85b38b9b82976f4f68eb9fdc6672b864ced8146b4a9abd751f2ba67ed1c3", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650627882, "uuid": "bc9215b7-0790-4274-b96a-da4b48684730", "comment": "Malware payload", "value": "c85b744033c7ed72b590c75fdb742cb91684807e", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650627882, "uuid": "3e112361-1558-415d-815c-a32f5fe31d47", "comment": "Malware payload", "value": "e589afbfbb4eafa95fab06e2bb85d4d3eeebceefc0edec3f44a868d65f236ce9aea969bb503201563391e5a85feaef8a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650627882, "uuid": "1ce628b8-be19-4439-8cca-c8cc7daa7911", "value": "T10B05AF01F9AC82B5E02FD53DC5534A1BD6B23C9443FA87CB82569B1A1F773E14B396A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650627882, "uuid": "b35b10bf-953c-438d-9341-0181aa693807", "value": "12288:f5ujMriyfJ/+P+s5eDjcm0B3Z5NdQt3TFKcPokRssNzhTgnJo:fsjIJ/+T5eDwm0B3ZLd0F/oSNhTgn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650627882, "uuid": "fc4a8649-bfcf-4f9d-ad5e-8723dc15716c", "value": 802816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650627882, "uuid": "17efb6c7-10d7-4d79-a832-64c9f008daec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650627882, "uuid": "7565fa1c-0c55-4f94-bc59-897a5d929b86", "value": "emotet_exe_e4_422c85b38b9b82976f4f68eb9fdc6672b864ced8146b4a9abd751f2ba67ed1c3_2022-04-22__114437.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "691f3e4c-c1cf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650585710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650585710, "uuid": "5f524659-f0bf-4fb3-960c-8a4db3ca48be", "comment": "Malware payload (Mirai)", "value": "55de9038f8dd6d08aa772cda2bd54aeb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650585710, "uuid": "c47125c5-95ac-4cee-afe0-a85750fc4394", "comment": "Malware payload (Mirai)", "value": "42393a476841cb9d33308458914c833824ed1934cc6298e1d7c634ce41ec163d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650585710, "uuid": "bc28934d-04f1-45cb-b46c-bfd9cb118f18", "comment": "Malware payload (Mirai)", "value": "f65b10a85485d608d17f2d371eef0644a5e03ffb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650585710, "uuid": "e9ae5bc0-902b-4de5-9d35-6d31f2ee2dbb", "comment": "Malware payload (Mirai)", "value": "ca5fca7d4d8bb6f08542bef7eb247e3769efbb606da35cc0f7c9005308b1f96564f2887b812189e33bbf9ff4c390fbc0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650585710, "uuid": "02a02c2f-2105-4b10-b0b4-213e69554d4a", "value": "T1AC53E749F9F5535BDBD471FAFA08128EB72E4798B3EE3117DD30099033C4E6A25AA064", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650585710, "uuid": "e51bc32c-952a-4973-a857-ba6df70f2761", "value": "1536:Ga3Gv9YqbNOFPXtltVdAO/IWOMmKlmXWBP3U:du9YqZkvtlSO/I/F+mXA3U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650585710, "uuid": "350f9e52-65e5-40f4-a0b6-9735bfac9dd3", "value": 65600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650585710, "uuid": "8121648b-7fac-4311-8113-274bb9727df9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650585710, "uuid": "f67e4f6d-fa73-414d-9232-d2b196360a90", "value": "55de9038f8dd6d08aa772cda2bd54aeb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4304a6d-c28b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1650666662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650666662, "uuid": "569f708d-e168-4d8a-b959-4ce0143f7843", "comment": "Malware payload (Gafgyt)", "value": "babdbba3a869453c2031a3b22eadae41", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650666662, "uuid": "20146974-b236-450d-84e3-7fde733e8d47", "comment": "Malware payload (Gafgyt)", "value": "43cb5f20a07da901825d725fd8e6424d2837984021d58221d03bb21a0d587a4a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650666662, "uuid": "8020b05d-6c1e-4a91-9526-a12d80bc7b3f", "comment": "Malware payload (Gafgyt)", "value": "9ecd7a8f85cc175f1b522be5b60fc11b011a2d75", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650666662, "uuid": "bb719f08-9aa1-4b41-815d-caff602b06b7", "comment": "Malware payload (Gafgyt)", "value": "15a30ec3edc5747229074f452d835e5d9a656953825f84085e850e15b3b090894683c04d646d6065936d6a0b04b53e5a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650666662, "uuid": "0541baf9-8506-4e42-aa00-a0bd5adc1a4c", "value": "T13FC33B06F5108753C1C2177AB79F561A77232BF897DB3312A6247FB82BC279A0E39950", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650666662, "uuid": "0e97a291-1733-494e-8a26-809335d80b5e", "value": "3072:idwracAAviNmLpMQ1x95hKHKSrbqlAdmyDQUJ1UX4Tn:SwraFgikx95hKHKnlAdmyDQUJ1a4Tn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650666662, "uuid": "01e3b938-b735-4fea-92e1-09219b90c111", "value": 118932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650666662, "uuid": "42baa456-a437-43e1-9459-1465002eeceb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650666662, "uuid": "a5f1cd2c-806d-4231-a062-82e759e903df", "value": "babdbba3a869453c2031a3b22eadae41", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "574a9206-c241-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1650634643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650634643, "uuid": "4fa9be8a-4d3a-4e85-98ec-bdc5f87c2a8f", "comment": "Malware payload (AgentTesla)", "value": "fc42475f87f4c879f00a7a1e3e924f7a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650634643, "uuid": "ec1bbdd5-01f9-457e-a98b-c44c8d930360", "comment": "Malware payload (AgentTesla)", "value": "447827fecd3c268be023d413c6d51e2985321272db79c58334820f4873d9a6df", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650634643, "uuid": "ed944b3f-ac16-46bb-b82e-d0f3eae6d9ce", "comment": "Malware payload (AgentTesla)", "value": "64c3853f60c93d2c5af86c3da2860d0aa6421737", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650634643, "uuid": "5df7d42e-473a-4117-91a5-d01420199df0", "comment": "Malware payload (AgentTesla)", "value": "dca0bf8a103ff502b87ddcb7457df7bf6ff8e3845d09c75e3e17a37cb916335c2535752fb2852b4a09aeef38c9e639a9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650634643, "uuid": "2cb9f499-0461-4ea9-92b3-8bea92567119", "value": "T10AC45CAC7A0D5A72FD9E993886076A14BB660F0323F099C257DF25CB874E0F52D15F88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650634643, "uuid": "974776f2-5119-478b-9b00-9bfea4f38de2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650634643, "uuid": "52377879-15d2-4084-817c-b271235e3977", "value": "6144:0FwLlzlf6Al/itjvFVAJWwqSRq9n1uz8Tx1lH4MnsKoo8wEqJcTJcky5Pwwyi2o1:cwL/60/Y8JWikn15tpoo8iHky5Pm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650634643, "uuid": "57bff058-ef6e-4f39-a456-d0e5c4bf0c9a", "value": 566272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650634643, "uuid": "e4aadc0f-c70a-450b-85bb-f0bfb27d8d81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650634643, "uuid": "c23b9b51-0cb2-43bc-8bc8-979b1c825eab", "value": "CTM at Aliaga ETA 01.04.2022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e7447e1-c221-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650620992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620992, "uuid": "095a2a4b-067b-4379-86e3-849367d46751", "comment": "Malware payload", "value": "58076597cb8a0cda7d8dc56317ea2907", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620992, "uuid": "90ad47cb-0f98-4e21-ad15-87ff4a1e21fa", "comment": "Malware payload", "value": "45b351bbe8f59adb10a0ea9d8fd37a99e8c27c17616981e76ab4a8f25654f42c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620992, "uuid": "31a1e31f-27fd-464d-9192-4c3547419e75", "comment": "Malware payload", "value": "9ad873c6526a70e11b5b63b51c937f12572f5d33", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620992, "uuid": "8609ba59-79ec-477e-901e-9e2a5844fb7a", "comment": "Malware payload", "value": "e76ff66123dbc8d91277331733999c58814b67d541b33a52709c1e89f8fc8b5b36019907e800dc968a3ce13677f58361", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620992, "uuid": "9ca65130-b1b0-49da-b1ba-4e239342868b", "value": "T128E55C22B244753ED06F1A7A9637A26C993F777265268C5B67F0888CCF365402B3E707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620992, "uuid": "96ee7527-3e67-4f0f-9f35-bee038a96369", "value": "077662acebb7ec6919e85affda448e47", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620992, "uuid": "853114b4-a4b1-4bad-ae59-d337a54df0d2", "value": "49152:aQRZyOKXYBjRg3zS9I5Bzz/+CmEN4Fd+zkT8uyt:aQR0Ws+C4+zbuyt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650620992, "uuid": "b0b0c751-dd8f-4382-bf55-d1981b57e660", "value": 3040768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650620992, "uuid": "8587705b-abae-4a67-8c63-bb8b8c241b70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620992, "uuid": "43cc5185-d3ef-42cf-913b-7fc49167dbd7", "value": "SecuriteInfo.com.Trojan.DownLoader44.47429.6462.1170", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c587f81-c23e-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1650633282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650633282, "uuid": "cb94748c-41b6-4084-b936-96627dbf8b3b", "comment": "Malware payload (AgentTesla)", "value": "dc47493cbf1628a88f6419f1872547ce", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650633282, "uuid": "e5979bb6-53ab-4667-8384-31b27d4ca01b", "comment": "Malware payload (AgentTesla)", "value": "45b7859d641ef7a24edbb6b5cca4f420245cde9d693f295aa2f7a3443c55d21e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650633282, "uuid": "30c5139e-ef7f-472f-8393-8d3b68a2df79", "comment": "Malware payload (AgentTesla)", "value": "13752b950a6ce08ad7a649ca0cc18cff16b10bfe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650633282, "uuid": "55e8606a-6716-40f2-a6b5-45d16ce32a87", "comment": "Malware payload (AgentTesla)", "value": "f99d43f24a7d98aa2a7401ba9c0dbcf464b79d8f2080f251bd42ec27cbb59daeb6f6acf9480ef4685943afce1ab9feb5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650633282, "uuid": "f49592c7-d28d-43d2-aae5-bc4df2fbf9d9", "value": "T125B43C2C3B4D1E72FDDD8930850A2A24BB660F9323F099C6579B19CB874E1F56D05F8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650633282, "uuid": "9b5b67c2-4b3d-4199-826a-35432072293c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650633282, "uuid": "8e2fc0de-3638-41a0-98fc-496107e2fab4", "value": "6144:t1sRU9e6684cZFEbjh2NuhcJlRsHACwPPAP5GkMeRD5QhnQMo:t1Ze24cX2dAueJvo9HNMeRtQS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650633282, "uuid": "d69c262f-60d2-4d8d-b438-9b6f084e1a00", "value": 506880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650633282, "uuid": "c3339a3f-d6d0-44b3-a75a-422b7ad581e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650633282, "uuid": "b0d704c6-9ae7-44f3-84a6-91f11c161025", "value": "MV JIAHONG PARTICULARS.xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55fb9f90-c1ec-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1650598134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650598134, "uuid": "8ffbc64c-437b-496d-a540-7f578ec7a906", "comment": "Malware payload (AgentTesla)", "value": "8d654a57118db406fec338e5d623b5ca", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650598134, "uuid": "806afdc5-89fc-4744-837c-e5cbe57fee58", "comment": "Malware payload (AgentTesla)", "value": "46b800034a07c74295061237ce2e6ed92c41ed453816a20e3d180c853783c147", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650598134, "uuid": "4d61ebb6-11d5-4b58-add9-0b9713b716eb", "comment": "Malware payload (AgentTesla)", "value": "583f3f4254cee51747b82f8914dc232ebfc2357a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650598134, "uuid": "32f65a4a-8e43-47ae-9f0f-cb4996b7ed74", "comment": "Malware payload (AgentTesla)", "value": "812532584425228a4275fd3532efa149a85998a420a9bbaa8692304c35d5fc416f9276e2877c66d7a973ffb3aff60edf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650598134, "uuid": "5ba14ab6-87dd-45fd-acc6-675dc9da5988", "value": "T11504A78CBC98851CDDB8EA71180FF173FA297F8A794C9B50E5487FD63A72660424E835", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650598134, "uuid": "d480f5bf-cfb7-40b4-ad6a-18dc026106bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650598134, "uuid": "6d357e8e-1415-4909-abf7-eb21fb0722cd", "value": "768:wLz1ounX3Upg4ykyipmi8MYQmGPtYcFmVc6K:wHOunUpg4Uipmi9zmG3mVcl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650598134, "uuid": "96a65a2c-ae95-4ae0-91b5-959ae7494bd1", "value": 184320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650598134, "uuid": "b46a8857-d7fa-441f-a87d-faba5c125914", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650598134, "uuid": "4640ddca-42f3-45a4-b61b-850eb5d72a7a", "value": "SecuriteInfo.com.IL.Trojan.MSILZilla.17915.17529.11627", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3490610b-c24f-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1650640598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640598, "uuid": "9588febc-11c9-4be2-95d7-fc03ce19d40b", "comment": "Malware payload (SnakeKeylogger)", "value": "582431aabf2e3422d8ff44d19fba8251", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640598, "uuid": "8313b7e3-c5a2-41c1-9c3b-c93eb1ffb594", "comment": "Malware payload (SnakeKeylogger)", "value": "47fff8d690fa5aa750cf313d6c1ebd136da13e11462d458c8b317a5ff6a48bc9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640598, "uuid": "0284e0cb-6d80-475b-a09e-4d6a0e0a02db", "comment": "Malware payload (SnakeKeylogger)", "value": "00e45f411d5ff07b1be0e39f2bc061ba70cef0e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640598, "uuid": "db206b8e-0896-4ed5-bab0-1cecf6044f01", "comment": "Malware payload (SnakeKeylogger)", "value": "e71cf2450c763deaca47864aadc7f269157779b9d554568559a50f1aa7cb1679b3cc1958daf9daa580faf320a11751ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650640598, "uuid": "e6878d68-7e7c-4b5c-817f-e37940d120e5", "value": "T18964D08A9B38D689E975BCF1BD73885103797D9640ECD94AFF33688928A320135379C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650640598, "uuid": "326a90a8-ce17-439f-a3cc-2f5e260dc7fd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650640598, "uuid": "38387896-ec6f-4424-b499-446bc81e6502", "value": "6144:7GBkuri/tJaUCB6UmCA2o+uKivuhnDsHMIc0nmdqdR:7wkwMAnBnmP+u5uFYMIHmdq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650640598, "uuid": "bacd76e3-59bd-4856-a7a6-3e7a5e617093", "value": 324608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650640598, "uuid": "fb89449e-be44-4297-a547-405349bc1d73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650640598, "uuid": "c836b5d2-8b5f-4c5f-8f2e-17586a33358f", "value": "SFA65309.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66b1b0bf-c254-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650642829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650642829, "uuid": "2034c086-1195-4478-804c-f9c412375fb7", "comment": "Malware payload", "value": "8a7ed15dfd5e385b3913129c372cc026", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Goldbackdoor", "colour": "#DBED80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650642829, "uuid": "7f08e3a4-97e5-4b0b-b423-6711f70f0040", "comment": "Malware payload", "value": "485246b411ef5ea9e903397a5490d106946a8323aaf79e6041bdf94763a0c028", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Goldbackdoor", "colour": "#DBED80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650642829, "uuid": "cd888e87-ae19-426a-9e87-b3e22be5b33e", "comment": "Malware payload", "value": "ff172a51c13c1a3be7f2c8b1e9352492e2ee01d6", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Goldbackdoor", "colour": "#DBED80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650642829, "uuid": "2fa5b9a4-5ed4-4893-bf48-7a58279d75c0", "comment": "Malware payload", "value": "88cff17cbfdd929c823c7eddadc15cdf1eb865cb479aca1626490667030ec0d5f827a0ede5299cf6b1efdba2b4a773d3", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Goldbackdoor", "colour": "#DBED80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650642829, "uuid": "7fb3375e-fddf-429d-b2bd-6ec9386351b5", "value": "T1EB45CF22BB82D572D492447422BAD37A4D3AB930473FC9C7D7D029694D316D02B3F7AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650642829, "uuid": "f80484e4-fd9e-40ab-a32b-c47f57b34016", "value": "1359bc5e32064d6cd85d5d1dabfed078", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650642829, "uuid": "2e598c3a-2911-438b-9c27-c4c019035542", "value": "24576:2QLVx+nSmMsWO1ANzhNJutjOuXLmDbbRfh3qacMWOEjzDHLPOCTYZMS98kx9:2u0nSmM9O14hNJWXqPxhSpOELLPOCTMV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650642829, "uuid": "f2a2b39a-b0fc-473b-82c5-61e2eedad9ea", "value": 1195008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650642829, "uuid": "4661d895-9005-49c9-8c14-efa5fb6f3f9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650642829, "uuid": "ce9090c7-7a7e-43ce-be64-84292b870830", "value": "485246b411ef5ea9e903397a5490d106946a8323aaf79e6041bdf94763a0c028.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83552853-c254-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650642877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650642877, "uuid": "621fb0d3-e628-47a4-a577-e54e13a8e27d", "comment": "Malware payload", "value": "247c3c32ae8441498f1c849f9448b804", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650642877, "uuid": "daf6d361-d050-4b0a-b753-74efa15ec1d3", "comment": "Malware payload", "value": "488e8dbf0995e031bc860660d90b9a79d99e05bbad2e9ae0764ca52bceffb640", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650642877, "uuid": "d76c4af9-01ff-46f8-946f-4089ba9d4793", "comment": "Malware payload", "value": "3e77eb3e64ccb81da47a00682545b05b0f5b03ab", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650642877, "uuid": "ce4b2180-6e68-4542-a051-24785cfdd2cc", "comment": "Malware payload", "value": "f3bd3911c94f8014a37ca08280b8978632ece5e0717dbcea4fc9426291aa3989c3401dae1e0e14df491b5aaca60e2ede", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650642877, "uuid": "d3997b60-936b-4264-91f7-8e1c2c0d79e0", "value": "T1A4F48D4BF77C84A6D16AC979C5639A8AE6717C454B71C34B4360FB3E6F337A05A2A300", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650642877, "uuid": "89e96416-bfe0-4e75-bc8f-5aa142b12464", "value": "57b460f7cd0fab28b120cd121cfb7f9f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650642877, "uuid": "e24ab2df-6959-440f-bba4-cf192f11434e", "value": "12288:aIabL1+x29hs+bDBLKhKmCKzTrj2i0I8PxiGhWzx+o8/NQfN7IT5p:XabLXhs7AZKzvjDT0hWzP8/yfRIT3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650642877, "uuid": "46e5598d-35f9-47d7-993d-7ead0f5e343b", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650642877, "uuid": "8810cb7b-91a2-4c9a-ad1c-001868f82f8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650642877, "uuid": "ce52421d-e088-48f3-9bad-893edac4165d", "value": "emotet_exe_e5_488e8dbf0995e031bc860660d90b9a79d99e05bbad2e9ae0764ca52bceffb640_2022-04-22__155431.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15f79138-c21a-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1650617783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650617783, "uuid": "e322fa5f-5fbf-4084-9ece-2594d35d02ff", "comment": "Malware payload (SnakeKeylogger)", "value": "4c91b4e85079882694887a18822deffd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650617783, "uuid": "e7ad068a-b166-432f-8f75-ace5bb37b7af", "comment": "Malware payload (SnakeKeylogger)", "value": "49265c6ec7486c9127ed1ce4f831057f3a50b0294c5341b8d56a62afffc01a18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650617783, "uuid": "c7dca973-87fa-465f-b9e1-b5c6320bff91", "comment": "Malware payload (SnakeKeylogger)", "value": "f03c32d451952f4f11eb0e80a760c6c86844c4c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650617783, "uuid": "d4b768d8-9668-457c-9753-2f10d3ed976b", "comment": "Malware payload (SnakeKeylogger)", "value": "3cc2e495b0bd67c7432621b56758077a9640b7b03fd6cb6298c4fdd8fb27e382f29532bb876ed3978a8c479b59f91454", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650617783, "uuid": "68f94420-07a1-4c83-8670-f7b4b1bc4afb", "value": "T15EF42CD1F150889AEC6B49F1BD6B943024E3AE9D54A4410C56AEBB2776F3342309FE1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650617783, "uuid": "a76c6bef-8ff9-49e9-8ad0-03c3e7d119e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650617783, "uuid": "82868dd2-97d5-4690-ad4d-ece3420117df", "value": "12288:0ddFJw9gl46YaOdIbLgdQFBiVcu/uyyjp32fAAYtv/h:no451d2d0G0l/ABdh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650617783, "uuid": "0f3ea420-0322-4d3a-8a50-74c12efe9263", "value": 784896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650617783, "uuid": "dbf46955-10bd-4368-997b-d358a1255f43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650617783, "uuid": "5f03738e-aea4-4592-927e-c2d0ae5c433a", "value": "dokumen dan pesanan pembelian.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8139ec8-c23b-11ec-8e58-42010a9c0032", "comment": "Malware payload (GuLoader)", "timestamp": 1650632202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650632202, "uuid": "3450f285-d25e-4f11-b8ff-c31c8d0c7704", "comment": "Malware payload (GuLoader)", "value": "de19622cebd77f4916e85d8b7df7174b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650632202, "uuid": "1de6f8b5-451d-42a3-888b-4d01b5177286", "comment": "Malware payload (GuLoader)", "value": "4968e09f38cf61ab3e5e4bf25fb7fcf71b1f07574c4a68bd83a7469a8acf0680", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650632202, "uuid": "840c62c8-2ea3-4e0a-a2ac-e50031fcc610", "comment": "Malware payload (GuLoader)", "value": "486057b55709c3101466ff646856fb54bce26bfb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650632202, "uuid": "0fff5e14-e3eb-4966-81c8-b21dabf50361", "comment": "Malware payload (GuLoader)", "value": "9a6873ca575eb8c64eb3c9280805bfd5833e0fd65ff4da45b55b405242739561cf2eccdc4a1bf20a1d1d1252aabdc0fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650632202, "uuid": "c77049ad-51a0-478f-86d2-2f1a6a960333", "value": "T193B4C56E736096B8F45889B44937DC604A676C084B95C7DBB39CF32F147B9C9C20E8E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650632202, "uuid": "f35c883d-31b6-4dd3-ae9d-c5b6ced72e8a", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650632202, "uuid": "d2fc2f07-9008-45e0-9851-c36c5fc0883a", "value": "12288:IYk/9xyBMX6/FSU78YxjTUrI53zo0DV27:IYkFxyeSSU78ETmIplDM7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650632202, "uuid": "d2523ef7-c417-4a4a-9d59-01bf10fd6956", "value": 536016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650632202, "uuid": "8ff777c7-2f6b-40d6-97f2-febabe673fc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650632202, "uuid": "881fecd0-d882-4d4a-90a5-b1bca980e466", "value": "FRACCIONAMIENTO 1722403906461L.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "345f7fde-c22c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Pony)", "timestamp": 1650625565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650625565, "uuid": "05e3eca7-299c-40ad-a25f-0182da8461ba", "comment": "Malware payload (Pony)", "value": "0829a42258ef1ec6d9abb92d53aa230f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650625565, "uuid": "86c7300f-49b2-4426-85ec-45761b8217bd", "comment": "Malware payload (Pony)", "value": "4ab4e1998e42ef5cc96cf53aed6743f96607af23841a36f255ed1be6c8b31461", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650625565, "uuid": "cb15e8b7-2f40-453c-82f1-522a4811eaff", "comment": "Malware payload (Pony)", "value": "2f285a08daeb710f383e6f8883946c2daac930f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650625565, "uuid": "f7975eea-b6c4-4b6f-80fd-766aa94630cf", "comment": "Malware payload (Pony)", "value": "2b92fc1280d1db30f03664ab617414bec7254f3e9ebb97f259ad327fb0b784d2a13b61813c243257b5678cf6aff1f672", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650625565, "uuid": "249bd12e-132d-4b67-a710-14fa680f86a3", "value": "T1B873BF0FB382E5A2E19541B0047BD11EC631D31AA7389AE7DBDC1C1B6D333D2A535E88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650625565, "uuid": "1184a353-2da8-4b75-a5d0-cd23d1fa0387", "value": "7a2469614a05505f4983ed5c0b420d75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650625565, "uuid": "031214fd-b59a-40de-9955-ca146b449670", "value": "1536:Rozq67h/pJLm7uV6QAuhof/OiJnouy8VeEbuN+nImcn5Sd90rs:CVjhc/HoutpuYnImg5SEw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650625565, "uuid": "957ca269-d580-40c8-8b72-f66adf4ad507", "value": 76422, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650625565, "uuid": "cc212ba5-5ecd-46f7-9096-2a6604c8463c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650625565, "uuid": "d710188e-40ed-4dbb-a598-6e1eb25b382a", "value": "0829a42258ef1ec6d9abb92d53aa230f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5186cabc-c239-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650631197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631197, "uuid": "1a1258f3-a427-4447-b3a9-f43b7c1df880", "comment": "Malware payload (Mirai)", "value": "fe4c7c72b03bd7e70f2bb6ca433a7762", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631197, "uuid": "beb89b2c-465a-4400-b67d-7008ed366c61", "comment": "Malware payload (Mirai)", "value": "4bf6f89027e2ffaee2cdba71b71aa79f41f5fff09f4b3e70c33d5b0bcc7af14d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631197, "uuid": "eea43ccf-0bdc-439d-b13a-90563b2f09a8", "comment": "Malware payload (Mirai)", "value": "51cafe10a55295abbc35299957fe87bf37d9b8d0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631197, "uuid": "3614d08c-27a4-4542-a642-94145a285d0c", "comment": "Malware payload (Mirai)", "value": "4907ac9ed63fef1593841c14b92badfb401acaaf3334dabc15671cbeda0042c4c17ce0d3eb50093cc78f82f64e4cdc17", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650631197, "uuid": "0ed42581-3be0-4102-a8da-bd4d274c5d27", "value": "T161932A47D9615FB7C0866A7121EB5D300B13A9921B8F2A8A71389BF4474F8CE751FFA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650631197, "uuid": "b0ece78f-f6dd-45ec-a5c8-f601023ced77", "value": "1536:hCNF4yOXWgwn1028ARKmgEbfi1JCu5h1hzmpmkxVqOEeofzee:hs7OXWgwn10/m4J75h1kpmkxVqODofzZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650631197, "uuid": "fdee50c1-f4f9-485a-b118-c8f72dc781e1", "value": 93242, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650631197, "uuid": "0fc4461b-dcb8-4d60-8d9b-0565d9902557", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650631197, "uuid": "49059256-3a36-4fb3-b181-b71bce755589", "value": "fe4c7c72b03bd7e70f2bb6ca433a7762", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c7aaa9a-c24c-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650639269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650639269, "uuid": "1981e6a3-803c-4f4f-9bd1-d521fa18340d", "comment": "Malware payload", "value": "9dbe1dc9cf3e8e8f79ffb4691318ca7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650639269, "uuid": "6d8c9d55-5d6a-4cc9-95cb-e8ffef0b9287", "comment": "Malware payload", "value": "4d6628437efb92cc85a1eaac5e7e863efc7e23cd52311b197deb13c9adfeb5a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650639269, "uuid": "35e99ecf-c370-45a1-8282-1de20f52661a", "comment": "Malware payload", "value": "2ae843f062eaf05ad4572271ae2a998f8c40a171", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650639269, "uuid": "1ab547bf-1638-4415-8f2b-149fa0cde025", "comment": "Malware payload", "value": "c187db00dbefcc2836a79e7dd6fb7fb40af9906ccfb30da5bdfd0a0b439c292ff7e65e271c3d2d892f94d039cdfdb5b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650639269, "uuid": "e4ddfc8b-8693-43c0-988f-f375f701105a", "value": "T1E0D49D11F6AC80B5E07BD13DC9A3875AE6713C9847B943C79255EB2A2E736E05D3E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650639269, "uuid": "4a68d773-7be7-4afb-9c49-603bac3bb40c", "value": "6ba79cbed2acbe9b8ecc8e14a572f100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650639269, "uuid": "ecd5677e-2421-4196-a5fb-10cb636ebb33", "value": "12288:C1FIcocJwMTHzXO7N25BHiyzskF1CubVnmn:tco9MTHzXO7NQ/115mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650639269, "uuid": "b0d6f7c5-dbb1-497b-a7a0-812ae976319a", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650639269, "uuid": "d83e5464-f030-4b30-b661-7e7552d57ba3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650639269, "uuid": "441133ae-c133-4a25-b7ed-a17a85e7363e", "value": "9dbe1dc9cf3e8e8f79ffb4691318ca7b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c18a440-c205-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650608801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650608801, "uuid": "c1a4438e-b0b7-4171-9492-40b5a2947973", "comment": "Malware payload", "value": "832596ea2edec33700684b3b1494a471", "object_relation": "md5", "Tag": [ { "name": "136-144-41-237", "colour": "#FAB5CC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650608801, "uuid": "5a4f066f-86c6-45f0-8348-960ea87bc686", "comment": "Malware payload", "value": "4ec87fe78a0b7079a4d319159d2a5100112ff0a0397c5c0c3d9a3860130df4c7", "object_relation": "sha256", "Tag": [ { "name": "136-144-41-237", "colour": "#FAB5CC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650608801, "uuid": "43d2735a-0be4-4e50-a00e-ac84ad932f38", "comment": "Malware payload", "value": "878e8f072df878fa20b48bfc303165b78ca59d2d", "object_relation": "sha1", "Tag": [ { "name": "136-144-41-237", "colour": "#FAB5CC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650608801, "uuid": "68d4e310-25ab-42b2-83ef-80c583a3ac86", "comment": "Malware payload", "value": "10d566c34225b0de03b4d105bc907856dc116224dda2c8a891f1c078980b0db7bf3ea6e7f50a21581a9a129d37702440", "object_relation": "sha3-384", "Tag": [ { "name": "136-144-41-237", "colour": "#FAB5CC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650608801, "uuid": "ec57ef4a-483c-4d79-9c7d-4c0a2b074068", "value": "T18066338837E24B06E641B66426BEA7D04D1F93C675ADEFD36748E0BAC201FC7B153618", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650608801, "uuid": "3ec94038-c3a5-4bd8-89d4-24ca2e9741b3", "value": "98304:Sq29hGPaG4aNpV9PvURNTdBJy70T3+OxSiSFmrcBO7Kk3JR6YEc2KyIRH6eNb:bMdBvKFW7Kk5R6YEEyEHjJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650608801, "uuid": "d8de28d6-0e68-4000-88b2-cb9b878af94a", "value": 6712244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650608801, "uuid": "8ec3fbde-9bdd-42af-836b-8ea92a78012a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650608801, "uuid": "f4d8f355-9b9f-41b0-bfd2-334eb45da2ec", "value": "obs_recordvideo04-18-2022.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "625bd9f9-c22c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650625642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650625642, "uuid": "81ee7ae1-3b35-407b-999f-e0ea9ad52238", "comment": "Malware payload (Mirai)", "value": "f9d7030f43b783babcd547a6301a8c9d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650625642, "uuid": "3d6fdd91-cda6-4f07-8338-3e418b8a428d", "comment": "Malware payload (Mirai)", "value": "50054fba8cf60b081433f09f41ee5d832163bebc769fc77947df0aee87b73fde", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650625642, "uuid": "b50be985-f6b1-43b8-bd06-d775efa6cd9a", "comment": "Malware payload (Mirai)", "value": "d206016ebb3cdd80859858a3f63a87def5c9c54e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650625642, "uuid": "5a6a6474-ea85-435a-b17a-a4d8e2b6adc9", "comment": "Malware payload (Mirai)", "value": "b66d394c9efaa7577b2c7556b995d0c684467c7489b06639f23c884b972c1b9611caa9011bc939ced5084376ee0a876b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650625642, "uuid": "b8904ac1-1ba0-4a74-8836-344e7431f8bc", "value": "T110430231599377FAE8547435EF37ADC7FB8F2668ECE03A40306E91A9A7F5C884116812", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650625642, "uuid": "a437c0cb-1d98-493a-840b-5934a044b3ef", "value": "1536:R7vijE5jwdfAdAFpMwHdvhHp5224JIG/EQZ:dvwVAGFH5F4JIa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650625642, "uuid": "802c987d-5c4e-4545-acdf-80bb490bf410", "value": 56008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650625642, "uuid": "98ac68b2-b930-4efb-b5e5-7b2957e3d83a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650625642, "uuid": "c606446b-98ab-495d-a429-2f855f0574f4", "value": "f9d7030f43b783babcd547a6301a8c9d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbaac8c2-c236-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1650630087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630087, "uuid": "715338e3-3f06-4309-99e0-c55332880339", "comment": "Malware payload (SilentBuilder)", "value": "93db41a583f1fd5b1bdce346ea6806bc", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630087, "uuid": "b628cd5e-413c-4279-9780-ad6bf1e8774b", "comment": "Malware payload (SilentBuilder)", "value": "510c6fc0c97fc9a7cfe624c71e79bdb0e0645306d6e9addc3353a547c7089a72", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630087, "uuid": "cd06ccef-7584-436e-b47c-875b1694d195", "comment": "Malware payload (SilentBuilder)", "value": "025d0d05689540a0f6666b77e5773de75c650d50", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630087, "uuid": "075e874e-8253-42ae-9d60-03d62b832a28", "comment": "Malware payload (SilentBuilder)", "value": "09c262d26f7c20f6c49c7d93679e6b9906ed28cf3e5c2e3a9f6fbb3bfc6d691b94c99c2c53508676b4cb79bd7f088d6b", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630087, "uuid": "b070a8e3-464a-4670-a162-86040a7de5b3", "value": "T18C23B646BA5D9859E9258B7548E743E9B333FC201F6B0B833616B3257FF49E05A03207", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630087, "uuid": "e4204dd6-7bd0-4fbb-91c6-a71960f91c0c", "value": "768:4DM52tfQXi8vgLZkTOHkQT51Vp6AwPdM8gQ6JT5X6DGwUdh+pqjeSLjcvLtzrxFm:462tfQXi8vgLZkTOHkQT51Vp6AwPe8gz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650630087, "uuid": "c7d91cc3-8160-4157-b4f8-3ba250f99d5c", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650630087, "uuid": "11bf3be8-c01e-412b-a58b-5b71a24ecbb3", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630087, "uuid": "ae19125c-ce9c-4aaf-8f72-881fa41fa644", "value": "OMICS Online.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "066e765d-c28e-11ec-8e58-42010a9c0032", "comment": "Malware payload (DCRat)", "timestamp": 1650667579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650667579, "uuid": "57178287-167f-4ca2-b774-3e7e91b02d1d", "comment": "Malware payload (DCRat)", "value": "14f2f7c66c816fe71a3a3cbc133fe8bc", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650667579, "uuid": "61eb9ed0-237e-46e0-ad81-5f4163deeca2", "comment": "Malware payload (DCRat)", "value": "516b7bd1f6bf44033b1c80a7ca6044ad76ade2449d2c429940ff311fb661d5d4", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650667579, "uuid": "aba02ec6-daf5-4a53-9159-479366384440", "comment": "Malware payload (DCRat)", "value": "4a3fae5f80cab81b4a1c11554d1a0636b000d0d1", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650667579, "uuid": "0eef2f08-e038-4a9a-8c4e-7908ce4a25df", "comment": "Malware payload (DCRat)", "value": "9ab3e81be9327be234acc3a2344fdf4dcd48a47eb92cf833caa301b8e1631e40676fcce835e7b2695aa46514d0c2628c", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650667579, "uuid": "ac4f0c88-805c-46cf-ac3f-112f37fcf767", "value": "T18CC13A7A1450D835D91FD93309686C7105EE4EBC7D80D6319F92390CB7E1F8ADA72C96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650667579, "uuid": "11727b84-d947-4f30-8f43-6385552f6306", "value": "96:6wk9OjiwiRZIGvQ1kl+ttukvJNP4NaaJG5HQteoD1VEXV9l5o:T+wiXlvgkl+t4EEJGBoeoDnEXNm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650667579, "uuid": "f34305e5-2622-442e-a565-b57497c9f37e", "value": 6144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650667579, "uuid": "08df2990-9951-432e-ad2f-d7b5669e2f77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650667579, "uuid": "4a8b9941-9a5d-42bf-ba7b-7b90132117dc", "value": "14f2f7c66c816fe71a3a3cbc133fe8bc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9a42748-c21a-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650618084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650618084, "uuid": "929085a8-4b88-4458-96ed-2ccd84ba1f61", "comment": "Malware payload", "value": "94364a3efeecf9ebe43d1a1cd1f713d1", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650618084, "uuid": "ba3d683a-fd46-4ea4-83fc-c27b1071c991", "comment": "Malware payload", "value": "51ded2f6bf7295706d332741c50466fe73940785909b395709e7865b124c176c", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650618084, "uuid": "160a371d-a5e9-4e55-9b8e-d162bb3cae79", "comment": "Malware payload", "value": "dc0defc0ebe1a4c7e9fc19f37a08651c435103dd", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650618084, "uuid": "3552c860-e24c-460f-9064-b47a60d514bb", "comment": "Malware payload", "value": "1f62cfb7d037825567ed0435f57ede9fb1cda22df1fe64cb8ffb45971c2732eec522129ef2e60cee6bc36b604447b1d0", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650618084, "uuid": "805f56c4-8395-4c92-8f93-e0b271e31643", "value": "T12442D2B5EAC8CE1AB85853934B582CE579F40B385762DC562C0AEF57CE644CEFE1D042", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650618084, "uuid": "43f9dafe-7af8-4da5-80ac-d45ad246f32f", "value": "96:EXp9oQoJIrfOzjAGqR+ByYhoEF33eQ2gI2gepx2gVaK5+N:6IQ7rfAAbRyRzCg3ge6gVaK5+N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650618084, "uuid": "8fb2f820-5718-4cf9-aaeb-d2d8b7f9eafd", "value": 12794, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650618084, "uuid": "d0a93d18-bcae-4e01-92ad-0f9609e41a9e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650618084, "uuid": "d1567765-ba44-4a67-b980-d462b4ea7f18", "value": "Info_Relev\u00e9_fiscal.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a28492ea-c236-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1650630045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630045, "uuid": "6d49a72b-97c2-4bfb-874f-c80732f7ea3d", "comment": "Malware payload (SnakeKeylogger)", "value": "6ab61d9c6cfd581a19f7d235c0e1d0ce", "object_relation": "md5", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630045, "uuid": "e3af51c1-7b56-423a-83bf-5940cdcad472", "comment": "Malware payload (SnakeKeylogger)", "value": "529f83f8a2e952cd81ae2305992dadcf3dc4b6016fcdefb65beb70fc98417d73", "object_relation": "sha256", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630045, "uuid": "ab8809d0-7762-4763-91cd-ec46243d20aa", "comment": "Malware payload (SnakeKeylogger)", "value": "e26a23d2b6e222ca4a934abc8e297b92229ac0e3", "object_relation": "sha1", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630045, "uuid": "52a8e27e-56d8-4b6c-9d0f-3cbe1cb8ddb3", "comment": "Malware payload (SnakeKeylogger)", "value": "09a39406d4512b68e455602da6363869be817d9f7d94cdf1b70b99a613525e23c3efdc286de8f996d564264e75e40372", "object_relation": "sha3-384", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630045, "uuid": "80be7bfb-c3c1-44f4-be23-1021ed4edab8", "value": "T1227423C17BDF0879550BD3EE9BF033EB377A9A5482E3479EA5B69321102252BF123161", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630045, "uuid": "633aa907-a912-42c8-b0d6-ec76c7fc7134", "value": "6144:4gwSsBIH7RUc7zR+nE+FsrpGaLULyAwVdrN8nr98iyRqlEG+D6v+tM/HdsBsl:vsq9Uc3kE+FsrER7wVFN8nhnGqx8qKMz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650630045, "uuid": "062e8146-7fc4-4614-a280-996e195d7360", "value": 360901, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650630045, "uuid": "76111283-03fb-4a3d-8931-63ec3ac64ab0", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630045, "uuid": "ee0e772e-a833-4488-9925-3ec58019cde2", "value": "319-7359-01 BL DRAFT.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb7a24d7-c23e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gozi)", "timestamp": 1650633603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650633603, "uuid": "0814e539-b469-4d80-b498-18e82cb2c470", "comment": "Malware payload (Gozi)", "value": "5d2b5cbd8a574c9e35309e21ecf93a0e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650633603, "uuid": "a983400a-2e66-49b0-b606-1dd5981ce2a4", "comment": "Malware payload (Gozi)", "value": "52d14c9cd56aa41ba98a24a4a3dc3674f7e281c3d79f6aca141382fb56585bcd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650633603, "uuid": "d7790d20-d0b1-43d5-99ae-c4cd46ef9268", "comment": "Malware payload (Gozi)", "value": "c15e583e28556f5d187197937b4d2a715ebf8ca7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650633603, "uuid": "f9660acb-e734-49af-a814-ce5e35a9692a", "comment": "Malware payload (Gozi)", "value": "0889d7ed108cf20edd25671062ce6d8060d765a3ac0bc1a6b0e1d0033102e534723b00f7d2cb18ff57187a996dba4349", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650633603, "uuid": "f0f0ebbe-b3cd-45e0-b63a-b5502cbba985", "value": "T13DD4BD1A029B2102EBB6CE78A751636C54174CE09B01E2CFC9190DA395E35FBF4FA5ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650633603, "uuid": "1c815366-36ef-4782-bb0b-99ded5029228", "value": "fd1c62e6f93e304a27347077f6d2b44c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650633603, "uuid": "485f8881-f893-4223-907d-7953f10fb14f", "value": "12288:+w1lEKREbddtOYRbHzcPwka1dCjc3N8ZR:+w1lEKOpuYxiwkkgjAN8ZR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650633603, "uuid": "9ec4a565-53db-4b60-bdd0-b2f4544d5205", "value": 639303, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650633603, "uuid": "a9801474-842d-42aa-8eae-b022823787b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650633603, "uuid": "35603567-b7ae-437e-b07a-d18ecdf1cdb3", "value": "5d2b5cbd8a574c9e35309e21ecf93a0e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7798da0-c23d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gozi)", "timestamp": 1650633167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650633167, "uuid": "ddab4c91-96ee-4e3b-b210-b1be8e549954", "comment": "Malware payload (Gozi)", "value": "117d2886bf0e722b91c0613f337e97da", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650633167, "uuid": "ca9149c8-5b90-492b-9316-955f86074dcc", "comment": "Malware payload (Gozi)", "value": "5460cbecf56cf0527a162da6e9232c055912ae695990c1894a32b08055f45d37", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650633167, "uuid": "8221d114-dace-44cd-b620-7c01d0d54cf5", "comment": "Malware payload (Gozi)", "value": "ca858266bb3a6c30bd798bd52ec9ad5f5992c999", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650633167, "uuid": "094101bf-b08d-44cf-a949-ddeaa24bba43", "comment": "Malware payload (Gozi)", "value": "e6a892b517cb1e71459d753cd97adc426e57779291935a3576a251ade334090d8c1cbff1258c248e718c0a16a37fb017", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650633167, "uuid": "55de8cb5-5c68-40c6-a55f-0e2271ea45c6", "value": "T1ABD4BD1A029B2102EBB6CE78A751636C55170CE09B01E2CFC9190DA395E35FBF4FA5ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650633167, "uuid": "594eb3ee-e59c-4bf7-81d6-5f0a0d44a266", "value": "fd1c62e6f93e304a27347077f6d2b44c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650633167, "uuid": "730af11d-2a3b-452c-8da0-659d6360e305", "value": "12288:+w1lEKREbddtOYRbHzcPwka1dCjc3N8Zlh:+w1lEKOpuYxiwkkgjAN8Z/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650633167, "uuid": "7b22c6d4-3921-4904-8d10-44297c237786", "value": 641494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650633167, "uuid": "09f89bc0-4764-4859-8b10-216da2427ad5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650633167, "uuid": "bc6237f7-8aca-44ef-8966-e91e6bd6297c", "value": "117d2886bf0e722b91c0613f337e97da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09a52977-c208-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650610031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650610031, "uuid": "36fd33c2-7ec6-490e-be16-1bb42974cd50", "comment": "Malware payload", "value": "8edfad5dda3b3c330cbb6abc9ced8d98", "object_relation": "md5", "Tag": [ { "name": "136-144-41-237", "colour": "#FAB5CC", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650610031, "uuid": "135e3377-1294-4e6c-b36f-aac018df88d1", "comment": "Malware payload", "value": "55036edd0f34a4b46c7bd8d3454099cd1f51ebb5cacfe97822e56d1c584c0872", "object_relation": "sha256", "Tag": [ { "name": "136-144-41-237", "colour": "#FAB5CC", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650610031, "uuid": "056d187f-3637-452c-a424-5e5ab269699e", "comment": "Malware payload", "value": "d5c1d9e7cb34793c81878788acd348cb304857d8", "object_relation": "sha1", "Tag": [ { "name": "136-144-41-237", "colour": "#FAB5CC", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650610031, "uuid": "d530131e-7eff-4704-a23a-f71ee566786f", "comment": "Malware payload", "value": "bfd00cef6c04595fbd30ccb85b6c6d641ba5b98acc6b2bb13e7042302711835d2ffedcd2a0493a66258294b38345a80d", "object_relation": "sha3-384", "Tag": [ { "name": "136-144-41-237", "colour": "#FAB5CC", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650610031, "uuid": "800eca27-51e7-4e36-98cc-31d44ae839ba", "value": "T1D8D0A753011D521C4581507DDF99B091A257A005BA952AB46243B206C00E02F4B555C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650610031, "uuid": "ee0545ef-3c4d-42f6-b076-8de76c0ba8d6", "value": "6:IXeqA75eB8AdjeCMzLh8TQ2nZYqWfBNnkqJO/Jrr75FHYN:IXfY5eB8AdjLSGTQ2ZYqYBNkqJOZ51YN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650610031, "uuid": "08c3f732-f50a-4690-a0ec-9e380fb7112f", "value": 224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650610031, "uuid": "a094ec03-66aa-49fb-8e1d-911587df7912", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650610031, "uuid": "dd4b5cc4-48d1-4153-b6d6-6d87690fb304", "value": "ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80f6dce1-c221-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650620969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620969, "uuid": "e7c30a30-56a2-4ffb-967a-d23790607451", "comment": "Malware payload", "value": "0985b2a5b49dfcdd9a842519dc177f73", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620969, "uuid": "679bae66-4004-40a8-9ccc-41383c06db24", "comment": "Malware payload", "value": "5508c28d0cae5067608c97f0ffa1380bd44a1e7e8de185e16c0ca54d55950d88", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620969, "uuid": "d5f66085-984e-40a1-a37d-b1c34c9a7346", "comment": "Malware payload", "value": "10cc8c47d851fdc6d2145d8d431324ceb55069a1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620969, "uuid": "937c2fb9-dbe6-4d56-8d61-33ab9780dbba", "comment": "Malware payload", "value": "583aa981feddfba4776eb303e29bd65ace128b52481ba6146fab6e27362af171f49256baca8935181f2e05fa4b9ccb57", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620969, "uuid": "b7239f1b-87ba-4f31-b083-e5237520b47a", "value": "T1D4F56C22B345653EC06B1A3A5537A2DC9D3F7B71762A8C1B57F0198C8F365402B3EA1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620969, "uuid": "e2e59aa0-eddf-49b3-b21e-b635922d2551", "value": "31f3fb1b3398a8420d31059bc5924151", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620969, "uuid": "5e2cac46-5107-4cc2-a85a-77e6b9210e70", "value": "49152:kqy5I93Wx+L9SJxh75CuVwGXUKW9FiBAOgjToH/eMbPt:kqQ+a5Cj2UKW9dcdt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650620969, "uuid": "8bb7682a-91aa-4d8c-9279-d3425a2b06f4", "value": 3352576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650620969, "uuid": "b4d325b5-c281-4d54-90f1-6ad3dbc8e370", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620969, "uuid": "4245cd29-8ba2-4b34-9600-bb6bcbd34db4", "value": "SecuriteInfo.com.Trojan.DownLoader44.44928.32527.31010", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "514c3719-c20a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650611011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650611011, "uuid": "5abcb32a-d61d-4b7c-8cb5-99d6046fc44f", "comment": "Malware payload (Mirai)", "value": "9d0886877304e0b5f00fb11d69985996", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650611011, "uuid": "1b24156d-865c-4232-8f36-f161c713a349", "comment": "Malware payload (Mirai)", "value": "551273a8ee3f3cc89de6b6f7550fa9e12744f54442d616ce4930ad1a6d8a2344", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650611011, "uuid": "33b2cb8f-58ee-4cca-8ff8-6de72911dd10", "comment": "Malware payload (Mirai)", "value": "b5a2c79ccc773c1abe09a7f2b3a64b6d0dff5d2c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650611011, "uuid": "3aae999e-32fa-4624-a777-f3f5c925289d", "comment": "Malware payload (Mirai)", "value": "933c59fc4abf54949133af418e2f2537ddf489a298e5372671b8f07ed3d5fd1326706979597ed6ee163d9642e82b4aea", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650611011, "uuid": "323d8c04-e0bc-4514-b93b-3356c6579f06", "value": "T17CC2E151E4C90E32D9F76DF91CDAE6A077F00BA57728CA8293D5AE10847363620B40BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650611011, "uuid": "acdd55e0-a6a4-4ac1-b940-b44926a22ecf", "value": "768:f/rAi8NCtoncQVE8/SA7g1LLY7wVJSjHnNn4uVcqgw0RNWXV:nlhtoJ/foJ2n4u+qgw0bWXV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650611011, "uuid": "b64e694b-72db-4be0-ba71-3d1837c77888", "value": 28124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650611011, "uuid": "a2369e07-6aba-4686-81e9-42474ffc7111", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650611011, "uuid": "ee5cf8d8-d9b9-4025-9725-8bbc5794f7ff", "value": "9d0886877304e0b5f00fb11d69985996", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72896822-c221-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650620945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620945, "uuid": "1e696d38-a48c-4a5a-bc28-627e05eabd7f", "comment": "Malware payload", "value": "7154b8c41196bbd629b0fa112eadb582", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620945, "uuid": "1e94d937-ad92-420e-9279-708fc4d7359c", "comment": "Malware payload", "value": "55175a0fe4351fa3c6c7e3edf0c7d432ad1481e61cb7c69d85a974471e267ae3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620945, "uuid": "331f5bd8-1317-4ee1-8dae-195afe5d75d3", "comment": "Malware payload", "value": "d5576b42a4fe42353a1c0e37b0aec5c86e29292d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620945, "uuid": "9875fff1-9d78-4f15-aba3-c0a49b8cb345", "comment": "Malware payload", "value": "88170f34ec11805eefd11ae4b5a3c764c5c75842a65789f98f91db469b2ebf0032ec1aeadb5d3cb5de577ef42223f065", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620945, "uuid": "8d9ddd10-bd43-4848-a014-2a4d84a5105d", "value": "T107F56C33B2C4653EC4EA19364937AA58993B7B713B12CC5B17F4494C8F396423A3E627", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620945, "uuid": "2557dc9d-51e0-4bd6-ba8a-8d5fe08fdd0a", "value": "9595a596dea5a792fb1557a4c25f5033", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620945, "uuid": "7acaaad7-12f8-4f42-8a80-3c7fe208012a", "value": "49152:3+e2X9hc9F3d7DS6i8IKH3ynjIfx6DCTiDfKhWt:3t2XUTCj86DV8Wt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650620945, "uuid": "1557d449-29b3-43b2-b0bc-4360c5aa3ee3", "value": 3644928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650620945, "uuid": "2fafb38d-6b79-4d06-8ac4-5023d650576a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620945, "uuid": "34bced0d-74ff-4146-a391-1b0285a4868a", "value": "SecuriteInfo.com.Trojan.DownLoader44.46871.31571.27873", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1281e20f-c24d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650639682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650639682, "uuid": "ad42c63d-0b0b-42db-8df7-ba685ff44b8d", "comment": "Malware payload (Mirai)", "value": "15fe35133bed3aac2c1d28d4c6fd61bb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650639682, "uuid": "43a459ba-c7e0-4018-9de7-165a717fabdb", "comment": "Malware payload (Mirai)", "value": "55219b6f32afb08780e72c703b3463ea2d09b38026420677b956b4bbbe111169", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650639682, "uuid": "c7e9152a-eb94-4820-be43-6ed483f0a6e3", "comment": "Malware payload (Mirai)", "value": "a6a2e60f06f0478b69c7bd19876b04db7b8b8dbb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650639682, "uuid": "792c1c55-bfba-4378-bdd4-340fd5eb3303", "comment": "Malware payload (Mirai)", "value": "32b5eac2cdfd8355f886b8665edffff19d94f0fe3a8c19a24a178ea5aa4fbcec4ea470a7de9dabebf64685d4abfdc2e5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650639682, "uuid": "2ae1ec28-c4f8-4756-8125-5614615942ab", "value": "T1ACF2E1919680C5F6F5891873DFBE470476E92FF4ED8978209B2481AC9A2100FBE7D2D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650639682, "uuid": "f50aa95f-7f2b-4e06-85c7-80e741478d0b", "value": "768:9UJmUM8oOpU2Kd0AxZIqL0IFSx1h1Rz28aYz+7g6N5kAr+d5WDE5/2p/3Ufs:9rQorfHRL04SxRRz+eNnkD80p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650639682, "uuid": "85fc5b61-e891-4f04-9c1d-30cbe0dcfc38", "value": 36544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650639682, "uuid": "58232eeb-b42b-442e-a468-e07fc00ff1f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650639682, "uuid": "00d190b0-af93-4948-94ea-6261cd1bd72a", "value": "arm-20220422-1501", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "968d77dc-c221-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650621005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621005, "uuid": "871edbd6-0bb4-4a03-9ad9-e940f8bb8808", "comment": "Malware payload", "value": "c3290ee03fcdff339e53d8e4068d62b2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621005, "uuid": "800aeb7a-41b2-4f55-9952-af9f6547fa3e", "comment": "Malware payload", "value": "55221f2c8e07b235bc794c72f8924e7b4d585e0f21cd867064b530a39af9231e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621005, "uuid": "33fcd09a-16b4-481d-8184-268c62773894", "comment": "Malware payload", "value": "a67a28a32331a2d78fa6610a6a428a1f12f8bedd", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621005, "uuid": "634b5fe1-2bfd-419d-a86d-5b1a0deac9c4", "comment": "Malware payload", "value": "d039708b948d9afea1235eb6a21deb3ea889a4063184a38ff457a2e58aa7326d348e29be13e3b784a1d9a14d43fe404d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621005, "uuid": "6fe2df2e-71ce-4bf2-b59f-c6e207ea8da3", "value": "T18A74AE1373C0C13BC5DB0175A61A43B24AFAB4708972929FA7C9436D2FB66C2E7663C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621005, "uuid": "03ca7695-a29a-4e89-b8e9-b673bf972f1e", "value": "9957bfdb6f7078196a235a87cd0fe46b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621005, "uuid": "fdd7b3b3-6d06-4de2-baaa-5f4088253b02", "value": "6144:JHsXmHCojK+JCtIGoPLOy0/Ffm2R86YLP8fidHY1rX/:JHsXLoe+JI7oO1/F+2RfYL+i0r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650621005, "uuid": "494dfc1f-ac71-4fb6-9e06-75498773e44c", "value": 364544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650621005, "uuid": "33bd572f-5ce3-42f5-bd2f-6ee31ea328b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621005, "uuid": "b2df97dc-7ace-4cc5-9451-936a8638e72c", "value": "SecuriteInfo.com.Heur.18413.26591", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8826acc5-c225-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1650622699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650622699, "uuid": "1799ce97-6694-4b75-ab6e-3e2e917e9544", "comment": "Malware payload (Formbook)", "value": "597900400a1d7b3b2eb534c7236b220c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650622699, "uuid": "aedeed39-f30d-490d-bfca-8a3e7848a8d7", "comment": "Malware payload (Formbook)", "value": "56682c4820125acfcfc901b7c478b4f3925ad0bd8cba76a43c4189c230288543", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650622699, "uuid": "56715f6e-544a-4226-94df-6d46836af5c9", "comment": "Malware payload (Formbook)", "value": "317b13b5e742e1a33786bf70a8cd82439da9770a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650622699, "uuid": "4166faf2-fc9a-44a8-aebc-ca7eb50b2fc5", "comment": "Malware payload (Formbook)", "value": "df55efde45aa4623064070d09f0fa1ed2b01c6562a0accadc520a94c880b06b08d997499045c0cff891b3b4205f69b01", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650622699, "uuid": "02317977-26e4-4616-b128-5438baec7647", "value": "T1F3F4ADDC361076EFC857C976CEA82C64EA6074BB830BD203A05715AD9A0DA9BDF145F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650622699, "uuid": "e7afbfea-fae3-46a0-a1e2-a35fd1530b5e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650622699, "uuid": "e82f7809-b7cf-4087-ac7d-839fb1c831cd", "value": "12288:cjtTvmFtpXsh9Qkxki8iQnF+xGWfkYi45PYndsCNS6kUQHXCqQ1wDngJsGtgvkup:8OtpXsvQkclnELcsPYdXSRFng", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650622699, "uuid": "eadc31b0-2460-40fd-8847-f0ccf9b93601", "value": 770560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650622699, "uuid": "04ebd3fb-84a9-4be8-8bd3-73eb74e7d733", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650622699, "uuid": "37b05e64-9524-4f6a-9977-e436b18f0602", "value": "597900400a1d7b3b2eb534c7236b220c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83659c57-c242-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gozi)", "timestamp": 1650635146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650635146, "uuid": "d0ebf832-3bbc-4e94-ba92-b4bb27eadfaf", "comment": "Malware payload (Gozi)", "value": "c544f66e442fbb1864b5abc8c919ef14", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650635146, "uuid": "daa41697-aa8a-4f2c-ade7-de7541bcf831", "comment": "Malware payload (Gozi)", "value": "5747f4ec2678631d2b8b001a4e1aeec2a74788cdc1381fcbb36b8f5f699246a6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650635146, "uuid": "b73cf2ff-821d-4b37-b824-41c445f33819", "comment": "Malware payload (Gozi)", "value": "7648765f0e8c7247187592be8ffc15e862833b6b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650635146, "uuid": "120531f6-e550-47c2-ac60-7de895540191", "comment": "Malware payload (Gozi)", "value": "77eaba0261ce8d3eef010e14b89e70ed54a7054218f284698b98155ae4ca50d0bba35daa0dc43f4e0cf23ae728424b47", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650635146, "uuid": "3438ac44-a4d6-4236-9660-18753d49b3eb", "value": "T13CD4BD1A029B2102EBB6CE78A751636C55174CE09B01E2CFC9190DA395E34FBF4FA5ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650635146, "uuid": "4227fa8d-4755-49e4-ae44-547ed3d2cc98", "value": "fd1c62e6f93e304a27347077f6d2b44c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650635146, "uuid": "a2a60879-e9ee-41cd-a965-c103fb6f87e9", "value": "12288:+w1lEKREbddtOYRbHzcPwka1dCjc3N8ZY:+w1lEKOpuYxiwkkgjAN8ZY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650635146, "uuid": "de14cb23-055f-4373-9e9a-30c50de12aa6", "value": 640155, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650635146, "uuid": "a12d58b2-460c-4b1b-8a4b-de53ce24c1be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650635146, "uuid": "7e20df77-bdc6-47fd-a2d8-89f91e29d48d", "value": "c544f66e442fbb1864b5abc8c919ef14", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68bf4a7f-c24f-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650640685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640685, "uuid": "70e6b0a5-e869-4ac8-82c9-4caa974dea37", "comment": "Malware payload", "value": "c250d3a4374ef7bd7b46fa56e56f580b", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640685, "uuid": "45d10b8a-d1da-475c-8227-b6a27adfeb5d", "comment": "Malware payload", "value": "581d5f09c494563d2d1815abe526a13a29da967ac9b2bce3d3068ca287885f60", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640685, "uuid": "e2fa687a-6e29-4707-9a6d-b968b0c96581", "comment": "Malware payload", "value": "0e504812ae158ba0c92f9faf0223cc87f1c0da87", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640685, "uuid": "00c11c41-27ff-42ad-a4d7-c4599d58ec43", "comment": "Malware payload", "value": "db5afd5d8af57e9c6dbf5d8df7102d55cfff0446a9049dd09070d9e2a584284411a126e3ef3da48a1d273a2911db7f36", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650640685, "uuid": "83c9c57d-9f17-4a39-a73e-50a83866a65f", "value": "T162A301C929BCBB1CD36251FC0C5CE63AB79A1C4202B69F49E29D7359D83AC45CC81EB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650640685, "uuid": "54e93c31-39dc-4d74-a060-6a54c817c9a0", "value": "3072:tqbz3yRGvNw5589h9ahwAqQ3acJtT1BdGxYp:+ORGlwma6AjdHp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650640685, "uuid": "dd0ffa94-3ca4-4501-ae89-ff442e0acaa6", "value": 107032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650640685, "uuid": "bbccce03-29a7-4551-8841-81af20365eea", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650640685, "uuid": "a4ee713a-b466-4823-a82a-df776cd8c0ca", "value": "\uc820\ud22c\uc6e8\uc774\ube0c \ubc1c\uc8fc\uc11c_2022\uc77c\uc2e0\ud14c\ud06c.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06657a6f-c23d-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1650632789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650632789, "uuid": "95e69127-df9a-4f79-ba54-72c425e2b2b3", "comment": "Malware payload (AgentTesla)", "value": "1d0170610abfa04b83419f6876bce808", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650632789, "uuid": "8e70dd37-9482-4814-bf9e-fb589b8aac73", "comment": "Malware payload (AgentTesla)", "value": "587bc75e3f8a61644757c661e525f574158776979dd6082b45e64a12b93a58bf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650632789, "uuid": "50c56b89-d12a-4feb-81ab-38cf2a05ffa6", "comment": "Malware payload (AgentTesla)", "value": "1f64c4a874e5147cf78523c1ea6575b02d3c33b1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650632789, "uuid": "5b3397ce-c1be-45de-9747-34498215ec0b", "comment": "Malware payload (AgentTesla)", "value": "22beea60993844351b7c4eb526de4397a030e569ad4949647374a028b8e27abf110d4612dd225dc92189a5f44a3ae37d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650632789, "uuid": "61f22038-2a5b-468f-8ac2-857dc5796677", "value": "T142A44DBC7AC11EB2FC0E91724D010A09BB660F6B72809FDE67DB15F9C74E2656D25C88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650632789, "uuid": "fdd53ae9-e068-4854-87b2-6ffd228d875e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650632789, "uuid": "b915cd76-0a3f-4d2e-a5a7-c8a3cd6b4b88", "value": "6144:AYGQ2ObPuDnlyokpIkYwH+hD7TUWEhJUjPe4BYfCuJxomipWyvcZww4+UfA9J4LL:AYGXePuDnlHkpZeBmAYfCdmPU49aj7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650632789, "uuid": "ce06da95-f0d6-4742-8713-d9e95292f347", "value": 466944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650632789, "uuid": "c7fe41d7-4b3e-4a0d-9622-2183e6930877", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650632789, "uuid": "2d28e107-5557-40a7-9b5f-f4a7ad0327dc", "value": "MT.Basat Voy 2204_Q88_(oil chemical)_04.12.22.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7c73a8e-c20c-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1650612095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650612095, "uuid": "4a1d169e-38a9-4a29-aab8-87457f0db2fa", "comment": "Malware payload (SilentBuilder)", "value": "7786232d73f32b883c97418bbde758fb", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650612095, "uuid": "d6c2e2ba-5819-4e14-94c0-f7a2df35df0b", "comment": "Malware payload (SilentBuilder)", "value": "5889e3a8bc561f73b3b3e1b70850b211525a02238410aacd725a990f35139333", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650612095, "uuid": "549d45a4-724b-4765-a87d-2f4153f51bd3", "comment": "Malware payload (SilentBuilder)", "value": "75b0b0bb773b476023c446b86aee663ad08fb7b3", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650612095, "uuid": "dd11b264-db4a-4747-a9d3-c9365174093f", "comment": "Malware payload (SilentBuilder)", "value": "1066cd588c92d6ee198f47aede080b5a32af9aa903d64de866dead362542f3f9dd69f8be421a5540c4c6a0f0039b5970", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650612095, "uuid": "ec84f279-54e1-4645-b0df-f76044340688", "value": "T19C23B646BA5D9859E9258B7548E743E9B333FC201F6B0B833616B3257FF49E05A03207", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650612095, "uuid": "b5d3e315-e916-4941-8868-05f2eb3734c3", "value": "768:4DM52tfQXi8vgLZkTOHkQT51Vp6AwPdM8gQ6JT5X6DGwUdh+pqjeSLjcvLtzrxF6:462tfQXi8vgLZkTOHkQT51Vp6AwPe8g/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650612095, "uuid": "10b27465-d347-4f41-934b-5c8ed065091f", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650612095, "uuid": "778d2574-2662-46e7-9011-4c4ae6ebaedb", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650612095, "uuid": "d2ce5a75-f1ee-478a-9fb0-69e762e99339", "value": "Scan 2022.22.04_0857.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a98afa8f-c24d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Matanbuchus)", "timestamp": 1650639935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650639935, "uuid": "330c07bc-11c5-4393-b49f-e8c06787264d", "comment": "Malware payload (Matanbuchus)", "value": "cdbba6b3a7723bb20b301cef81ea00b8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650639935, "uuid": "965aa7b7-d8d3-4e31-8bd2-3e7510cfacf9", "comment": "Malware payload (Matanbuchus)", "value": "58a673023bbc7f2726e3b7ac917a43d9306692dc87b638ee21b98705a3262ccd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650639935, "uuid": "6b611e9f-0651-46df-9db5-1df232cc245e", "comment": "Malware payload (Matanbuchus)", "value": "f1abce272f70e39855dcd085954f1132c6cb41db", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650639935, "uuid": "b9b340c2-a645-4e88-a6c3-4a70f127928d", "comment": "Malware payload (Matanbuchus)", "value": "4768e674f305189099e45568a4df516c006983fa7491ab3764fd6c7868e31ace3e7d639a8617fe4dd76b8c33c7e11a9b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650639935, "uuid": "298b48e0-e14b-48f5-9b6e-f192f696c677", "value": "T10B543911B500F132FCBA04759E749AB04A2E7E309BA805CBBE8C7F2E597F5C1A524E57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650639935, "uuid": "1feb8572-3e4f-4fef-9025-253db6fd1fbd", "value": "d86e96cd523f0d88359af350afd73632", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650639935, "uuid": "b083d7ea-b385-4634-aa9f-1d9c743cbd29", "value": "3072:c6mvqcGPwK96Q5OqyaH1MH/oanIAW+Z7fmq9OhqZWXYWrrRSVMnvw84XWpWeZj6H:mvqPn9BOqvmAarWq7fROnMSkdh4sSCl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650639935, "uuid": "347a845a-6d68-4ce7-976d-7caba2583ad0", "value": 299008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650639935, "uuid": "03ae3a1d-1c5d-41b2-8c6e-746e55808315", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650639935, "uuid": "f1df06ee-3155-4106-ad82-2db50c5fe178", "value": "wmplayer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c2573b7-c212-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1650614492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650614492, "uuid": "5f1ecc64-df45-4007-9ab4-05633bf3d0c9", "comment": "Malware payload (SilentBuilder)", "value": "a7531a03603410736757e8f530b27e53", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650614492, "uuid": "1930bd44-6a0f-4fd3-aee7-6352b22d7bdb", "comment": "Malware payload (SilentBuilder)", "value": "58f23bb78c818713c6beeef2c76c9dbf93b5fbbe958d9f31db044f93df2ed802", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650614492, "uuid": "52c5736a-78c4-42ba-a9e9-c4a3504a1091", "comment": "Malware payload (SilentBuilder)", "value": "44c67a31716114899f2ff833ea3b0ba693ab50a8", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650614492, "uuid": "616127e8-f571-404a-a273-35674232d5c2", "comment": "Malware payload (SilentBuilder)", "value": "a760180211a6d8d77f1da919ff0c4118c958752245bcfa13ee03d9144d6d0f5802cdceb1fc68983aab38881d7e8466f0", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650614492, "uuid": "a14954d4-d498-4160-9ebe-3ca7c8257abe", "value": "T1F123B646BA5D9859E9258B7548E743E9B333FC201F6B0B833616B3257FF49E05A03207", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650614492, "uuid": "3c328893-fd43-42f8-a8dd-787fa9ca3cab", "value": "768:4DM52tfQXi8vgLZkTOHkQT51Vp6AwPdM8gQ6JT5X6DGwUdh+pqjeSLjcvLtzrxFq:462tfQXi8vgLZkTOHkQT51Vp6AwPe8gP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650614492, "uuid": "59a4dfd4-14f1-46cf-8f87-6c34d1f2a9a2", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650614492, "uuid": "05f698eb-7c1a-458f-825a-a3793dd2bf71", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650614492, "uuid": "baade452-7f07-443b-9b2f-2380424f68c4", "value": "Details 2022.22.04_0958.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bbc66ed-c283-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650662890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650662890, "uuid": "dce90e73-17fe-4ddb-8eff-e930d02cdd96", "comment": "Malware payload", "value": "ec0b1d172de21d4e6240b6df1e2b8516", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650662890, "uuid": "59dc54da-a3a8-442b-b8ad-9a0dabd5a0b4", "comment": "Malware payload", "value": "5926728ff030af46692e6b54de26dcae9e5abd3ba2c939156f5764fd5eb717dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650662890, "uuid": "2b0b2464-9e16-4763-adc8-e481ca4575bc", "comment": "Malware payload", "value": "9883b5562e6b8e91b5560babdd1db9c5108a1e22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650662890, "uuid": "e0cd2b56-3291-493f-8d77-c63c1e405437", "comment": "Malware payload", "value": "ea85348dc75fcfa7985774152d57fb6c7386baba45bf2a082805c2aa62e927c1fd7247fa3b0a536dfb5a25f1a5a93a88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650662890, "uuid": "9ffd924e-ed56-4746-a38c-f6194cddd080", "value": "T149D49D11F6AC80B5E07BD13DC9A3875AE6713C9847B943C79255EB2A2E736E05D3E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650662890, "uuid": "21d62ff3-0dfb-4108-8746-aac37e354b42", "value": "6ba79cbed2acbe9b8ecc8e14a572f100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650662890, "uuid": "b1f9a470-5bed-4e5e-aa90-0e141708ee01", "value": "12288:C1FIcocJwMTHzXO7N2tBHiyzskF1CubVnmn:tco9MTHzXO7N4/115mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650662890, "uuid": "7be20b04-1388-4dbc-8e31-449755a11d63", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650662890, "uuid": "53747f2b-9bc0-4336-a397-8003049a7cba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650662890, "uuid": "46a3299b-1e62-4df1-854e-dc5d30217e42", "value": "ec0b1d172de21d4e6240b6df1e2b8516", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7512643a-c25a-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650645430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650645430, "uuid": "7d7ee606-395c-4463-a56d-d5a3cd43707c", "comment": "Malware payload", "value": "f70ec98d37ea26ed39f88fb4600812e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650645430, "uuid": "84788793-21b0-49ad-8509-3306f703261c", "comment": "Malware payload", "value": "592af4efa4d1ca30c21a3050bb3b379d1302cf6e4b747c81794abd4b5e6abbb3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650645430, "uuid": "3c13777d-ebf6-47ac-8923-cec4e20d8f36", "comment": "Malware payload", "value": "1ac54a69cd83068ae30443af3e43eebf2a0a0f4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650645430, "uuid": "54262994-e5f7-4817-a997-793465284c12", "comment": "Malware payload", "value": "27310b4aad4a05248f17099a6d80ea32cf9bc9680a456b89c2bd564f110681eb4732801635d8cc77375cc4fd5ed208fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650645430, "uuid": "bc3bb49e-4a96-4d64-b0d2-de36420d27b0", "value": "T1FFD49D11F6AC80B5E07BD13DC9A3875AE6713C9847B943C79255EB2A2E736E05D3E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650645430, "uuid": "e4a5aadf-f14e-4f5d-850b-72976a8ff343", "value": "6ba79cbed2acbe9b8ecc8e14a572f100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650645430, "uuid": "44175f88-09c3-459a-b449-4555f0e55fee", "value": "12288:C1FIcocJwMTHzXO7N2ABHiyzskF1CubVnmn:tco9MTHzXO7N5/115mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650645430, "uuid": "1f3572fb-b69e-4cac-ba65-5ed6d01db96b", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650645430, "uuid": "5313db83-bba2-41f8-84aa-10128315d9b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650645430, "uuid": "1f528010-477a-4229-9cbb-01d01d3396b9", "value": "f70ec98d37ea26ed39f88fb4600812e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bea32d26-c236-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1650630092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630092, "uuid": "36347ec0-caae-4b2e-97dc-6db47416cc1d", "comment": "Malware payload (SilentBuilder)", "value": "ea7f2390b7f9e06e0261ffd7c504b263", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630092, "uuid": "d7f914a1-4f6a-43cd-902b-ce49062fd59a", "comment": "Malware payload (SilentBuilder)", "value": "592e9fd0383a7220e729895cd55f5a8b5793f1de1315e7422721a6a2ca8cc8f5", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630092, "uuid": "8c69e5c8-deed-4bd3-ab91-e1046c22746c", "comment": "Malware payload (SilentBuilder)", "value": "62ab7ff73d358fa6a71544be15f4474cf85cc275", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630092, "uuid": "caf3b0ff-dc72-40e6-a2e6-900434276655", "comment": "Malware payload (SilentBuilder)", "value": "9e0e05dd4b3810cafeccc8644f470d6e1b69221ffeb8b620aa3ccaf4f18de6c1f48759e08efad742348e072e83689d54", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630092, "uuid": "fb5224b5-ffbd-429c-841d-1e3e4c8f6955", "value": "T1B823B646BA5D9859E9258B7548E743E9B333FC201F6B0B833616B3257FF49E05A03207", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630092, "uuid": "c081e00c-0325-4d52-8190-c700696ffa36", "value": "768:4DM52tfQXi8vgLZkTOHkQT51Vp6AwPdM8gQ6JT5X6DGwUdh+pqjeSLjcvLtzrxFK:462tfQXi8vgLZkTOHkQT51Vp6AwPe8gv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650630092, "uuid": "19f28112-6f7c-4b94-bca0-29d0a0763a0e", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650630092, "uuid": "09607e72-579d-48ea-a9e4-2202aa5c33f7", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630092, "uuid": "b282fc9d-5022-4f49-8c24-09219d9e8f3c", "value": "Scan_20222204_27216.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee69d209-c296-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650671404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650671404, "uuid": "af43d93c-807c-4ba9-aec7-2acc7c18142b", "comment": "Malware payload (Mirai)", "value": "60c98f471abcfcfccfa43c1c0e1fbb9d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650671404, "uuid": "c125e6a8-6479-4734-a172-eecfda2a95b5", "comment": "Malware payload (Mirai)", "value": "5995bae2f55af6942ba96baae428fbfc75ec619380b48dc0c73f154f1192726c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650671404, "uuid": "c1f60da6-8bd3-49db-b2c5-539961de9695", "comment": "Malware payload (Mirai)", "value": "40a22c16e57644013a2fa07efc7ea80431f11a95", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650671404, "uuid": "da07bfa5-a863-4add-8342-5ed64213028b", "comment": "Malware payload (Mirai)", "value": "1515914ea1cd1904fa5406a93fb0c71b2814fc86dde0c07f70e3659e575b1a15c350dc744e20d306cd24f49d27178368", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650671404, "uuid": "8ceb5000-13d5-4470-8eda-d2515faa57d2", "value": "T19723F16322C4A59BEF742277F93E490E7A860379F5D334B1AB1811B4BC8C2E25797582", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650671404, "uuid": "bf4cbb6e-3776-4ebe-98bb-e542f55522a5", "value": "768:KmFwVaTZgrb68kc4D2G5hLcQERiLtHGIXoKrboVR9q3UELlO8IPYtuleOm/O4yu1:Kta1UYb1nL+wBmIXoPmLlOflleB/O451", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650671404, "uuid": "0b6c8a0f-2b10-4e89-9edb-c74c39c6653f", "value": 48280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650671404, "uuid": "d45a2e3d-8826-47ed-9cb9-289198853802", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650671404, "uuid": "ad9730e2-fdfd-4c43-9e48-a8359f4ce5b0", "value": "phantom.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52852960-c289-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1650665559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650665559, "uuid": "52cf4485-1f73-4dd7-9493-01a1c07f2942", "comment": "Malware payload (Gafgyt)", "value": "f0c960173211addf059f8d6ce2943892", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650665559, "uuid": "eb033f22-b970-42bd-85a6-6867797fb51c", "comment": "Malware payload (Gafgyt)", "value": "59eb910212ac03529535b92acf0956c4f5b8b0158ac62dafca7523eaf2acf186", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650665559, "uuid": "3ab962d0-4738-4382-9653-7b8dd66a0f78", "comment": "Malware payload (Gafgyt)", "value": "1c8d8e1a7a040d5ee84530f84e13676ded54b20d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650665559, "uuid": "132f55ab-1ebb-460f-99d9-e1a3632eac52", "comment": "Malware payload (Gafgyt)", "value": "aebbab13aaac6ab2d16dfea4f7cfc5cf3603696bef724e1eabc9656ccd54e23eee81ca6c5e48d635075f182c1c9fe62d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650665559, "uuid": "a1bde776-0ec5-4aa1-a9a8-2a208c1600fe", "value": "T156B3D86A7921AFFEE06883310BF7AF20C7D521D626915386F15CE7585E3128D2C5FBA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650665559, "uuid": "fbb99eee-f271-479b-90bc-9f9f7d096cb0", "value": "3072:C/4g3Kd1rl5hZmxgA9OKdwwjF9GhsR1Ae:O9anl5hZLHKdwwjF9GhsR1Ae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650665559, "uuid": "08a36fdd-a94b-4db8-9fa1-548aa35f17f6", "value": 116503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650665559, "uuid": "a905c0bd-314b-4b30-9b78-79a32834e479", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650665559, "uuid": "6161126e-d99a-4301-bb97-36743768da28", "value": "f0c960173211addf059f8d6ce2943892", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e740fdc-c27b-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650659646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650659646, "uuid": "5aa77ed9-e5e9-42ef-9c6d-85082eeada84", "comment": "Malware payload", "value": "bf4a38e0f4a9882e8f2ed78e9d3d00a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650659646, "uuid": "a9330de1-a12c-49a6-b34c-ac2f9bf9deec", "comment": "Malware payload", "value": "5a7d060857565c5cf8e7a16d1ba0e5839d45463da994b6eda0a8e198019d89f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650659646, "uuid": "bdf3fe17-4524-4c38-a20c-33a466e54b9a", "comment": "Malware payload", "value": "911ef07cf42d6767f5ae66f867aa2f913dbeb61b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650659646, "uuid": "35aea18f-49de-4e4b-bcad-5ab5d1606191", "comment": "Malware payload", "value": "3dfb4584657cb0fc4fb0b4af92db9d02936755f4a3fef673b9aa1b7398a6596d4afd317a1a2c14c1b1961bb9aa7ae41a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650659646, "uuid": "f62bef07-be34-4072-9f7f-2b85871bbce5", "value": "T187D49D11F6AC80B5E07BD13DC9A3875AE6713C9847B943C79255EB2A2E736E05D3E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650659646, "uuid": "50a2547e-151c-43a4-b761-c3aabf0b407e", "value": "6ba79cbed2acbe9b8ecc8e14a572f100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650659646, "uuid": "ed1e22f3-5a52-481e-b0fc-ceb860d7f41f", "value": "12288:C1FIcocJwMTHzXO7N2BBHiyzskF1CubVnmn:tco9MTHzXO7NE/115mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650659646, "uuid": "ed956ba2-6097-4841-a68e-e662620d3218", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650659646, "uuid": "41516abb-af26-4784-ac7b-4d39364cec77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650659646, "uuid": "f4e3a861-5700-45b7-85d7-e047c3b3d01e", "value": "bf4a38e0f4a9882e8f2ed78e9d3d00a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d8b40b6-c22e-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1650626413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650626413, "uuid": "301806a0-2861-473c-a558-7ed63f2391b3", "comment": "Malware payload (SilentBuilder)", "value": "0a2134c337fd084d85530e5a29c72b8a", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650626413, "uuid": "0168331c-5f8b-4a5b-86de-4f2a188abb2d", "comment": "Malware payload (SilentBuilder)", "value": "5ab118279364f5f1e70588611a307ab6cca9256ff3113ca33d8a6490e373dc67", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650626413, "uuid": "82089d21-7788-454a-923e-567af97e451e", "comment": "Malware payload (SilentBuilder)", "value": "7564221190a576fa7162ea596805cddc5ab329f0", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650626413, "uuid": "1091a8e6-0ce2-4353-a5c2-055dde0a5dfc", "comment": "Malware payload (SilentBuilder)", "value": "9b8d211bf9bbfd7c585061c8c3db34c0e61a7d7c424af7dfedfd360841f6f7db48f68a5e9135bc63cbb941311bb2cd43", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650626413, "uuid": "22b747f6-c1f1-4d68-87a1-9930538f3b9c", "value": "T1CC23B646BA5D9859E9258B7548E743E9B333FC201F6B0B833616B3257FF49E05A03207", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650626413, "uuid": "d5a02537-3e28-458f-ae28-4b1f73551067", "value": "768:4DM52tfQXi8vgLZkTOHkQT51Vp6AwPdM8gQ6JT5X6DGwUdh+pqjeSLjcvLtzrxFm:462tfQXi8vgLZkTOHkQT51Vp6AwPe8gz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650626413, "uuid": "637d93ee-ec6d-486e-901c-6ebf67b382e0", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650626413, "uuid": "97c74d35-33a1-4d5d-bd33-3677eb83bee5", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650626413, "uuid": "e10d6c9d-f889-48ce-ad84-2971b1ea8d45", "value": "Rechnung-Bestellung-90008.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a883688a-c202-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1650607721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650607721, "uuid": "9d8598b6-d996-4487-8502-58a7997aafed", "comment": "Malware payload (AveMariaRAT)", "value": "ab2d017352502eeffd5db648208ba5fa", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650607721, "uuid": "43b5e7c5-b8b1-489b-8dfc-333e9c4390a9", "comment": "Malware payload (AveMariaRAT)", "value": "5ae23478cd4aefc74c446598bd1ceae3ea86c4c6a0ab2969358d79f8e6a4a172", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650607721, "uuid": "03191b51-e0fd-4340-b503-dd48edf5dd50", "comment": "Malware payload (AveMariaRAT)", "value": "c2ad4f08d9a7af86ba1a6f235b12fb8a5680366b", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650607721, "uuid": "8dc80808-e1b3-45f1-a589-801502ccad15", "comment": "Malware payload (AveMariaRAT)", "value": "16a7c4d68014bb21522954e1d807a96d980322c55b0ad8a1dddb23205d770f94b66cd4cea44bcfb57a0326520f12d922", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650607721, "uuid": "893cd7e2-77a7-4a3f-8666-2e21616444ce", "value": "T13F45120E72981771D4EF17F9A571130813B5A607A613F308B9EC32EF2F66784A611BA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650607721, "uuid": "535278ad-ccdf-48c0-9963-1611d3ec1305", "value": "6144:KUBKXaGChqkTzk2E2oIvD5seMisYhd28nPExa0AaAPIls3ueogX/f7M0PxSd9XrZ:HKYzhE2ouD5jeYh3i36Iz+4p9XSS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650607721, "uuid": "b61f7863-470c-48cf-ae5e-1ff804bdf847", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650607721, "uuid": "ceecbd28-9925-4347-9453-0c999c74e9fb", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650607721, "uuid": "1673ab9e-d05a-4945-a8a8-1c8950d976ac", "value": "ORDER-MVTOLEDO TRIUMPH-LTD.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d65eae5f-c23a-11ec-8e58-42010a9c0032", "comment": "Malware payload (GuLoader)", "timestamp": 1650631850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631850, "uuid": "fde186ba-38c1-4078-ba0f-765e9cdf5a1d", "comment": "Malware payload (GuLoader)", "value": "d6ac9afb0e047d92a53c2ba91be24c5e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631850, "uuid": "d7daaa66-4b52-446c-94d4-9429f1e688ef", "comment": "Malware payload (GuLoader)", "value": "5b5906fc1e6fe24738edb944789aa3c022bb4c5535323a3f516e76ddbabb7850", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631850, "uuid": "364b7ff6-db10-4bfd-a2e2-f78258d4ec5c", "comment": "Malware payload (GuLoader)", "value": "50951e5d9d6d88484a6c0844a24e7d3db23884a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631850, "uuid": "d66050d1-f621-4a18-83cd-3cbaccda4205", "comment": "Malware payload (GuLoader)", "value": "55ab8f34044079e80a4c266851b2b9580e6b42abeb7f90d4fe2caa30697bdba084659cd228096d3b3310293cd39951c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650631850, "uuid": "88adc9af-1098-4217-bd72-f04a86547230", "value": "T181B4C46E736096B8F45889B44937DC604A676C084B95C7DBB39CF32F147B9C9C20E8E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650631850, "uuid": "77e6c711-8443-4c75-95a5-9f037966bf42", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650631850, "uuid": "5de260e8-1dcb-4f3f-9cf5-05644bbdf8d0", "value": "6144:bYa6OpR9xyBMc+6/FSU78Yxj81hBYCJiQCWFsEN:bYk/9xyBMX6/FSU78YxjmYxQlsEN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650631850, "uuid": "a4797f83-f1d2-41b6-83b8-7674c1ff51ae", "value": 537344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650631850, "uuid": "37c777b6-f451-439f-94e1-48d9cca61da7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650631850, "uuid": "8436143f-e9b0-49e5-9dcf-d387ec510fa6", "value": "FRACCIONAMIENTO 1722403906461L.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc745aba-c21a-11ec-8e58-42010a9c0032", "comment": "Malware payload (QuasarRAT)", "timestamp": 1650618062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650618062, "uuid": "4f49f8a2-93cf-4da2-b3ad-4198fdd05b49", "comment": "Malware payload (QuasarRAT)", "value": "7a690238b7ada1318edede1f7190ac29", "object_relation": "md5", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650618062, "uuid": "7940bc99-722f-4786-934b-e3a6043eb8bb", "comment": "Malware payload (QuasarRAT)", "value": "5b6d5819cc000436777cda63e9022fdd19b15a91451c7b8c4608db9fcf3d359c", "object_relation": "sha256", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650618062, "uuid": "83ca049a-03d2-46b9-9b4b-cbdc3f053396", "comment": "Malware payload (QuasarRAT)", "value": "7c9df4979e1a5a9f205fc6c1e139112297ddc6bc", "object_relation": "sha1", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650618062, "uuid": "03d027bf-8eea-4580-8179-6bb0fadb098a", "comment": "Malware payload (QuasarRAT)", "value": "0330bbe6b7dc2ba2ec1d9c25d246bb4150c1322401221187293c4361d5aafdae3012797c2fd25a5245bbf2cb0c33226b", "object_relation": "sha3-384", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650618062, "uuid": "e2b3a67c-ac75-451f-bbab-7fab2e018bb8", "value": "T18FC5F17695B37D99FEFD0AA129102C578C101E1F97E24648EAC2B7F469E2C11EF380B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650618062, "uuid": "43edbb6c-e6b2-471a-bb03-68318f272bfc", "value": "24576:CHZqNW+LcY+MC/2nd7xTFgLO3pCVXB0byLVswFtuUoQhAdWXAYK/ZB6rDVoWhCLm:2ZgU8ZEOgVR0OJt1oZB6HV7QUumt05y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650618062, "uuid": "a9eab2e6-0099-4c28-b24f-cfbd510b6303", "value": 2542770, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650618062, "uuid": "c593a10d-47b0-4f08-be94-c506b71b2c16", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650618062, "uuid": "78ead520-dfb8-45e7-85bd-0fe449979ad6", "value": "Quote#1PDF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f9d32ca-c1fd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1650605451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650605451, "uuid": "91ee6e4e-2f35-47f2-ab5e-65502bd662c2", "comment": "Malware payload (Formbook)", "value": "55a1b24b20dcc97c9a12ea2617059725", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650605451, "uuid": "5f593e01-d85b-4efe-8789-fa7bf7ff2e59", "comment": "Malware payload (Formbook)", "value": "5b8124423be6af37ad74816af0d1df049bc6d740117e934947b067d5fa61eb0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650605451, "uuid": "378676f7-a1df-4278-b9cc-934465bc5126", "comment": "Malware payload (Formbook)", "value": "d94d89ceb8d16d84b868f3b90398f986b84b7b93", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650605451, "uuid": "40d44ef0-a474-414a-a131-76ed3feea889", "comment": "Malware payload (Formbook)", "value": "09dd5a96e444f4b9d6997cbaf2211aeacd70a029c5e50517de6836c1fbcd0e9306cd255035dfd49ea17a3cb485a629ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650605451, "uuid": "0b209515-38b0-497f-8d1b-2b9b97d63109", "value": "T13CC412217760C2A2C4BDBB3624E1404793F5D5231A1CA65D2EB7A2F77AA1390534FB8F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650605451, "uuid": "20fba7d4-eb83-4cd4-a8ef-9ce2325ccb19", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650605451, "uuid": "5d6bd9fd-5690-47d6-ac86-ea99bea42ce4", "value": "12288:HfL6SNHjifEMeY19SRBadXalpKywzUNhScJDgBuIUIgX0QlstY+AYtv/h:/eSNmwY19SitUFwzUNUDEXvatY+Bdh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650605451, "uuid": "a2375140-84e6-4c8d-96bc-1a5cf4ec0b44", "value": 566272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650605451, "uuid": "84f35f9a-7d33-480f-b3f2-274f84a5a2af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650605451, "uuid": "896578c5-768b-46ae-98af-a2212bfb5d20", "value": "purchase order #202204233111.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecf3389c-c295-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650670972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650670972, "uuid": "84ea8d1c-cb58-4c56-9f7d-004577d1a68c", "comment": "Malware payload", "value": "862701879dd9c3aa509a635f2b784775", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650670972, "uuid": "65c876ba-fb65-4465-893e-f672c9d9f1aa", "comment": "Malware payload", "value": "5bd1516783f4b30a393c0bcb4d2917c1ad49d60d36c9c3ceef768be2cc0d23d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650670972, "uuid": "3f28ce94-d7aa-4f69-93e8-aad71ad097ec", "comment": "Malware payload", "value": "85ab58fb18302dafe9317de6d431619a8191b684", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650670972, "uuid": "847f5f32-c493-436b-87eb-ce8e8620c0db", "comment": "Malware payload", "value": "26335dd42b5cce6e1f5c7f1a0cacf180e74698becaadbf64023b6571033c734747a98bc7395fdef5b2f46b446e0288bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650670972, "uuid": "49179dfe-91e7-4b02-8f30-cfa1b0365caa", "value": "T138D49D11F6AC80B5E07BD13DC9A3875AE6713C9847B943C79255EB2A2E736E05D3E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650670972, "uuid": "c8deccde-6f8e-4e7a-baeb-1004a98179ec", "value": "6ba79cbed2acbe9b8ecc8e14a572f100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650670972, "uuid": "a9719bde-b660-4276-b388-de14debce50e", "value": "12288:C1FIcocJwMTHzXO7N2RBHiyzskF1CubVnmn:tco9MTHzXO7NQ/115mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650670972, "uuid": "902ef5f2-9119-4e09-b9dc-0a902576dd13", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650670972, "uuid": "94388078-66ee-41d9-a7b5-704eb39784db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650670972, "uuid": "235c2e4e-0529-4f9e-a3f7-9b91c769be9e", "value": "862701879dd9c3aa509a635f2b784775", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85b75776-c248-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650637727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650637727, "uuid": "12021137-294a-4096-a12f-2054ee5975f6", "comment": "Malware payload (Mirai)", "value": "11ada58f0996ed2b2b4d25ca76b25411", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650637727, "uuid": "a7a92b4c-f7d8-42ca-a49f-a5e32f1f9b6c", "comment": "Malware payload (Mirai)", "value": "5bd7364b221164fc6082a67e8de2b4795eab0dc5f302c7a5c9b6f5bde1dd3e23", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650637727, "uuid": "36478ed1-9cd7-4c8f-9912-78d4a913bafa", "comment": "Malware payload (Mirai)", "value": "facaaed5d33047583ba09413cf20b63357e8ff10", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650637727, "uuid": "57e92e28-5eed-4832-a2fe-d4083d56aaf6", "comment": "Malware payload (Mirai)", "value": "a18f182f28a0531268b37b60860a8f8e687b28780ead613113bd86dd97d7b9495125b5631910ecbc2fc4968714b76dcd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650637727, "uuid": "624bc51b-845b-4f81-b26c-9b3c1599ff34", "value": "T156B31845F8408727C2D327BAE78F479D3B36579467DB33116A38BEB42BC17892A29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650637727, "uuid": "57db2559-a47a-4f3f-bd56-e50241a54961", "value": "3072:MSY+46m1qOzssmFPPKNy+AmkZrQAhPDCXFke:06mgOzJmFPzmkZrQAhPDCXFke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650637727, "uuid": "d5b83223-2b9a-4223-8285-01928371d24e", "value": 108417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650637727, "uuid": "372a9339-3db0-4f4c-b89d-3405eca1069f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650637727, "uuid": "91b17068-5713-4ec1-930c-8408864bda33", "value": "11ada58f0996ed2b2b4d25ca76b25411", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a46f9fcf-c221-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650621029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621029, "uuid": "92d01f59-f921-42ac-9f22-6fa8072bfbfa", "comment": "Malware payload", "value": "84a0caa665d41ecf13f0f4b1538902e8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621029, "uuid": "a245cd26-acf9-48c7-b45e-814f0f7badb4", "comment": "Malware payload", "value": "5bf9031b8217aa1b550ba8e8d7fe9de921ff20bc76f356c63f01abf48149271e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621029, "uuid": "f8e18462-6ebb-4fd4-8abe-232fc31f8907", "comment": "Malware payload", "value": "e92e97acb12f4f0fe1792d32b7a08306457a2da6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621029, "uuid": "04dfb041-16ef-4ead-bd9a-912f1fb837d7", "comment": "Malware payload", "value": "bf4634bffe5d53f1571827df31f6892d07758ace0486697b3af68312688c32eb82f4cb87f3fbd20baab81ec33dd02bc2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621029, "uuid": "c3194c15-81f0-4f88-a6b9-a0b4f600e248", "value": "T190F53A32B2C4653AC06A3A3A5527A278F93B777167168C5B57F0C88C8F357436A3E607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621029, "uuid": "f8e35153-903f-40a8-8160-1bc8ca0d5a70", "value": "3e10d667044ca2abc0862360adcdbf64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621029, "uuid": "479876a3-4ba2-401e-a885-10d0fd2ecd86", "value": "49152:6ZZQrdvsIn1ZaSr/cD72QU8hb38aAoYT4+oqkdkPp8t:6Z2stUUbMaAUqkk+t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650621029, "uuid": "322e0791-69ad-4a13-967d-c6ea36e0e523", "value": 3629056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650621029, "uuid": "3a2a7feb-eb12-4f43-bc69-95600c94c26e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621029, "uuid": "f0def61e-cf8a-409c-8d74-12fe4e0059fe", "value": "SecuriteInfo.com.Trojan.DownLoader44.46872.8950.4487", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a2c2aa4-c221-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650620984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620984, "uuid": "31e86d9c-a719-4fa7-92ce-019e4f15db0e", "comment": "Malware payload", "value": "cae8981019a416e7ed8e73fdc207cd97", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620984, "uuid": "ba565088-5dfc-4be4-9dd6-4b089102e168", "comment": "Malware payload", "value": "5c39dbe535817cb0b5a540532e3275f61e2cdb21a610e9c29c29ce7a6f5ce070", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620984, "uuid": "76f3abcb-eb3b-4215-b0cc-833a7b9eac5e", "comment": "Malware payload", "value": "bf589e705c51d203730d3da7567b967a7add0933", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620984, "uuid": "3d135a7a-c2b2-4a1d-a81e-c3fb7be5c659", "comment": "Malware payload", "value": "0569de005ca74734d9c107d707bf1cdd18f6f94b38894b053ae9c5d2bf30529a821777d150fab4ed11a4156e9f415072", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620984, "uuid": "3d7c6add-14f3-461a-834c-5c2eba888905", "value": "T146463826B688B63DC49F0A3A9537A65C9D3F6772B912CC1757F4088C8F364816B3E607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620984, "uuid": "b0d12845-de9e-463e-adc9-6dc92ffce538", "value": "57c2177b8e3585595cd7584343dd36e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620984, "uuid": "a1102086-5a44-4a42-8df7-14dd884f5ea2", "value": "49152:h7VF6CA09B5Qx0SBvNcTDt1aN08e31wqv+ouUwtNi6xmTdy44v2q3geYx:tVFHAudlP3SOTuXtNNxU4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650620984, "uuid": "98db9ad6-ddc4-47bf-b7e4-47cf5a221716", "value": 5391360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650620984, "uuid": "0be48e64-bd81-4f1d-b6a6-d1f6cf7eaeec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620984, "uuid": "a3796129-3835-4786-bf94-e5350da77f34", "value": "SecuriteInfo.com.Trojan.DownLoader44.45166.22386.17966", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "171ff39a-c25c-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650646132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650646132, "uuid": "19c6ade1-a3f1-402d-96bf-6eb0ce9dbd25", "comment": "Malware payload", "value": "4ed092231b8332cf314f2c23cd4d0d8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650646132, "uuid": "248213a3-8015-4fd4-8fa9-37bf91baa94a", "comment": "Malware payload", "value": "5c4c8230758946f60eb2cd0c13bd9dd95d0a9608e84bf5039e6a95e1bc4391d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650646132, "uuid": "8b193786-a680-4964-9170-b014c4bee8bc", "comment": "Malware payload", "value": "85b51f43dc0ec4e80f3db932040def83b7f7ac28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650646132, "uuid": "35d063e2-9b97-4285-8c09-4198b4db411d", "comment": "Malware payload", "value": "04f89a6a84daf87a68f0f851ab2f6f787722c660973b63b996e01c68a6083800589b5b2fc1a3aada2a8e58c864fb54b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650646132, "uuid": "506839f1-a41b-40e4-911d-30f25c34ca2a", "value": "T10CD49D11F6AC80B5E07BD13DC9A3875AE6713C9847B943C79255EB2A2E736E05D3E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650646132, "uuid": "bcc7a70a-eb3e-41e7-b147-eb940d24be8b", "value": "6ba79cbed2acbe9b8ecc8e14a572f100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650646132, "uuid": "c975d1c4-2614-4afe-88b0-b7f4e4059db6", "value": "12288:C1FIcocJwMTHzXO7N2qBHiyzskF1CubVnmn:tco9MTHzXO7NX/115mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650646132, "uuid": "8f04b1c3-26d6-4ae2-9ba0-56ef33e32aed", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650646132, "uuid": "544d041e-353c-4d1c-b1f2-e863cc050a8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650646132, "uuid": "39cf799b-db8d-4ac9-a61a-7afbbc005b1a", "value": "4ed092231b8332cf314f2c23cd4d0d8b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7374a20f-c239-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650631254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631254, "uuid": "8483fe42-c160-4582-9250-35d9825adaa9", "comment": "Malware payload (Mirai)", "value": "948589a8310dc3fa1b4c80fb13d5d12b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631254, "uuid": "fcb27ce8-8407-4332-a7f0-5783194000b9", "comment": "Malware payload (Mirai)", "value": "5ccf3fba619de332c1628eb95b670f54fe216f35e7044a5039b2fcfa27c69984", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631254, "uuid": "1b85cedf-1d92-4e09-ab43-c69a61308c0c", "comment": "Malware payload (Mirai)", "value": "e49bbb4415c1c79229c5638df56d742323da59ab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631254, "uuid": "60a4ebff-eebf-4ca4-9682-fec78cc942f9", "comment": "Malware payload (Mirai)", "value": "dfd698dc6b3ad491ee4a52451d653927cae4fb526baa59535365dc5f68908575ed49074179740deadf3ad55ddf15382e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650631254, "uuid": "335dc17c-a7fd-407c-ab24-8ac3b3afa917", "value": "T1B7C33A05E4508767C2D2237AE79F825D37335BA497DB33219A34AFB42FC27991E39920", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650631254, "uuid": "a78e6739-ebe8-4d8d-b4d0-9b3ec0ebf7a8", "value": "3072:LkYPK8AqnnCxEWSa7/N9V5hwCDE5kaQ+mTQOY5NX3cn:4YPK8AqCjSaTV5hwCDEZQ+mTQOY5R3cn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650631254, "uuid": "3a0053fa-b95f-413f-b171-7b3735809740", "value": 127864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650631254, "uuid": "f2788b2f-ebff-48a6-b6b9-cf242e07457c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650631254, "uuid": "e6f09a9c-aa5a-4f9e-9e54-18b999d8ffcb", "value": "948589a8310dc3fa1b4c80fb13d5d12b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98e2668c-c221-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650621009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621009, "uuid": "14433dea-531a-4b07-a294-0718cba62a84", "comment": "Malware payload", "value": "4df734b37a631d2a83b3a8b16e9db1d1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621009, "uuid": "77ca0e4b-458e-4783-ac38-6dbef1d4ca46", "comment": "Malware payload", "value": "5cf3bc90746f3ee3280dedd386de0c1d979985682bcaecf6992b87ccb38b8d5b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621009, "uuid": "5acd917c-01da-449b-90a6-859968f14ac0", "comment": "Malware payload", "value": "e95e3e71b40649fb935bf270011038f7d64800f5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621009, "uuid": "2c324ed5-fc15-4d8f-8412-0b062c547b19", "comment": "Malware payload", "value": "9d75b5b0f15aac26c70cc0365a9ce635c9a1df26d566351962298fa6470623c02898fea89faed15947924b90fb67d5c2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621009, "uuid": "6e9a8124-c488-48ec-97ac-10485ce68d69", "value": "T1F9E54B26B2C4653BC07A093A9937E238B93B667D25168D4657F0C87C8F35B43E63E607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621009, "uuid": "a0bf642d-e21e-4fe0-91d2-334584305e6b", "value": "2a97021eabc6fcdb9ad8a5df08c6771d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621009, "uuid": "259960ac-7fbe-4599-85b3-4d553d30fbd9", "value": "49152:nf1N6NwN9L1jRoSH2wEBxmcZ/c7TS6Hy:n4wnfu0xH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650621009, "uuid": "4172e404-c45f-4b6d-afd5-e101e40c1259", "value": 3161088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650621009, "uuid": "2060809e-7d2f-4983-acbb-8dfe981ea47a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621009, "uuid": "f65b5f47-d0e0-47f1-805d-1c2cfe5f0e52", "value": "SecuriteInfo.com.Trojan.DownLoader44.44911.32641.19154", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93517388-c221-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650621000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621000, "uuid": "5d70e7cb-740c-4b88-96dc-625c1512579a", "comment": "Malware payload", "value": "567af26d9b642bf19a73b6c15b7d7fc9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621000, "uuid": "777b9f68-bc04-4785-b45e-0493f1a1a0e6", "comment": "Malware payload", "value": "5d0f672096817ae9f20bb6b9ae00feac8f13fbdf847a86411ab4c1868a02fe17", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621000, "uuid": "45e333ed-04f1-401d-911e-0bdad134e2fd", "comment": "Malware payload", "value": "5d027a2b258983140454100ac2c2c3b5e288c297", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621000, "uuid": "7cdfe88e-33d4-41f6-998c-cfa1de1ed42c", "comment": "Malware payload", "value": "f876c2eed2efd052f4044029d673f703175eb7f9b054e8ed31e2da24f0f0ae21b0616e616750c1fd495828ef391ddbdc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621000, "uuid": "591d2995-2b65-4b82-93fa-6dfc0c7b52f7", "value": "T14274AE1373C0C03BC5DB0175A61A43B24AFAB4708972929FA7C9436D2FB66C2E7663C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621000, "uuid": "6890684a-364f-44a1-a11a-3a874ddb09a4", "value": "9957bfdb6f7078196a235a87cd0fe46b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621000, "uuid": "fe000c50-87c8-4cc5-befe-3cec7382e99e", "value": "6144:JHsXmHCojK+JCtIGoPLOy0/Ffm2R86YLP8fidsY3rXL:JHsXLoe+JI7oO1/F+2RfYL+iJr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650621000, "uuid": "52a577e1-d1c5-4440-8b15-8598dd96e3a4", "value": 364544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650621000, "uuid": "0228579c-b2b6-4320-90b2-e206a655f5a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621000, "uuid": "6d7e970f-2530-4864-ba53-ed7904c1aef1", "value": "SecuriteInfo.com.Heur.3561.302", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33c670c2-c24f-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1650640596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640596, "uuid": "bda95333-5f3d-4a3d-bec4-e30c85fbc572", "comment": "Malware payload (SnakeKeylogger)", "value": "bb56dd1808ea50465d68866b08ea6184", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640596, "uuid": "9122e402-f81a-4616-b787-4e996d083cb2", "comment": "Malware payload (SnakeKeylogger)", "value": "5de9b5ddd0e2581e82a8a543f55ef8bae7df3e404764e341036ba9080ebd7c57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640596, "uuid": "40a6e65f-3aa7-4159-a2f5-d10979f37068", "comment": "Malware payload (SnakeKeylogger)", "value": "015fb21c99cbb63cbd79e85a1f9e81426d9326a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640596, "uuid": "960a5db1-6cd2-40e2-b1f0-11a6f31e19dd", "comment": "Malware payload (SnakeKeylogger)", "value": "694518772a9853741274c43842c98c8ef5729d8f39fd658458f798a9fe07acbbd3eccb7549a87d2446e6386993810976", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650640596, "uuid": "e2727a62-a908-48d5-a63e-951be5f3ef2d", "value": "T12FE4128132B89B33ECBC47F794B0B5A013B5211BAA45D68C8DCA70CB1575F690B91F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650640596, "uuid": "9e901aac-51e9-4506-9635-222d698ec465", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650640596, "uuid": "0a23c07d-80c9-44f7-aa37-002e7903a23c", "value": "12288:971pV0i70rUNEVwzobp1Uxh2M3zCDHfQakjZkONPwI3sP6:l1j1cUzobTWk2gfQLBp8P6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650640596, "uuid": "c9b1b90c-96c1-487c-9607-9fa9b7bc3d8d", "value": 690208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650640596, "uuid": "d4811aec-bb47-4f9e-94d5-f8d45cafdee0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650640596, "uuid": "10014ee3-755d-4cf3-aeb4-427fb2d2cf74", "value": "bb56dd1808ea50465d68866b08ea6184.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbf95952-c242-11ec-8e58-42010a9c0032", "comment": "Malware payload (AZORult)", "timestamp": 1650635268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650635268, "uuid": "0b082a6c-4a32-4d05-af8d-ad18c28bb248", "comment": "Malware payload (AZORult)", "value": "0167add7fe843212624f60cc748522ec", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650635268, "uuid": "aaedeb06-1099-465e-9421-ade18180c6e2", "comment": "Malware payload (AZORult)", "value": "5f72024cc8a15038a120024eda6225ea45982eb8d5f37ab49d0b7b0391e9b8b2", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650635268, "uuid": "bfc04dc2-9e3c-474c-be6e-f60cfd2baa39", "comment": "Malware payload (AZORult)", "value": "e3fe43b5d4638e41c5f75517f934c80e76eadb9a", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650635268, "uuid": "37f8acff-2a35-47c9-a510-dd7dd24b4283", "comment": "Malware payload (AZORult)", "value": "6056b2f1cf8ac636f3b71b8024b1265d4e0bf366631bc6a75f8d4b27f92028df98897c4f1a00f2742ac8ad3b4837ea2a", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650635268, "uuid": "ec9170a5-7fa3-43a3-8278-ff5274065717", "value": "T11CA4122137F08B21D678E7F55C602A45E3B167693A01F3280DFAE4FB16227442B65F9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650635268, "uuid": "6c473f18-096c-4d99-9946-7e5552424dce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650635268, "uuid": "7671c83c-018e-482b-a4e2-0b8dc9612c53", "value": "12288:GyAYtv/h/DizvLdL3UXJQnJC8bzYyPBE:ZBdhivLdL3tnJZzY6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650635268, "uuid": "d5a82009-04bf-4606-9a14-67e895b000df", "value": 451584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650635268, "uuid": "e9be55f2-ba2e-42f9-841a-799f3dd0c10e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650635268, "uuid": "ae330a66-003a-4866-9425-8d239053eb34", "value": "Swift Email Bildirimi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "727eb416-c256-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1650643708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650643708, "uuid": "532a546b-0627-4e53-b959-eea559e560de", "comment": "Malware payload (Heodo)", "value": "534129299d5011fab9945b6f8ddbc76e", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650643708, "uuid": "5de65d77-2bfa-48a0-ac57-23975df5dd84", "comment": "Malware payload (Heodo)", "value": "6034ff5e40bab0b1a747025154bf0690d332ebad1892d7e1effb982dbd19344e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650643708, "uuid": "88bc9580-fb77-409d-a081-a0569a564e64", "comment": "Malware payload (Heodo)", "value": "2218c1e300d1422e51e6f6f3f5671256befc5c21", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650643708, "uuid": "4ec44ac9-28d8-4724-90bc-60629452cf7d", "comment": "Malware payload (Heodo)", "value": "1b40943293aaa12d9845cf1e3f0515f557b5cc01e3b663e49bcc19169c123da7a95bb81f3b1921520ed827a26bec0237", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650643708, "uuid": "c05e07b4-2d1c-45b5-8436-1723cda0e08d", "value": "T1BD23E02AC5207828DB3A4C35820469D2721A7D05DDD5FB5A3145FB4C3B86BFB53AF88D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650643708, "uuid": "e51e120e-1f62-4ec0-9b16-3f13cd4d9bf6", "value": "768:L1m2o0pOODOevZCwrvtTzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0Vf1V5f+:L1HoadD3tT5fTR4Lh1NisFYBc3cr+Uqu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650643708, "uuid": "51945460-81f2-4e50-af87-11b3cbe7a00a", "value": 47653, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650643708, "uuid": "c827bbe5-9c35-4159-b5fe-c7664ff166ae", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650643708, "uuid": "0d7e343f-bacd-4291-9d4a-a5676b27459e", "value": "Latest invoice with a new address to update.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2238f32a-c21b-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1650618233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650618233, "uuid": "47e70966-c188-4a8f-95f8-cb59ef2da2c3", "comment": "Malware payload (AgentTesla)", "value": "fb2f48faeea2cad3359b3a163e19a48e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650618233, "uuid": "bed43dfc-8767-4192-a5eb-f56f1ba1bae6", "comment": "Malware payload (AgentTesla)", "value": "60ad9b79fa3fd8d43aad5145ae7916fe04f55e487864946cad9523eaa8de02dd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650618233, "uuid": "a6fdbf73-3837-4f38-8a2e-2ed8341119d0", "comment": "Malware payload (AgentTesla)", "value": "0fc4c6b78b8732eb66579738d1a126fcffade953", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650618233, "uuid": "24c6e9c1-29a9-4a77-a6e8-05167be6264f", "comment": "Malware payload (AgentTesla)", "value": "904de4b3dc207cb9541b2b0abfa932d24e63b8fdc7fc7688d022e244c83618482d9268b795c8a23e37149e8597f1b87d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650618233, "uuid": "82e98395-1f65-4449-822c-a382ca6929e1", "value": "T1AED4126F55893B13D2AE07F14A74929103B9306BA812F02EDDD131DE18E6F987E11EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650618233, "uuid": "3a329524-96c4-4e67-a460-2bf0e72fcacc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650618233, "uuid": "ff4d80fb-254e-469e-915d-bacadeb6f1a7", "value": "12288:yV7zo2qHi+pgSBxtctIyhguyGd+SuhM7VG77gbcF24sCA:4ZiiSgtI3aVOgbmV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650618233, "uuid": "e494508f-8234-4db0-bcea-69a7404efa4e", "value": 602112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650618233, "uuid": "4697e7e3-4f5b-4bb9-a842-3fe81e92388c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650618233, "uuid": "8ada841c-c825-426a-9fa3-ec7ccfe71d38", "value": "DHL Tracking Information.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a9dd93c-c239-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650631239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631239, "uuid": "57e22b99-8903-4476-977d-4393b490c536", "comment": "Malware payload (Mirai)", "value": "48dcbd8e225b8bcd978a9c222840de51", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631239, "uuid": "8fc35d62-9d59-4781-a61d-ef8b4dd895cb", "comment": "Malware payload (Mirai)", "value": "60b6d2a5bac9c563de38481189414ac84a4c0432aaab8b7ced16af6d9abd6011", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631239, "uuid": "75405601-7cc9-44ff-8206-4bc10b62026b", "comment": "Malware payload (Mirai)", "value": "75ed5af62ebf093d16a0ddc03cf52fc26184c2d0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631239, "uuid": "3ce7f381-6684-4e19-95c6-b690fd4abae6", "comment": "Malware payload (Mirai)", "value": "dfdc0219a74a4d8037556d9765bba186fa62eb5e4d50bf63f61a46b04961c861d1bcb54af3328f766dd5455554404b2a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650631239, "uuid": "e0147b67-f818-4ff8-b2a1-90d419a19507", "value": "T186F33B05E6408B57C1E2277AE78F424D33339BA4A7DB33159938ABF43FC27991E26911", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650631239, "uuid": "10b7271a-4992-4873-ba25-b961b62812e4", "value": "3072:e1g2WIM5SIee47vW/Ka0F/mW5hATSqnyLRM/9IUXcmFwfBxKQodn:Ag2hM5SIZ47u/Kao55hARnydM/9lcmFB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650631239, "uuid": "8abf96e6-ebe4-43f1-a227-2ceb834184c8", "value": 165297, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650631239, "uuid": "685cc070-3c49-4795-8b87-31acb52723b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650631239, "uuid": "f45b9815-42e3-4871-9fe4-758d43d1a11a", "value": "48dcbd8e225b8bcd978a9c222840de51", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64603e3c-c255-11ec-8e58-42010a9c0032", "comment": "Malware payload (OskiStealer)", "timestamp": 1650643255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650643255, "uuid": "49b15d77-5b36-4403-a9ae-fea3826b665d", "comment": "Malware payload (OskiStealer)", "value": "e59c2c3d0584073fb66654612fba1e05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650643255, "uuid": "664abaaf-69c8-4c9c-af47-a9442c839922", "comment": "Malware payload (OskiStealer)", "value": "6107e3ec5898ce2f80b04ee16b3a41107a0733339cded01cf8c5ade5fc105472", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650643255, "uuid": "99bf73f7-87d0-4951-aa42-d3e299df0960", "comment": "Malware payload (OskiStealer)", "value": "92f39bbf9880b17b10e8b16de76d8a14d30aca1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650643255, "uuid": "f3fecca2-2d23-4f2b-9b16-922dbe2a513f", "comment": "Malware payload (OskiStealer)", "value": "2b934de5781ab477841aba40cce70e12f2b9fa314801c5448eb8cf62f88fe52bf3158c5780e91970902211b054f3529b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650643255, "uuid": "a0ef17c8-a140-44af-b445-a53fcf0c3c9b", "value": "T18FE49DE2CEA0254DC9155738E0E3CCB1E5CDE44C642D7788747067176EAE3C0DACABAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650643255, "uuid": "6e86408d-118a-46f1-b284-6b59a89693e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650643255, "uuid": "e04d5469-fc08-4148-ba48-21efbc0ba741", "value": "12288:osJrx24EXSOvIdBKxTWz1Xj+rJ32ikYuFg:ogo4YQkTWZTk32HF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650643255, "uuid": "fa131dec-d5cb-476a-83ab-5673373cd8e3", "value": 661504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650643255, "uuid": "1ef53729-db88-4d1c-9335-ed7ac9270af9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650643255, "uuid": "c6386ff3-5f4c-4133-a302-2de9e3cce565", "value": "Inquirypdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "732ccd00-c21c-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1650618798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650618798, "uuid": "17b80698-8645-4976-ad18-27f701e4fec9", "comment": "Malware payload (RemcosRAT)", "value": "4f5b3d6e61fea2bc5cbecb8feaf7c585", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650618798, "uuid": "e0e03c00-076c-4ad6-a206-e333099ea787", "comment": "Malware payload (RemcosRAT)", "value": "6147f65ac8a998e2ca8eb9de8d41b252210cd6aaf6726d6e617b4c4ab4988820", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650618798, "uuid": "00f2c86d-4335-4824-9b45-eb9aef3b22af", "comment": "Malware payload (RemcosRAT)", "value": "dffc8914e50db34276a8e28e19e838a2a9eea62a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650618798, "uuid": "ad6101bc-9422-4079-9e9d-8d3ab79390ca", "comment": "Malware payload (RemcosRAT)", "value": "e12bbf49be447d4b1f8827cb585d7b9f245208333d12f402255511a84183fab14ecda8f2945b8d1983a2e83b7337ea75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650618798, "uuid": "fe2d8592-a545-4a58-a669-928a31243524", "value": "T1F645BF2326C65D5BD07B62B463190D945AF1BAAFC031CB9D7DD811CA8AE2E634713B33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650618798, "uuid": "b9eead9f-3ce1-44c7-9a99-bb690385230a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650618798, "uuid": "1bdcc96e-8da8-41ff-81d3-135ce52343f0", "value": "24576:SDxanRqFHf7hEmc1Cy/DnhHR7c2cv9jUdCG:vy/7CoWDnhHRI2c1jU7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650618798, "uuid": "dd8e88b9-4a0a-4b8f-867a-8498903ccdfd", "value": 1264024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650618798, "uuid": "321e1352-4652-49db-a84e-620108dca05e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650618798, "uuid": "c363fd7c-fe4d-453f-8899-86fdcc19cf18", "value": "4f5b3d6e61fea2bc5cbecb8feaf7c585.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b02e1e6-c23e-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1650633334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650633334, "uuid": "43225e2f-d293-4b46-8991-a119df3da50b", "comment": "Malware payload (AgentTesla)", "value": "f94e383cfbe2f7a50840fde37b298ce5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650633334, "uuid": "ce829516-e558-4127-8433-5a817ef037eb", "comment": "Malware payload (AgentTesla)", "value": "617aaf2ce2cce4044d297c382ab984a32af499f0dde146ab8490dcf776e95ab3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650633334, "uuid": "c870f7fc-ef4f-4de1-8283-5c5b7a654087", "comment": "Malware payload (AgentTesla)", "value": "5e213b7de5eeff169cd0eb47a5cb2d8ccc5d3cb5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650633334, "uuid": "d8e9380a-ceec-41ce-8566-11c3ad3882a7", "comment": "Malware payload (AgentTesla)", "value": "148e14eff165ec45a28c809ea404e531520dcc6d34056f542a72a589a92b61dd223f346f88a2abdac7fe4ac645bb14e4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650633334, "uuid": "36dea39b-874e-4549-aafb-6d970aaab659", "value": "T15CA44DAC7AE15A62FC0EC0B34D018A09BB660F1332909BCF57DB25F9C74E6652D65DC8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650633334, "uuid": "82ec1023-0da5-4124-81cf-995a56e03441", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650633334, "uuid": "f2df3101-269d-4db6-89d6-57dd80d765b5", "value": "6144:ZCXo+CbPIDQmGF0tZW+mk/VGsb++hj8mYiaJ/FEhcjoCExV4g5MvTi9:ZCXoF8tGatBrrZ0CqjoCExt5sTi9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650633334, "uuid": "b539a596-961a-4041-b7af-11327699ea32", "value": 474624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650633334, "uuid": "00cfc8f9-c3ca-41af-bef5-a6cbef693908", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650633334, "uuid": "437a58b3-9cca-4d75-b5b0-0da26317ba4a", "value": "034 MV MONEMVASIA - VESSEL PARTICULARS.xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7630f62d-c221-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650620951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620951, "uuid": "617e6636-7baa-468d-bffd-aa85ecbf819f", "comment": "Malware payload", "value": "3eb45768d3e5a1fec11d699c40a34db8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620951, "uuid": "908c9891-60d4-40e8-b951-b3480cb27e4f", "comment": "Malware payload", "value": "61dbd74d87f7f6e2b5393107274fc55fa03f444fcc8a701f6370ab84aed7563d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620951, "uuid": "150e4d32-ba02-4a51-9a4d-fd904ee91f51", "comment": "Malware payload", "value": "f60b75b7d1c2da634d98f9fada02028ba7b7e3b9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620951, "uuid": "6bab7a51-b41b-4125-842d-9e5477b884fd", "comment": "Malware payload", "value": "cb1e1d32ebe48b1fbc6202535dce4233875e36975bde5073cb9237f8fdb85f85ecf4ee0690fc69ad3bfd0701481dfa43", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620951, "uuid": "43f44821-d680-4216-84bb-f7f62bccab08", "value": "T179464926B688B63DC49F0A3A9537A65C9D3F6772B912CC1757F4088C8F364816B3E607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620951, "uuid": "e57badaf-b29f-4807-8668-4e2ed3a7f36b", "value": "57c2177b8e3585595cd7584343dd36e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620951, "uuid": "0fe7d453-a9e7-45c3-b992-18b8ed839fae", "value": "49152:h7VF6CA09B5Qx0SBvNcTDt1aN08e31wqv+ouUwtNi6xmTdy44v2q3geYx8A:tVFHAudlP3SOTuXtNNxU49A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650620951, "uuid": "fc76fac4-2e4a-471f-abd8-d78141e48ebe", "value": 5451264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650620951, "uuid": "13990659-9844-43ef-8e4c-97d20c5819a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620951, "uuid": "578bf50d-04b6-41b0-b75e-5d4defb952bf", "value": "SecuriteInfo.com.Trojan.DownLoader44.45166.28333.27454", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2395390-c1fd-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650605617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650605617, "uuid": "5040f6fa-aad5-42f9-92b5-0da400c0e0a1", "comment": "Malware payload", "value": "cbf2145ebbec19031edc4a234e0f75ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650605617, "uuid": "6e93165b-31ec-46f6-a4f1-bf1a9dbd309c", "comment": "Malware payload", "value": "625b414a29d10b09d84a02f01c2875db8bfdc3bb37963b738be8d2ff7663ba82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650605617, "uuid": "1fe063cc-8fba-4e14-99b4-24b137b38620", "comment": "Malware payload", "value": "64b50cba58361ded8baf56d3f2b6ee99bc1933eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650605617, "uuid": "306f6bef-dd4c-4ba9-8001-cece1ae2b18d", "comment": "Malware payload", "value": "abf7d54291d1aa7b16b6be044fd682fc4b7091f29f85814ef71e95ef8b1ac550dfa651420fbd5c3014679bcd964cfd2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650605617, "uuid": "2cda93ae-47df-4d3a-a158-43de05302791", "value": "T1E3C2D073CE8084FFC0CB3432208522DB9B575A72656A7867A750981E7CBCDE0EA76753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650605617, "uuid": "cd4e8364-2270-43cf-8a81-8cebe18448c7", "value": "87bed5a7cba00c7e1f4015f1bdae2183", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650605617, "uuid": "d4cd9c3e-592f-4be1-ba8b-9a00ca6895ad", "value": "768:bd5u7mNGtyVf7AsQGPL4vzZq2o9W7GsxBbPr:bd5z/fcvGCq2iW7z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650605617, "uuid": "b741ec57-5a91-44b8-8cdf-8a50e2422f05", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650605617, "uuid": "4190b132-a53f-4592-8a90-4d5e3b4926c3", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650605617, "uuid": "711706ff-0c20-48f1-91c9-7c1d943d5560", "value": "MAD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53a547ed-c211-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650614021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650614021, "uuid": "3a7f2a16-6622-486e-8020-7754b9526090", "comment": "Malware payload (Mirai)", "value": "cdd360103f899bc893f9d390efc975a6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650614021, "uuid": "4f615c4b-386b-404c-b5dd-4ecc97a85ce9", "comment": "Malware payload (Mirai)", "value": "627a9d8898aaf7ffddb1af98788731e257d5a95d8087667ef5e4b226f806d0db", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650614021, "uuid": "210d0b19-d11f-484e-b621-d0f316b33aec", "comment": "Malware payload (Mirai)", "value": "3b921146540578d79ec01d550e2f814b08f2c530", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650614021, "uuid": "d1b30017-7b4c-490e-a2a0-a73f5c40ea73", "comment": "Malware payload (Mirai)", "value": "fa514deb4cb45fdd2bb354a45acf34052ee77a4f3322870c9909e970a19c9ac61a791721e1cc307a63330f75335b6f1d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650614021, "uuid": "db73f589-6795-4cc9-af59-2aca4513cefb", "value": "T178231891B8829A13C6E4137BFA6E01CD332563A8E1DF33179D222F1537C592F0DAB695", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650614021, "uuid": "ac8165d7-f7f4-4b1f-ab59-e1426a918a5d", "value": "768:eAUloOgTNqkf90LUBIMJrpcOa8qiZ0WgzV8w2QEWDPqrcS3br7vQdYPN+SDwrcNw:SlcsA90YBIMtpcN8ql0zLrD/gG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650614021, "uuid": "18745bda-ba1b-43c3-b723-7464da61b5bd", "value": 47556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650614021, "uuid": "79cd2358-a60e-4eea-ab76-fe601dfaef5e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650614021, "uuid": "f6e75a1a-95bd-49aa-8e99-e63dadbc9830", "value": "cdd360103f899bc893f9d390efc975a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67de6beb-c289-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1650665595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650665595, "uuid": "91a823e0-fd19-434a-93fe-aab473692f4d", "comment": "Malware payload (Gafgyt)", "value": "cbabf8043e6ad8d27a227e05edc0803c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650665595, "uuid": "66df0e30-f5ef-4a72-8abc-b6b550abda3a", "comment": "Malware payload (Gafgyt)", "value": "627ba306eae38f8f13bca600abc4c2d7fc2e6e824165da67bf35d989f891c8c3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650665595, "uuid": "ba50e10c-e16b-496e-9312-d01b9390b2c2", "comment": "Malware payload (Gafgyt)", "value": "c86e730e99a13d507312bc1cbf749aa52a889b92", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650665595, "uuid": "07cd2ec7-d5d2-403f-b023-495c6c5df045", "comment": "Malware payload (Gafgyt)", "value": "be296eaf6feb3723e523147e8837b92b3bdc5639292df49a24736c9621bbf1e9104c6e6464c66caa96b6a68a6ce7a96d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650665595, "uuid": "a6b8fb3c-bb92-4649-b31e-650799b7db5b", "value": "T173A33A37BB130A23C0CA547212E30731BBB5D3D928FA5247BAA16DEC6F166803566FD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650665595, "uuid": "0a9dff30-4ba0-4fca-9404-b7db508cd2cf", "value": "1536:xfRuqNM5h7t/RiRt4nuphaQoRKzO6F6OXj6ufeRTe:OqN8jRiRFphaQoRKzO6F6OXGufcTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650665595, "uuid": "a7e79c21-19f3-411e-a294-ea8ebcb286be", "value": 102442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650665595, "uuid": "25fbfb30-a175-4bbc-979d-4cc5c41aaad9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650665595, "uuid": "93419e2e-b5cb-4de4-b2d7-a4cdc3e665ef", "value": "cbabf8043e6ad8d27a227e05edc0803c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce2147b7-c1fc-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1650605207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650605207, "uuid": "ab32e1dd-4568-491f-a305-b999220d38b3", "comment": "Malware payload (SnakeKeylogger)", "value": "42dfc637f8fc94c2d045039ed5f544c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650605207, "uuid": "45daece8-ab7e-4336-ae02-da923c307e06", "comment": "Malware payload (SnakeKeylogger)", "value": "634fefbc232809a2ad35350217c2d38ec152e691fcb40d6dbed60f9a76c6ec1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650605207, "uuid": "24cdafaf-4849-4ccd-9bd5-06942d1b9ba5", "comment": "Malware payload (SnakeKeylogger)", "value": "49569d9c61e2bbff950250debbcb0a7ad3c2d918", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650605207, "uuid": "b88c99c2-f501-4097-be60-6a773952c385", "comment": "Malware payload (SnakeKeylogger)", "value": "ad7ba54d5e200f5035bac8e2c9223808358a2ddb1bb29479c7e718b6d8e332054ad11a75d2d72b6fec511bc659d023bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650605207, "uuid": "c6f1f192-34c9-4502-99ea-7d3197624031", "value": "T112C4315F299A120DB251AD156FBCF132C55EFAF1283A4CB74DB70D5A1016AF08B6CB23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650605207, "uuid": "b9c96987-1b2a-4d49-8926-9e51bdc935dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650605207, "uuid": "d97f7214-f4cc-40b8-8d3f-25be3954aec2", "value": "3072:mGsnnXpb3aVT+eRxUB/kMvDeJtZTB8In3YGVHVYRfHSJ4wtsHOtxzTtCo:Za5cyqXZTZf0K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650605207, "uuid": "4d33db4a-8616-41ac-a843-a749fa57c2aa", "value": 562112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650605207, "uuid": "d4bda73f-2162-489e-b65f-a8731a739c2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650605207, "uuid": "7a79c3c7-2093-4d8e-be90-2820f68ca9e6", "value": "42dfc637f8fc94c2d045039ed5f544c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "681c028c-c227-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650623504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650623504, "uuid": "b6fede4b-757d-48d3-bd76-c53baf6dbc36", "comment": "Malware payload (Mirai)", "value": "994e10c54335b2974248120c3409ccbd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650623504, "uuid": "4a0a7b23-9380-4f6a-8831-9706f157630d", "comment": "Malware payload (Mirai)", "value": "64ac3f0e88e5b18bae8a29740893c12d69e01ea4f0ca4bad889c5e8d5bd200a0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650623504, "uuid": "0cde08c6-3172-4530-bdfb-a95209b7ef84", "comment": "Malware payload (Mirai)", "value": "5c7358810cfadad73a53144476527b18dd42f4aa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650623504, "uuid": "4b29e49c-9f4f-4b00-983e-841050c5c823", "comment": "Malware payload (Mirai)", "value": "384dfe5f9c9398df10ff31d65ead89a2cc3803b558bf1ad98d7f8523d325c3ab89e8269ca283de55e4b4cb9753df948b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650623504, "uuid": "606063a0-9ae7-41d0-8ddc-c296975b87d7", "value": "T154334B26AA791D57C0E8647A62F3432AB1F6224F64B88F5D7D720F9DFF605C0680B1B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650623504, "uuid": "b9121215-d48c-4a1d-9fe2-1cf1c1f7bcd5", "value": "768:/w7oxx6VghmSjgaWQa3NrCkJdinO+CyzllqZEDD:/w76x6V2mSjvWQaHJdi7d/qc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650623504, "uuid": "c972bcb5-2b76-4c66-ad43-979ce34d2c65", "value": 52104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650623504, "uuid": "b7b73455-dcc4-4d9c-ae1a-7044095cfa85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650623504, "uuid": "769520e1-e507-4669-8ba1-87dbf462bf95", "value": "994e10c54335b2974248120c3409ccbd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6dc870e-c214-11ec-8e58-42010a9c0032", "comment": "Malware payload (NetWire)", "timestamp": 1650615476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650615476, "uuid": "50485408-a1aa-410c-945e-a08cf16601f2", "comment": "Malware payload (NetWire)", "value": "9bb6cce68d6a41391864f4749d5603f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650615476, "uuid": "b8ae2b4d-386a-4d0a-bdc0-1eace9019cfb", "comment": "Malware payload (NetWire)", "value": "6556bd37ac00c8f0572f458828376e56469268fb5e1e38a60569148f54123612", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650615476, "uuid": "c2e45710-c700-4de3-9f36-0f8a241b1a7d", "comment": "Malware payload (NetWire)", "value": "4235f6557db5ce08cea24b94010221d41e4f1c28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650615476, "uuid": "55f563c7-2cf6-4879-98c7-e4e279a15b41", "comment": "Malware payload (NetWire)", "value": "229f6a171ca66a9da0bb6d2f398007e1b3df4f8341d9562807fa8f269da52e605a8efb873d4036a4f359a7d74786d0d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650615476, "uuid": "f14be5f2-f61a-46ac-9cbe-6d6ec572ccb6", "value": "T1E2E4E06DEA58A633C2EB0FFCD2E3924446AC5FE16950D3556D903FCE3C33B846861A16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650615476, "uuid": "b308b606-7b34-4c13-b31f-211983765e3c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650615476, "uuid": "e81c772e-39a8-4e60-907e-30f1145b15a2", "value": "12288:SzvVliPFrR5OwwxRnhoFvvW5PFK/f6C6r6u0tqtIFrIq0:SzqPh2wwrhoEFK/iC6GujtI2j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650615476, "uuid": "94636e55-d3d9-45dc-a2bc-2b9d05173970", "value": 705536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650615476, "uuid": "e829caff-27ee-4163-b815-813f9d17d186", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650615476, "uuid": "7d6e3ebe-3bcc-439c-aebb-c3b5f8796606", "value": "20220421_NEWPURCHASE_ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a618d73f-c236-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1650630051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630051, "uuid": "75331b62-aeb0-4872-b041-8a3ee784043d", "comment": "Malware payload (AgentTesla)", "value": "3fa728841ff3fb6f4d003982ee1a8023", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630051, "uuid": "746dae9d-c2a5-4179-b0c4-c3a157d0d038", "comment": "Malware payload (AgentTesla)", "value": "65631d3e914c60006569cce073d6ef4ae0d8d286b281a5732f73c3944ad43bb1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630051, "uuid": "1e0cb14b-bc14-4cc8-ab70-97554bc78a42", "comment": "Malware payload (AgentTesla)", "value": "2517edc76bc72285fac3133fcdd8f518d52f8b0d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630051, "uuid": "7a476838-8fa0-47c8-ae55-d61e259d784f", "comment": "Malware payload (AgentTesla)", "value": "0f32d9155da682e3342f9d48a0fbb4d6b2a0f80b245e114cfe8bb491b82a2867c28e87bcf18ec9c7ad45b0c1a63bf5ef", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630051, "uuid": "0b339fd5-779c-4188-9554-d2b89a070da2", "value": "T1AFC40212B6B0C1B5C82EE67534D7048B83F4E56B5A5D9B4D086353BB9BB0340236EB9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630051, "uuid": "114ee409-18d7-423e-aa8f-369eaa6280e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630051, "uuid": "c970c856-7fa3-4105-819a-681f65371647", "value": "12288:1vk47RMJeFxh+TpvweyoxhifZEufUrgf6pugWTfBVe+jAYtv/h:+yRMJeFr+tw5oxsfZEVVpzWzVBdh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650630051, "uuid": "38031722-9764-4b9d-b5c1-c558cf0958dc", "value": 581632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650630051, "uuid": "51edc6cd-797e-41a5-95e4-e27cac11bc2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630051, "uuid": "6cbbd7f5-765e-49e4-bca8-60d482aca797", "value": "FATURA, AMBALAJ L\u0130STES\u0130, KON\u015e\u0130MENTO_xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad0f3b91-c236-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1650630062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630062, "uuid": "d0f446fe-24e6-4200-998d-750421d0d467", "comment": "Malware payload (SilentBuilder)", "value": "15816c8da64d83fa10da33ff26bd41a6", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630062, "uuid": "8a624c0c-2fb0-4de7-8676-f50fc7210f4a", "comment": "Malware payload (SilentBuilder)", "value": "65ea05184d8d01c81e85b9d8a960562565b237e167d52dfff99c9892321d68bd", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630062, "uuid": "f477ce71-94cf-40e5-b988-783b8b55a21d", "comment": "Malware payload (SilentBuilder)", "value": "f18232d5bc573ac926fe119b8306c24dfdf43c35", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630062, "uuid": "fb0fe4c1-6e2e-4e30-a6fa-4f581fe6ddf8", "comment": "Malware payload (SilentBuilder)", "value": "0d635b5290320c2810901c67d233ea4e765ac72246651105e30f4e8bbbaab58563e48fd0a93cb5676e8fc615be8d3287", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630062, "uuid": "1cfded70-03a5-492b-a0f5-e03731088939", "value": "T10223B646BA5D9859E9258B7548E743E9B333FC201F6B0B833616B3257FF49E05A03207", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630062, "uuid": "59d17c18-5929-44a0-84a7-9c5a8d115652", "value": "768:4DM52tfQXi8vgLZkTOHkQT51Vp6AwPdM8gQ6JT5X6DGwUdh+pqjeSLjcvLtzrxF2:462tfQXi8vgLZkTOHkQT51Vp6AwPe8gj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650630062, "uuid": "415a91e9-39aa-4671-a545-2f21d8c797a5", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650630062, "uuid": "440d3487-61c8-4bf7-acbd-b796a95d3548", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630062, "uuid": "e97216c4-66a1-4370-97f7-ea343eb532a5", "value": "My current address update.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7118848f-c208-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650610205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650610205, "uuid": "eb3bc423-f845-4a7b-80f4-e181deb8298d", "comment": "Malware payload (Mirai)", "value": "18bed9d14fe16e786ef9b9adbfe831fa", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650610205, "uuid": "ea2bbf13-78f9-486a-853a-cb03cc5c1976", "comment": "Malware payload (Mirai)", "value": "6608deed65e77b4630173ef58c1ae421e864b1065ff091dea9e0fdfd77f819ea", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650610205, "uuid": "1f83142d-8ff9-4f46-83dd-fce113bceae4", "comment": "Malware payload (Mirai)", "value": "ec01aa713e9472a1bb4e4db49df26477f6827e51", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650610205, "uuid": "4bd84376-7456-4daa-9642-58b44463a3ba", "comment": "Malware payload (Mirai)", "value": "ae1bad01d8fcdfb5185796de7bb2821d06721ea4df60dd5b15b4542ef2a3181ce4b3c5a3386ccc6ed99e58bcb17adaa4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650610205, "uuid": "16505034-8df3-4d70-9c7b-3bd03cf1e480", "value": "T1CBD2E08D98D85A8EF8AC5F7C828A4758C802B5C135EE4F9D13616D88E32B713B64D899", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650610205, "uuid": "8577268d-e563-4ec1-88a5-abd4a8d03bed", "value": "768:S+5054o4pjjvz54bVhsRmVANENq4nreWMz:Si058vV4pWRmVAUTrK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650610205, "uuid": "070b0f3e-d75a-4cba-9a2a-826007b91d32", "value": 31024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650610205, "uuid": "1ccf7ede-bea2-4344-b8e4-eeb2de3ecf66", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650610205, "uuid": "70cc7366-7ae7-4632-a693-24ad54f6d385", "value": "portlordmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d44dbc80-c263-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650649456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650649456, "uuid": "b439d666-e62d-4a56-9841-1446829a5e23", "comment": "Malware payload", "value": "4b56edefc37a28c7ba81db2dafdf235b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650649456, "uuid": "dad0c1d9-9b46-4db4-bf0f-6b08a74ceab7", "comment": "Malware payload", "value": "660fe21e8ff5b7ccc28db6813b54294728b3aab247462e1347683bacf3c834b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650649456, "uuid": "dde3fb0c-f6a0-4c5c-8770-78aaa1e19386", "comment": "Malware payload", "value": "8d77f53a593e1d03e167d81bf9a3c858d1345db5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650649456, "uuid": "8bf6dd37-65a2-4279-b2d6-8070f6affef3", "comment": "Malware payload", "value": "660782c988ef80c61ae2217a21e1183af41d13f4cbbbf5126f43b00896a8134c239381c78599f33d86d9c7b1dd2a4a4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650649456, "uuid": "d31d9092-d092-4ce9-b75b-0785600187fc", "value": "T141D49D11F6AC80B5E07BD13DC9A3875AE6713C9847B943C79255EB2A2E736E05D3E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650649456, "uuid": "15eb0915-105e-44da-ae3e-38a18d04caaf", "value": "6ba79cbed2acbe9b8ecc8e14a572f100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650649456, "uuid": "25d6d789-f9f9-43b0-bb1e-b705451f67de", "value": "12288:C1FIcocJwMTHzXO7N2QBHiyzskF1CubVnmn:tco9MTHzXO7Nt/115mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650649456, "uuid": "55394455-1de1-4940-a2a8-113e9fe0e699", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650649456, "uuid": "6349f146-99fe-478f-923e-b85cd3cfae85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650649456, "uuid": "9d59c36a-2960-49d9-ac13-7b0688a579be", "value": "4b56edefc37a28c7ba81db2dafdf235b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8e77e8a-c21a-11ec-8e58-42010a9c0032", "comment": "Malware payload (GuLoader)", "timestamp": 1650618083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650618083, "uuid": "8fe767dd-a61c-43f2-ac39-89b73ee63ac6", "comment": "Malware payload (GuLoader)", "value": "dc63cb2f8e8010ddbe2a83d60c63b2f1", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650618083, "uuid": "b3107821-16a0-4b70-9cef-9a699e750424", "comment": "Malware payload (GuLoader)", "value": "66170e8faf3f74f2c4a14a52dd311d379d62751b0e573de733448b0ada8442ba", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650618083, "uuid": "eef08cd1-e582-4f3a-97ee-967651ccb6e5", "comment": "Malware payload (GuLoader)", "value": "546176334835bb4f9aa8f1ababb661b01c65ba96", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650618083, "uuid": "48f1cf5b-cade-4332-8328-0579516fdb75", "comment": "Malware payload (GuLoader)", "value": "7bda9f60294a8d7b927ad4caae25d8f930dc6b56e55f47aa0fd5c0ec9e9500293b60611d452a19c3e2bcbcb331dc2547", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650618083, "uuid": "8ebe864d-2249-44d3-bae5-f0356e45af04", "value": "T1F334BB719FD3C84F85599EE94C8B5EF22A3B46228FA7481C4B8A1D46B9185F7113F30B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650618083, "uuid": "742a99d2-1cb3-43e0-ac7b-6a2aa24a37d0", "value": "1536:a9xHxS1+s/TYegz6Y4oAgVoFY1afxWVTop5S60xJgf5A4f6/csz7r691ntxRVBLF:aHGQegYvBfxFptf6f69tz7IQ0xUK5Yp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650618083, "uuid": "65cfae08-9382-43e7-a0f0-761f9320b37d", "value": 245600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650618083, "uuid": "53aac7ca-1384-4d66-abba-2206fea39742", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650618083, "uuid": "73e031f6-7c55-47a3-9a39-c5b6601cfcb8", "value": "Cargo_Arriva_Notice_OVDHG4784.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e5e5811-c24d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650639675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650639675, "uuid": "f208fc4b-0796-43fd-bbe9-36796307bacf", "comment": "Malware payload (Mirai)", "value": "7087d76d35c5271edebc78618d992e5c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650639675, "uuid": "259a3ab3-4961-44ec-8d7f-c20b74375bd4", "comment": "Malware payload (Mirai)", "value": "664dbebd9cde6ec1fbf6dc601a4b1063bbb7cdb76902bfd781305e80847160e4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650639675, "uuid": "5f86b12e-454c-4bf2-aeb5-5d6e39a36dee", "comment": "Malware payload (Mirai)", "value": "f503f7e6b7eb159506d7dad0427b39d9a496cfbb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650639675, "uuid": "12037749-d057-4737-ab25-1af8244b27b3", "comment": "Malware payload (Mirai)", "value": "d929d622d1762fa6119eaf99cef137b6e705b761095fd81ff62eb09055a35b50586a7c6d19662a6eed398be6253b5de2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650639675, "uuid": "a11d861e-4f56-48c7-937f-a02b29fdad8c", "value": "T178E2E190C6052C32C1F02D76DF9CD68B27124EE2F2B031B167645A7CBB52256ABBF2C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650639675, "uuid": "0feb369b-a072-4615-ab04-7749e4b88a57", "value": "768:QQ214iM/DNLXiX8DELrmHuSo7bsJMeBmc04R3Ucb:QV+isJU8oQJnIJQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650639675, "uuid": "55222e99-43c0-40cf-9178-eb3e0f73beda", "value": 32632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650639675, "uuid": "ce8ed0a0-a6f0-4352-bdcd-971a9c2a2bda", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650639675, "uuid": "8a43e916-6633-4b84-9b0c-ccfa645a6f03", "value": "arm5-20220422-1501", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83daa954-c225-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650622692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650622692, "uuid": "7b228237-3e73-4ffc-bf85-b06cdc312282", "comment": "Malware payload (Mirai)", "value": "82926178d9b8e39a22e3a388b23477c7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650622692, "uuid": "3d917392-4c9b-4b03-a851-0a84aad76c95", "comment": "Malware payload (Mirai)", "value": "6657cdadc14d25ee460ef30dea4ee79e48a4b023bfc40dc9626c438e82e9d555", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650622692, "uuid": "e4a8461b-6a99-47cd-ba6d-5c178b995bfc", "comment": "Malware payload (Mirai)", "value": "98e0e8d56fbe8039b69fce42f322551e3e8a217e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650622692, "uuid": "2320fe5e-5c27-43ca-bede-77ead8d2f54f", "comment": "Malware payload (Mirai)", "value": "f78798662233569fbb609dfc16a87e40f658284966aa139e55296be155a8d826717f1d5d54320c0e094d2d7ea4d51eb7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650622692, "uuid": "e97a52d8-3d1b-40ae-9ff7-4d8b11e2c731", "value": "T1C3237D73C86A5ED4C6944974A228DE3A1773D418E2972EFA5A07CA76900BFDCF0093F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650622692, "uuid": "80172530-2a0e-494a-ab3e-30125bf117f8", "value": "768:sBbYO9FeDmjgDCUVOoo9PLcCQo2lxtFCLpKt/:stT+D1VOoo94s2lFCLpK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650622692, "uuid": "7f582b1b-eeda-4288-b602-7f6aa94ae609", "value": 46116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650622692, "uuid": "fed3c74c-c001-4574-b144-52c2b411ce17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650622692, "uuid": "351763c2-8c5f-4419-9f9d-76aa25c42e83", "value": "82926178d9b8e39a22e3a388b23477c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a10e4abd-c204-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1650608567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650608567, "uuid": "2fb2043b-fce2-4265-8161-14fc1adb991d", "comment": "Malware payload (AgentTesla)", "value": "ae1d881f5d5c739546305a1d3f2a5770", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650608567, "uuid": "2c0ef2be-e67b-4f61-8b7f-1052d740e43e", "comment": "Malware payload (AgentTesla)", "value": "668832e8181b0270c339930a8402a735e638b8374d53e2c95a715254220e0651", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650608567, "uuid": "b03d6420-75f9-4251-8a0b-5141a3b7f75b", "comment": "Malware payload (AgentTesla)", "value": "2b79174146261d455ede99a2e060c150118c9c8b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650608567, "uuid": "b76f780d-85fc-4265-89af-fc5d6b11aa15", "comment": "Malware payload (AgentTesla)", "value": "32222e2694b956dde1fc1ccd52a26b31d8d8b377b4d279d2d650dc1cd4dacd0f6d45b4458b723dcc7d75cf684c25ae2e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650608567, "uuid": "992ab0d1-85d6-4f2d-8f61-fb25344bca29", "value": "T1F5C412623BD5D4A0C8BFEB7678D1158B83F0C5439509978E193362FF2A61350236EB9E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650608567, "uuid": "23e19b50-a254-4e0f-963e-5b0ea0313d15", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650608567, "uuid": "54042e22-5ed1-441b-a243-101b551c0799", "value": "12288:BcHIj31g+y1O9DoqkHbRIGnZouFsic4OsGRfjdHaaxXPKWAYtv/h:uVaoBRuuF97gvxKWBdh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650608567, "uuid": "2ad682aa-8947-49b5-868b-90bb1f629c96", "value": 592384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650608567, "uuid": "7dac3789-c4ca-4d52-94a7-ba5af7f4d4bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650608567, "uuid": "8b1047e9-8eb7-485c-8cb2-4d51e862eba8", "value": "PO32427.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2cd045e-c1f0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1650600007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650600007, "uuid": "13c5c483-166f-4e4b-a506-83f139da7ecd", "comment": "Malware payload (Heodo)", "value": "ff02513387088d611cf443b696a583cd", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650600007, "uuid": "efd1a6a3-0939-4214-aacc-4cb3b6f8d2e6", "comment": "Malware payload (Heodo)", "value": "66c82371a33124fabdb27ef5b816296c1267b345dc5090114fc6dac7182b7fa7", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650600007, "uuid": "f77c1ab2-94ce-4b49-99f5-af1a7fcf3594", "comment": "Malware payload (Heodo)", "value": "fbd4359be792cd53aa3568290aec19bc9747dc6a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650600007, "uuid": "e09825ab-622d-4158-b8e3-307e0ab73eab", "comment": "Malware payload (Heodo)", "value": "8353100b81103bdf8b330af97e27409327f26bbf31f5a7acce5a6d3a43c7451f41c982dace1671835b8ecb1305551606", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650600007, "uuid": "2fadf43f-8f35-4e7b-9f4c-00e9ede2e9b4", "value": "T1F4D47D0AFFE0C1B6C35B513449C6C649A3ADBE6CE7A1C2B3B7A5FE0D6A321C14527650", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650600007, "uuid": "68e3e014-0a08-4f29-b624-12e5f980ac7d", "value": "6144:uGHNRlqAqfISHr/mvcQYbi2HN8C8BgifO7y7NcuVqrWLWvM2znNdQtRRQEM2UmM3:uEHlq3bivcQMNsrDSx5NdQt3UmA09K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650600007, "uuid": "9ecfd58e-6dae-444c-b385-f773339b30c1", "value": 635392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650600007, "uuid": "b92a2686-81c9-4275-9edb-276cd876049f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650600007, "uuid": "f93ae523-00ca-425a-9b20-cea81d8acc71", "value": "emotet_exe_e4_67d8b4f9ac5ae55ca3cb391c7741dd0a7ec86e2fdd5c99a5b46f87c6eb4d389b_2022-04-22__040001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "702f1d23-c208-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650610203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650610203, "uuid": "da6691d1-37dd-4d55-80aa-f93c2626bd25", "comment": "Malware payload (Mirai)", "value": "a8f908771f0c876f50f7cf4c37c80a15", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650610203, "uuid": "65a8f144-d5be-4120-8cca-e1fd1b4489bd", "comment": "Malware payload (Mirai)", "value": "67028df5d7da46df391136a47426767bd7e8ccc714a0a4615dbc6e279a74bfd2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650610203, "uuid": "c11431f9-fb05-4451-af4d-df42b5b77139", "comment": "Malware payload (Mirai)", "value": "dbc3b1c93fd3072b55320ccac1f160fca1bacb68", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650610203, "uuid": "e4aaf56b-d6c2-4368-b8ea-20b6b7659e6b", "comment": "Malware payload (Mirai)", "value": "857c39b58c450378469f1e68fb41dca3c457354f3df8d4b39c377f662270b7da0c16ecfc5e94fc23b59a61180a4b0767", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650610203, "uuid": "a62c4c69-ae4f-4e3f-9caa-79bd6413a3ce", "value": "T11DC2E1D5FBB42766E91DA33F486811F9D22773185BCB42C528E7AA1991120039FFC6DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650610203, "uuid": "aaf2c8cf-4294-45df-b9f3-82de97b3de4e", "value": "768:eCZFj/no9cVqc92uGHwhid8HMcM/qzDMsoXo2BB:xbno9c0c92u0uixcM/qzgsGo2BB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650610203, "uuid": "fb0610ff-3b47-4d3d-beb5-05a0371364bd", "value": 27328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650610203, "uuid": "35291ce1-a1b8-48f3-a74e-b3d0bb0e5544", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650610203, "uuid": "65ba9324-c086-4770-87f7-b7ba52acbbfd", "value": "portlordx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "475525bf-c239-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650631180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631180, "uuid": "cbefc8cd-523e-48cf-b974-7bdfabfa85c1", "comment": "Malware payload (Mirai)", "value": "c11d3a1a95d5a88a53d34ad3fa455092", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631180, "uuid": "02ed861c-4b25-4a45-9fc2-b4755e11a473", "comment": "Malware payload (Mirai)", "value": "68eaedec222667effa17272d2ed99098ec0148fcbdbc9c4925845b766680e4d8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631180, "uuid": "406fcf01-1c56-41a6-9ef6-f500d8272fcf", "comment": "Malware payload (Mirai)", "value": "5be674c7f4fd898f6898b2575c4fd788a8c6bcc2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631180, "uuid": "68b131eb-f6ff-4115-baf3-8f30fefba6da", "comment": "Malware payload (Mirai)", "value": "4e2768d6c6945ae60b86bda15bc992e099d671eaf7cbac752cef3c80f6b5ecad434363931cd25685f3927f204cdf3976", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650631180, "uuid": "b11f3cee-c57b-4748-b4f5-89eb82e16795", "value": "T10FB31945F8408727C2D327BAE78F438D3B3657A457DB3311A9387EB42BC17992A39960", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650631180, "uuid": "a69d0381-1b11-4639-8b50-89739d75922e", "value": "3072:KSf+o6m/nETzcV5h/dPAbMzYP8mkZrQAhPDCXFke:16mvETIV5h/dPATEmkZrQAhPDCXFke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650631180, "uuid": "e15af1c0-960c-4a5d-8798-b7bf57325a1a", "value": 112738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650631180, "uuid": "d224c120-f058-4d50-8ad4-65dfffa6017e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650631180, "uuid": "bc9b5a99-08f9-4fdc-8eb8-044e834977dc", "value": "c11d3a1a95d5a88a53d34ad3fa455092", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63007cef-c24f-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650640676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640676, "uuid": "22f57e17-b89a-42de-8ef2-c6308bc175bb", "comment": "Malware payload", "value": "82c4f5c3dd9695679215ac3af85c9661", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640676, "uuid": "c99e0ca1-07b2-4eb6-9779-27d463d98c51", "comment": "Malware payload", "value": "6a0f3352bac460fde9ccc506c6c4c61c8268ba11372f7b63b406620d35bb7e73", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640676, "uuid": "5e8450b6-0560-4568-8289-6fc2f0b0a4f9", "comment": "Malware payload", "value": "f0606b303099f9d18cb7a50f8438edd79eb1f779", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640676, "uuid": "cc9060eb-3786-4898-a93a-3da431aa343d", "comment": "Malware payload", "value": "7d4687f2d7c38469aa58d8cbb40d910dcbc4dbc8c9ac0a3517135acb2a390f36c40659bcb9fba0fc98668869dfc67ec8", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650640676, "uuid": "c00d7bd4-dede-49db-92bf-d63360bda96f", "value": "T1DD93F1C9FFAEC428FDA90F76C120C08A579A5C37AD86F457C4E972486638D745C20EAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650640676, "uuid": "95e9142c-b88b-44b7-8a7d-0606b6cfca10", "value": "1536:/XDN7Z301IVljAjuVoh0aBPP3ouJnP/QKk1dtNYDfSgTjmF0uZaAYoLK24AM6jQ8:/ZVbljAjusxP3nJnPj6fNKqgGF08aAYq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650640676, "uuid": "8adeb3d7-d385-4026-8277-3142f1d09a11", "value": 96768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650640676, "uuid": "37709c81-c208-4984-a8e0-9c63b8f85a97", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650640676, "uuid": "8c4c122a-4953-47fe-a5e9-01ad1c802d94", "value": "xFCr Rechnung 22-04-22.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dc13fb4-c221-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650620964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620964, "uuid": "cfec4b09-0d6c-479e-9b34-081ac6d0dc9b", "comment": "Malware payload", "value": "52e48054392bfb52ea6968fe65d6179c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620964, "uuid": "eba68caa-1897-4250-9ccd-a34571d74c1d", "comment": "Malware payload", "value": "6a31b1fd3a3ec3f8628817b07baebc23fc181e572b2d586dcfd98d00861bb87c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620964, "uuid": "acb80a2e-247f-4e5e-8333-0a3e9562c0d4", "comment": "Malware payload", "value": "3d2e044e6493eb4a02cec8bef3f9dceb74058ec4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620964, "uuid": "c3bde4d3-38e8-42fd-94b9-dd220922feca", "comment": "Malware payload", "value": "8501b61fbd0f5117447e8b5197128f908301131fe579003b856195d94124f555cad5cd33ac1f74dc0ef7e194b4265f2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620964, "uuid": "cd5fb856-dae4-434b-bd65-9edc48209108", "value": "T1C4B56B23B29460BFC06A0A3E45779A50AD7F776166938ED75BF0184CCF771402E3AA4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620964, "uuid": "b1068c82-571a-40c8-9e63-291ec3b3851c", "value": "9025568f4a25f0a40e98eda24f66fc65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620964, "uuid": "2f98e4b7-7a7b-4f09-aacc-243d2bd54994", "value": "24576:CL58M/nWhMzSXj+8gF3tHTdkqBDrzumfE6t6NBMS2rbq1x5fjIgEKQD9536/mZzG:5KZSXj/QequNOS23AjI36/mZzzTOobb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650620964, "uuid": "eaf6c5cc-735e-47a6-9f27-77490475b7a6", "value": 2342400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650620964, "uuid": "68bfe8e7-5031-4628-94cb-63d4da5d8c3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620964, "uuid": "adb63917-f401-4866-b0ff-85717664fc3f", "value": "SecuriteInfo.com.Trojan.DownLoader27.61892.26393.2156", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "516bed1f-c26e-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1650653960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650653960, "uuid": "8d3aa820-1a93-4efd-8d76-33fab373a297", "comment": "Malware payload (AgentTesla)", "value": "39a772a037d886d21c59a6197f8ccf65", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650653960, "uuid": "8ac6dd98-7664-4fee-bfd7-73959542c3b4", "comment": "Malware payload (AgentTesla)", "value": "6aa819ddfbb79b945195bae610a50c06c15295c71feb09ac1813feca7c4e55da", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650653960, "uuid": "c6200dd8-b0da-496a-a41f-c2436700c05e", "comment": "Malware payload (AgentTesla)", "value": "a24924d48fba206a8ac43d03baf9ec277fbad73f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650653960, "uuid": "29d42691-8a8a-4db5-a58a-b62d54cc22d1", "comment": "Malware payload (AgentTesla)", "value": "bffab6d11a429bf991ee4a9a8cf735382357a32585b468c6394e06a6971f56f7f4e0da85ffe7400059d434150847b3c9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650653960, "uuid": "f1e31f1a-2a03-48c0-9cc4-ba9b5956875d", "value": "T140257C987940B08FD186C971C9B5EDF7B670BCBA0B0B9342B493BBADAE7C585CD04161", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650653960, "uuid": "33a4b58d-3349-4467-80c5-6f03a00015ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650653960, "uuid": "ea85c413-4648-43e9-89c4-9c6faaa70e24", "value": "12288:nz7hHHdWnF5r7UiYP1ivxbX1OQmRrkyutZMdEovHrOuCZJrxkbe/:zOnF5rYiYdip7IQmRrkJx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650653960, "uuid": "329559a7-97f0-478f-a542-417051411fb2", "value": 966656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650653960, "uuid": "0f20780e-4279-446c-98ba-c161d72afced", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650653960, "uuid": "a3d554cc-774e-4b9f-8981-0fa7f6265db8", "value": "invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27508f2f-c1fb-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1650604498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650604498, "uuid": "12dcaf68-ed2d-45b6-87c9-0d3ca87f6099", "comment": "Malware payload (Heodo)", "value": "66c21050ec57e039cadb31ef8eac7cf7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650604498, "uuid": "0f93c913-605e-4ea1-9b7d-c2b3d63f0419", "comment": "Malware payload (Heodo)", "value": "6ae54004e33156bd1637210c05261a776e7c6b93ea124811ce6412e1745d7e58", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650604498, "uuid": "b61cdd74-109a-4911-b3ea-7c75b8c849c3", "comment": "Malware payload (Heodo)", "value": "3404e49aadee7f1ec4a3357d392e401a1ebbcef5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650604498, "uuid": "8a18c10b-8f0c-42b1-9f1a-e644acf3b4a4", "comment": "Malware payload (Heodo)", "value": "dfb94bb5ac49431e15134fa71bdaa57ee04851b88385c6ca9458a7121b9ef88e84d7bfeac0c4412521830268cda6148c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650604498, "uuid": "0bd64248-eb4d-45a9-9f44-aec1c2a55ead", "value": "T1FE056C2073A1AD35C3EB627A4FEDA3A509EBAD504B3241BB717D756D49334C20E7072A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650604498, "uuid": "a960fcb7-e49b-4ad1-8b31-73bf2e74a775", "value": "bb2e319682f72745317e92a26483f973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650604498, "uuid": "590892b9-0db7-4f4d-871b-9dfe517b9fd9", "value": "12288:J1U8sNY8/z0rYebzwdKCoGEAbcVBLku8wcmQjcQ6JC3s5cYL:oq6z0rYcMdKVGEZBLkuFcRAQAcY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650604498, "uuid": "9b8b2102-4919-48ee-b558-d2da1c826648", "value": 860160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650604498, "uuid": "d1c668b0-3b1f-4d22-9347-8045c427e8e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650604498, "uuid": "93f049e6-9bb6-48d6-9a7b-5a56e75359a9", "value": "emotet_exe_e5_0add90d08eed0c7ca2dcf9b48f87ff82c1faa635d7ae47c89625392f62feb2ed_2022-04-22__051453.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ee5c018-c22e-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1650626522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650626522, "uuid": "a14b0d35-ef18-4f25-b464-20cb34e64d1b", "comment": "Malware payload (SilentBuilder)", "value": "953ac78998807309cbf42e81829f94c0", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650626522, "uuid": "64fe523d-54e0-4380-8de9-7f7ac7c6d8fb", "comment": "Malware payload (SilentBuilder)", "value": "6afa83402a2a8091666f636c59d359e8259ff089d87890c80052ce4cd951cd9e", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650626522, "uuid": "69ee9af3-7d58-43d9-ade7-44f0d3f15947", "comment": "Malware payload (SilentBuilder)", "value": "2e0ab39fcd6d50f7738d92740d0177c4b41f1b9b", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650626522, "uuid": "74acf913-e116-4fd6-86c5-95a348fcc24a", "comment": "Malware payload (SilentBuilder)", "value": "f68d71373a165c0cdbb0276c82d66d470ac4fcd14ea4c57d4b8eced5a3d86df76a0e117b3664e3ea5e6dd7147e295e6e", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650626522, "uuid": "6333c792-8089-4e1c-a2a3-5c6ac23080d8", "value": "T1FB23B646BA5D9859E9258B7548E743E9B333FC201F6B0B833616B3257FF49E05A03207", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650626522, "uuid": "6b9d3ffa-5121-4d8f-a73a-cf36216a29dc", "value": "768:4DM52tfQXi8vgLZkTOHkQT51Vp6AwPdM8gQ6JT5X6DGwUdh+pqjeSLjcvLtzrxFW:462tfQXi8vgLZkTOHkQT51Vp6AwPe8gD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650626522, "uuid": "c8decb82-eeaa-4533-9bcd-f2e011df0a17", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650626522, "uuid": "bc96fe78-a20c-4986-9393-1c73f11ff972", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650626522, "uuid": "39dcea4f-b5a4-405f-a903-d4e9092ab991", "value": "Scan 2022.22.04_1258.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31d94483-c221-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1650620836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620836, "uuid": "581701c4-30aa-4747-9454-b4799342bc05", "comment": "Malware payload (SnakeKeylogger)", "value": "b5d591c79815ed0f546305896af62742", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620836, "uuid": "174085f3-e9bb-4084-a30d-bf2fe63f3ec0", "comment": "Malware payload (SnakeKeylogger)", "value": "6b1c1192b3fdd190b82dcbc48857dfd81a14d0da81476b7ebae7a1414d8beed2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620836, "uuid": "2e2d586e-3b12-4578-a1fd-03a1d7e92ef1", "comment": "Malware payload (SnakeKeylogger)", "value": "021e5ab7b6a4b43bdb9997c2f695f7c50989fcef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620836, "uuid": "7bb4803b-3f14-402d-b908-1dcf9d357729", "comment": "Malware payload (SnakeKeylogger)", "value": "85aab8d7f7c166555b7903dbec64e5848876ce73e610981b87160cb3fdbce9d16611b894601ad62007bd018d3c36b1d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620836, "uuid": "0c8ca546-9ee0-43dc-82cc-e2f05c9e909a", "value": "T1AA937F290ADA885AC2531F790AB0A22DE179DE413C7ED757EE1B289DFF34F846DC1181", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620836, "uuid": "cd843cf2-3c5c-4a5c-a585-904d8462b3f4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620836, "uuid": "f4189fbc-6544-4bd0-9866-15856c20a333", "value": "1536:luou2S1NEfxljMHdaRiyQGmivVPz2tCKUIZxTkHN8INYNjttj8ZGPObWmBhNe0M7:AOSYxlY9aRiyDVPStCK7Z6HiJCzbWONU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650620836, "uuid": "5faf618d-50d2-4ef4-89eb-83526cbe4c25", "value": 96256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650620836, "uuid": "f115ed09-26da-4ead-86f2-13e54f48b83d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620836, "uuid": "be189f64-dbac-433c-9209-6dea8fdcf32d", "value": "Wpghskn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58c2d974-c289-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1650665569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650665569, "uuid": "ca50b171-3ffa-438e-8342-9d3ab8605d1d", "comment": "Malware payload (Gafgyt)", "value": "6bfa7ec9dcef8b699652e312311a3fbb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650665569, "uuid": "3b10adf3-3985-40a8-8769-16535763343b", "comment": "Malware payload (Gafgyt)", "value": "6b431d6c846b55d90745cecb270f0a0177afb64a22861b8ceea7cc2f0756ad04", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650665569, "uuid": "7376e1ba-00ad-4c70-8c9a-bbb2b0ced676", "comment": "Malware payload (Gafgyt)", "value": "10d082ced30a4a362b5b372ee5a12a685fc919bd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650665569, "uuid": "ede787f2-9bd2-4bfc-aa5e-78c080fe45dd", "comment": "Malware payload (Gafgyt)", "value": "6b0747ae993fe54788800f4e17cc0f6032ac73b673da95dd04cfbdfce02916fb7fbbed4b583fc99f5c00df56e1d6dbbd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650665569, "uuid": "141ccd29-212d-43ed-a85e-d699c38ff6f2", "value": "T174931A67F900EA72F40AA77A04D74B157670FBF60E93272273173965AE721C52827F84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650665569, "uuid": "bdefee72-d5ff-403c-b5d0-652e1417e2fc", "value": "1536:ru7CnuMA8JdlTOWoCkThvvk9VOU9EelEyt7MJ3aLIhk+NGK0jSmC6V6qDj6ufSae:rVuMndFo5dnxelEyt7MJ3qyNJjmC6V6l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650665569, "uuid": "1459339d-c7f5-4b3a-897f-c6794ae914e2", "value": 96630, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650665569, "uuid": "88899af1-b836-45aa-95df-e6cfb57745bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650665569, "uuid": "7208b276-8475-4a9e-ac97-6d24f6014296", "value": "6bfa7ec9dcef8b699652e312311a3fbb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6b7dc89-c236-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1650630052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630052, "uuid": "2fc68c54-770d-45cc-acb0-e9637d2ec347", "comment": "Malware payload (SilentBuilder)", "value": "d9069b76d9935e4fc91996d5adf9484b", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630052, "uuid": "33084935-9cd2-4caf-b539-afc520c25222", "comment": "Malware payload (SilentBuilder)", "value": "6c017f86afbb4b4af15a3ed5ff8d22920fa8cc20277d91397ca203c8fd9e85cb", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630052, "uuid": "5ca305ff-6912-4458-adff-0180776f9d99", "comment": "Malware payload (SilentBuilder)", "value": "efe53130f5df19cdcd4198579181ef4d886c55fc", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630052, "uuid": "abfff562-ca55-44b8-ba18-a468a6232dff", "comment": "Malware payload (SilentBuilder)", "value": "76710f574f213027af2b76d27f766fe01fe5a8902377624e05cd7917bc186403565516e3e392835ae32c543cfc846997", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630052, "uuid": "129994d9-c96a-4ee3-8cb2-f3c8b3e533ba", "value": "T11523B756BA5D9899E9258B3548E743E9B333FC205F6B0B833616F3257FF49A05A03207", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630052, "uuid": "d6a26d8c-d1ca-4016-abe4-f0ae5d008ac9", "value": "768:yDM52tfQXi8vgLZkTOHkQT51Vp6AwPdM8gQ6JOiX6DGwUk7qHDSEuRZjiBp5z:y62tfQXi8vgLZkTOHkQT51Vp6AwPe8gB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650630052, "uuid": "9ab73616-7479-40dc-b37b-44105ae1a772", "value": 48128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650630052, "uuid": "17f5a079-e8d4-46a0-a830-0ff2af98163d", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630052, "uuid": "44d9aacf-f353-4d99-b466-ba35bf69dc49", "value": "form Dt 04.21.2022.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43d2627a-c245-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650636328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650636328, "uuid": "479cd709-ee93-4f98-848d-d06c928877b1", "comment": "Malware payload", "value": "6250e345b04dac081155c1ab1c5a5655", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650636328, "uuid": "47cc6075-6b0c-4c01-9ab8-a3473d00ede7", "comment": "Malware payload", "value": "6c06934cacfb25ba949cb57115c58286b622dc6c9e61d0d64ae76d279eb019c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650636328, "uuid": "136c36cf-e104-4d1d-8c88-8f60d3cd3c14", "comment": "Malware payload", "value": "1333a96cfd4c0b9db507f1389de6770209d28520", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650636328, "uuid": "3bf174e5-eb43-496f-b7fc-212ff0c90353", "comment": "Malware payload", "value": "2ea6629da905522c7eb0bd27ac07bc59abfd63e006ab6c9ec5efc13e6675242cfbaf44fc469ca4414a81b97fc0f888a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650636328, "uuid": "0c359424-dd96-4e08-9fbc-568e33f9c140", "value": "T16BD49D11F6AC80B5E07BD13DC9A3875AE6713C9847B943C79255EB2A2E736E05D3E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650636328, "uuid": "3e041d89-57ef-428a-8f60-a9bc7d3fa2a5", "value": "6ba79cbed2acbe9b8ecc8e14a572f100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650636328, "uuid": "7b63cec9-062d-4fc3-bd22-ee5377803990", "value": "12288:C1FIcocJwMTHzXO7N2EBHiyzskF1CubVnmn:tco9MTHzXO7NJ/115mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650636328, "uuid": "8a27374c-4a07-4091-8126-3cc2868002c0", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650636328, "uuid": "983a7566-fb0c-41d7-bb34-d06309ee81ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650636328, "uuid": "d4875651-c5ca-45f1-9c76-3f72ec7ecb99", "value": "6250e345b04dac081155c1ab1c5a5655", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71a2e3b8-c25a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1650645425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650645425, "uuid": "c16382e7-9b50-4b3a-ba6f-53e9455ed30d", "comment": "Malware payload (Formbook)", "value": "12ef0d814982f8902126ce887aca5741", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650645425, "uuid": "3d26fa51-9f7f-40b7-9efa-5022310c9562", "comment": "Malware payload (Formbook)", "value": "6e2d552e111d1303a2b72809cd77f7aab66ce3e7bdfc243f0dcb53c30d272736", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650645425, "uuid": "df2008ea-046d-438c-9ff3-a0b0da83c107", "comment": "Malware payload (Formbook)", "value": "155412b7d9f08710cc0ae210453deaffe3651334", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650645425, "uuid": "f7991acc-ee01-463f-8a82-4445f9f74c2f", "comment": "Malware payload (Formbook)", "value": "51f1e5d46a440d5436e9417107e4d8c8c9bbee0559c41dff5c7c2909db548fbd62ca8b1bb4a1dd6d173997470c6fad78", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650645425, "uuid": "63f952ec-7172-4bf2-92fe-79a6029d9dc2", "value": "T16C2412147A75E0BBE1B20F721C3AE6E3AEB565691834460F97E0AF4D7D236C0CA0E355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650645425, "uuid": "97db5bca-f041-4dfd-a980-99da285fb5ee", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650645425, "uuid": "048e9963-630f-46a6-bf0b-61d74c480471", "value": "6144:HNeZmPj9xGVS30eE89rmG4U1PXzQHTo3DeDQePlSVLy36:HNlPRGSrmG4UtzQzBFSpE6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650645425, "uuid": "f725c648-65be-4bc8-95e7-9773e541c858", "value": 224515, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650645425, "uuid": "f196d626-01d5-43f8-a706-86824bc1c3a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650645425, "uuid": "e6b7524d-d39b-488f-a61a-9eca80e8209d", "value": "12ef0d814982f8902126ce887aca5741", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2293a045-c254-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1650642715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650642715, "uuid": "93682409-c551-41c4-a004-72f79ef631ae", "comment": "Malware payload (SilentBuilder)", "value": "0c68b9f03d83459eb6a2aaaa78128a9f", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650642715, "uuid": "2643e054-3be4-4e2a-bd88-cbfb0795a297", "comment": "Malware payload (SilentBuilder)", "value": "6e38ff31e24e7ea1d5d02f32c4e182df34e75e560dc742b09df17cd66464231c", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650642715, "uuid": "8bdf7da1-0482-4f24-8682-80c2e3722e9f", "comment": "Malware payload (SilentBuilder)", "value": "34791703209afd02824f8f9bb2c51bef057755f5", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650642715, "uuid": "dbe9659d-c124-4cd6-a2cb-fc836985e241", "comment": "Malware payload (SilentBuilder)", "value": "a01c537dd070d3a585506c13e4a052112b90f182129d1121304ef2be18daf82dec74af4618aa9df9c5fcc2f40462e7a0", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650642715, "uuid": "3145d90b-b560-403d-af6e-09d703e492d8", "value": "T11F23B646BA5D9859E9258B7548E743E9B333FC201F6B0B833616B3257FF49E05A03207", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650642715, "uuid": "73a14f10-4ac9-4d8a-8c0e-4d1d7704e3c6", "value": "768:4DM52tfQXi8vgLZkTOHkQT51Vp6AwPdM8gQ6JT5X6DGwUdh+pqjeSLjcvLtzrxFK:462tfQXi8vgLZkTOHkQT51Vp6AwPe8gv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650642715, "uuid": "9007c529-c825-49d7-8861-e0397f992754", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650642715, "uuid": "4299bb23-eaf2-4c3c-b581-a3fade7e284d", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650642715, "uuid": "7269962f-4d70-4b74-b91a-3d20108326b4", "value": "17968932919480902.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "febd8ffd-c20e-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650613020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650613020, "uuid": "f250fd63-4c18-47a8-9c8f-2f5e597a12eb", "comment": "Malware payload", "value": "f1763579a9319d2506ee468031e1eb1b", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "LazyScripter", "colour": "#6D8205", "exportable": true, "hide_tag": false }, { "name": "pass ABCDE", "colour": "#EE32F9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650613020, "uuid": "33b6981f-fb59-41e8-850e-ca505fcc9fce", "comment": "Malware payload", "value": "6e3ef2551b1f34685025f9fe1d6358ef95fbe21ada8ed9de3c7c4d5070520f6e", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "LazyScripter", "colour": "#6D8205", "exportable": true, "hide_tag": false }, { "name": "pass ABCDE", "colour": "#EE32F9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650613020, "uuid": "4a18e3d5-bad6-4f86-8d5f-c00f18506ef8", "comment": "Malware payload", "value": "0c382cd67ddcee292095d2ba0dc6c28363d7e5b7", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "LazyScripter", "colour": "#6D8205", "exportable": true, "hide_tag": false }, { "name": "pass ABCDE", "colour": "#EE32F9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650613020, "uuid": "e6969b27-3b16-4548-b57a-02efc349fcd3", "comment": "Malware payload", "value": "b49a38b9956d8e83139573a8f0636f875ab21ff3667efab41e716bf6321ca0c02d4cf357b2f84a4b85c330ed9f082a9e", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "LazyScripter", "colour": "#6D8205", "exportable": true, "hide_tag": false }, { "name": "pass ABCDE", "colour": "#EE32F9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650613020, "uuid": "e4fb0771-d463-46f8-92e7-3b0214b7e358", "value": "T1B403E1707DB6BEB5C1100AF3A3BF869899E2BC104D61C76731A7BB6C9A396620C1C305", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650613020, "uuid": "d4eba4f4-5f8f-4ccb-8802-d9739d521eba", "value": "384:QkqsnL4LU/q56Jl2Utgvq/DMfLZ2tY/TODOYF9Y5Stai3yZjkY+Lv2QtwN7fiq:fq9Sq5vKI924IOY/ySH8A2QtAn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650613020, "uuid": "e3ea3aa2-8dcc-484c-bf30-b87bcd1dd21a", "value": 39424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650613020, "uuid": "3b5174dd-d8a4-46aa-b740-01b38922233f", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650613020, "uuid": "13364196-4463-419c-ba3a-9712afcff1dd", "value": "Recommendations.docX", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "948829d7-c205-11ec-8e58-42010a9c0032", "comment": "Malware payload (GuLoader)", "timestamp": 1650608976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650608976, "uuid": "cfe3d503-214d-462e-91ff-4a23ab397105", "comment": "Malware payload (GuLoader)", "value": "d78aa8e9ad3f84fdaef09dd6ace808fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650608976, "uuid": "aa1e74e1-f530-4de7-be07-a73e7daea4e3", "comment": "Malware payload (GuLoader)", "value": "6f889e87bba115ad4ded061fc70129311fb110f987a64798c9c39002250ad39a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650608976, "uuid": "00e7fdfd-9213-49b2-bb5d-8126ebeb48c9", "comment": "Malware payload (GuLoader)", "value": "2390f08b732cf2408401d936807de7237ff7b72e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650608976, "uuid": "6152f52b-19ae-4c5f-9e02-0522bfe31e67", "comment": "Malware payload (GuLoader)", "value": "3d57acb25377a98a6b49ea6efdb661dff14ba28fa84a5a89c42213cf1f848071c91bd0c5ebae1eef5ed6e6ac181d84b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650608976, "uuid": "e641e22f-e688-4c23-afa3-820f50437742", "value": "T182B4C46E736096B8F45889B44933DC604A676C484B95C7DBB39CF32F147B9C9C20E8E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650608976, "uuid": "96aa6840-3ce2-485b-9428-242facb6d259", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650608976, "uuid": "6adbafbe-023c-4ecc-950c-dece4832250d", "value": "6144:7Ya6OpR9xyBMc+6/FSU78YxjO7N3UHPGweb9qD1u:7Yk/9xyBMX6/FSU78YxjyQyb9qD1u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650608976, "uuid": "b3926d93-0f4d-4d47-b4c7-56500d37ba0d", "value": 535792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650608976, "uuid": "4c9e68ea-1247-43cf-b606-69cbece0fa60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650608976, "uuid": "cc953bf7-98bd-4d7c-b595-c49b75bc2d4d", "value": "FRACCIONAMIENTO 1722403906461L.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5cad311-c246-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650636949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650636949, "uuid": "7a661731-db66-442f-8757-c3a3098f6803", "comment": "Malware payload (Mirai)", "value": "fdd631b3f16b44e3f6e685d5b3a890d4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650636949, "uuid": "7a01b7d9-ccc8-43cf-8f3c-ac6b0c079103", "comment": "Malware payload (Mirai)", "value": "700f0f5b1634b0326d186bbf8b34582150cb37b660c3563148c89e85fc2d5801", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650636949, "uuid": "3fc1b607-094a-4fdf-9f87-d3c82eece0b2", "comment": "Malware payload (Mirai)", "value": "3e237952a7ece35644eedfce9f174d36cbcbaec6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650636949, "uuid": "29e97c59-7050-4e4e-bb08-aa01b4a54f12", "comment": "Malware payload (Mirai)", "value": "fdd71f6cc167a4ed572c59949aa389676a42cb7a6c17134971b87f3e225d4efb0ba1aa17279ec9867ebec9b210dab077", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650636949, "uuid": "adc8e90f-f428-4441-b594-137460a1ad1a", "value": "T11EA31A44F841872BC3D327BBE78E479D3B36569467DB33116A386EB42BC17C92E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650636949, "uuid": "df00df6f-36c8-4371-885c-d80c8d15c978", "value": "3072:VSx+i6mqaObhN/nPNKV+qKmZuqQ4DPwXXtse:y6mRObn/nP7qKmZuqQ4DPwXXtse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650636949, "uuid": "1ad1fcaf-eb1e-4879-ae11-eae810c35b3e", "value": 100871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650636949, "uuid": "36a137fe-ce6f-4de3-bcf1-7d587b0f9c3b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650636949, "uuid": "0ddd7cba-accc-4505-9644-bdbbf9ddea69", "value": "fdd631b3f16b44e3f6e685d5b3a890d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36adbcf9-c202-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1650607530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650607530, "uuid": "3c432c6b-5d36-4ee6-ae8e-ed6ff3457236", "comment": "Malware payload (Loki)", "value": "2ae028767a4f6eb9c623b3da3e917c50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650607530, "uuid": "6902a77a-2145-4db5-be31-2dff6e74a0eb", "comment": "Malware payload (Loki)", "value": "702966eb365937eb195010449eb592a3817d74d0f7e4da14a0e9fbb13b5303b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650607530, "uuid": "8a4dbf1e-625d-45b8-af26-70d9f38a50ff", "comment": "Malware payload (Loki)", "value": "47c9f7224a692a2b6b7310d2bf0c74edf0c932c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650607530, "uuid": "6c96b59a-586c-47b7-ac46-b17c8e02f124", "comment": "Malware payload (Loki)", "value": "2c8a92104a6a05641b377a7f905e4f90d0cb5cb7c6d97859bb6f6be9db866f3cfe151527a9de194debb17d7929c9a703", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650607530, "uuid": "4d55367b-08f2-4ef9-b28f-94dc1c47828a", "value": "T172A4021273A4C255C4BEEB7A68E0048B87F4C103570E975D1D2762FB2A62790676FB8F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650607530, "uuid": "3b9f005f-759d-4f6b-9ecc-f139f34006c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650607530, "uuid": "fdff2e9c-3b5b-4d87-88ab-e6fa4f8fffe0", "value": "12288:DaV5zfgYJdYufeLJaNbg8pjyxrWE6ucP4Mj9AYtv/h:uVVfgOY7LJaN08pRP4IBdh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650607530, "uuid": "8b4847b1-f342-4ba0-b0e4-2f444f9a8bd8", "value": 472576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650607530, "uuid": "460af137-07cf-45e1-932f-4467bb9d74e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650607530, "uuid": "15903b81-abd3-47e7-8de6-05f72c88bd2b", "value": "Shipping Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83574fcf-c261-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650648461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650648461, "uuid": "47106895-5ef8-4bc4-a8e4-1c2ac2a28266", "comment": "Malware payload", "value": "390497bfb3e6c4f7b9b5b63406a1fad4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650648461, "uuid": "a54f1307-3838-49bc-b4f7-0b3990aaf54d", "comment": "Malware payload", "value": "711005c94107755e4bad96d35b2d862aca7f4b4df8038c19fa9b6b21b995802a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650648461, "uuid": "7e4226e1-01f0-46c7-a333-4daa6f92e6b6", "comment": "Malware payload", "value": "321748ccf1438f241593f1c9dea79d25b7451d2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650648461, "uuid": "b2f306a0-aac1-44ea-a35f-cf0ca8f18c81", "comment": "Malware payload", "value": "5d5d3f95af30a67a14b4bc1cd842dccdf0d5a50633aa91d0c43e2ece0ceb9e49549319e8a02348797c1e09b9bc7ea4cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650648461, "uuid": "7866cf41-ac4d-4230-af4c-2a27e7208497", "value": "T181D49D11F6AC80B5E07BD13DC9A3875AE6713C9847B943C79255EB2A2E736E05D3E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650648461, "uuid": "90a7f75c-2f51-4ed5-925e-e857ace38350", "value": "6ba79cbed2acbe9b8ecc8e14a572f100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650648461, "uuid": "9bd7f2e5-cab9-4ebb-9c3e-e9b7b8788c83", "value": "12288:C1FIcocJwMTHzXO7N27BHiyzskF1CubVnmn:tco9MTHzXO7NK/115mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650648461, "uuid": "13a5db1c-cb12-48ae-b44f-577cbe5f2946", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650648461, "uuid": "59e51c84-26e5-4c2e-a5cd-b6e8558f060d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650648461, "uuid": "777af13d-b27f-40cc-b105-53e54f02824f", "value": "390497bfb3e6c4f7b9b5b63406a1fad4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b2ef68f-c221-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650620986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620986, "uuid": "3b264669-ac58-49dc-a8ad-0d25c41883ad", "comment": "Malware payload", "value": "8935064c2c6f2745464806696a625240", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620986, "uuid": "91784f5b-d768-431d-b45b-260fe0f84ff3", "comment": "Malware payload", "value": "711bffcc7b4aa80fc69c648dc4b1ab6ff6ec18bf0f8cdd0c75fd564485eecdb7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620986, "uuid": "7a0d77ec-2483-479a-908c-fd13f5363309", "comment": "Malware payload", "value": "30cdca04fbbba51828138b219617f50ee273b796", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620986, "uuid": "d085d0f9-7732-436a-a1d9-f9e7b21d04c6", "comment": "Malware payload", "value": "b9e173484751e091710b9927a52853878387b8c7950d0a734e7d501ad78e0b96a7d80c655925aaa6d90c88775c498bde", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620986, "uuid": "3feba1cb-0729-4450-99b3-8a9dfe783230", "value": "T157F56B22B345653EC06B1A3A5537A2DC9D3F7B71762A8C1B57F0198C8F365402B3EA1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620986, "uuid": "ad756d93-d7ff-4c9c-862a-26d2b4e50c59", "value": "31f3fb1b3398a8420d31059bc5924151", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620986, "uuid": "1ecaafeb-b550-452d-a49a-cb16375db7d9", "value": "49152:kqy5I93Wx+L9SJxh75CuVwGXUKW9FiBAOgjToH/eMbPtUA:kqQ+a5Cj2UKW9dcdtUA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650620986, "uuid": "54adbda8-c44e-4b12-8a7b-370e8e63bc2d", "value": 3418624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650620986, "uuid": "1d30e024-7fab-4dc8-8ee0-3703cff4182d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620986, "uuid": "50a9e0bf-7555-4056-aef2-4be22db45fe4", "value": "SecuriteInfo.com.Trojan.DownLoader44.44928.1039.8469", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd13ff5c-c255-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650643457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650643457, "uuid": "14cf210a-4150-4786-92a6-c3a3061dde3e", "comment": "Malware payload", "value": "5b7a783f1b10145dfb99c39d0b743ce5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650643457, "uuid": "ec88c780-3efd-4ff6-9a6b-4fcb7fa1e5a9", "comment": "Malware payload", "value": "717bc1b4343abcb39d13816cc82cf4b3988060857c7a81a22c0509d0fc32131b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650643457, "uuid": "2d8ecc6f-c063-4696-b02b-8481ff73938d", "comment": "Malware payload", "value": "1ca9665dfe69628139229688593eda782fd4c56c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650643457, "uuid": "c25a6494-4c39-44db-b78e-db19ffa02aac", "comment": "Malware payload", "value": "ee0dae30384886d9f293d7f3dfbec3377462b8b71b16981d295e88e92236f97ec85563e08ca68302302766814385634e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650643457, "uuid": "7a70bcad-abcb-4795-a50c-37b03b773ec0", "value": "T10DD49D11F6AC80B5E07BD13DC9A3875AE6713C9847B943C79255EB2A2E736E05D3E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650643457, "uuid": "159ed2de-e80a-4fd6-bbb5-96e8bc4ea30b", "value": "6ba79cbed2acbe9b8ecc8e14a572f100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650643457, "uuid": "f9d470f0-5cac-4903-872e-9f09929915cc", "value": "12288:C1FIcocJwMTHzXO7N2JBHiyzskF1CubVnmn:tco9MTHzXO7Ng/115mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650643457, "uuid": "6d5829e2-d1c6-4d7a-afd3-ba1d9e41a34c", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650643457, "uuid": "767fe919-c59a-443f-8c49-e151abedaaf7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650643457, "uuid": "3c5ffd7e-2b30-459a-913f-5bf1962a75b3", "value": "5b7a783f1b10145dfb99c39d0b743ce5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f98474d1-c21a-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650618165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650618165, "uuid": "084fb943-2e12-472d-b884-3c6dcd3872b8", "comment": "Malware payload", "value": "af77782a52f0dfefa2dec46c21629a2c", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650618165, "uuid": "2447b828-f3da-457c-8be3-3ca18a6064bb", "comment": "Malware payload", "value": "7230a7afa29f8f58aa559393886a0a0e8ed4c7be7966e74e10db9c3c3873c542", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650618165, "uuid": "24b6deff-4941-4f82-bc62-37996404780f", "comment": "Malware payload", "value": "73353ee04f891d27451c3ffb45688537bcc8ea04", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650618165, "uuid": "2c7abb11-daea-4571-96a0-5f306f41c92c", "comment": "Malware payload", "value": "0b06e375152a98514ecdee05352d4652b386e3f461e8c43a5755e0fe048fe2ef92e1fb98daed5999ef3f1a6a4ae96768", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650618165, "uuid": "a73f0597-9937-4167-b3ec-5aa10f721ba2", "value": "T14104BC8CB04E8364B5FD5EA38A9610CDBD411FB2B5043C414C2BB6D984A7778DEACCA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650618165, "uuid": "037007f6-37ec-474a-9691-b84019437aa1", "value": "768:VxpBfhejrwQjewNj8x2PjwebyOx2Pjwey7yQjtrF8kjReyBfhejrwQjewNj8x2Po:Vu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650618165, "uuid": "71f13ae0-9f46-4dc0-ae99-d8c57f8f267f", "value": 186944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650618165, "uuid": "4797d4d6-126d-41ee-bbf2-3ae140f2e0a4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650618165, "uuid": "3c3f36f1-a7a4-4028-8e49-deae2f815ff8", "value": "Info_Releve_ID02155007.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d8cee17-c24f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1650640693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640693, "uuid": "be738b31-18bd-4e85-bcf8-70470fb4da07", "comment": "Malware payload (Formbook)", "value": "f5afe7f7259ce8039978af73dc03d27a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640693, "uuid": "739f3068-c8c1-4813-8983-93756dbf380f", "comment": "Malware payload (Formbook)", "value": "724305f278a5c8c462087fd78ac98dcc0afcb431506c41a828cb02f48b065c81", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640693, "uuid": "b8c01461-79d4-44a8-8b15-428f08b129db", "comment": "Malware payload (Formbook)", "value": "bc932bd0eeb4d31b200b4f15b41a7dccc6c9acfe", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640693, "uuid": "ff52aa7d-f90c-4a60-811f-b26e1a24e93f", "comment": "Malware payload (Formbook)", "value": "a1ff8727f25b48abf0f3d03e6e8c907e2f5eec687f3b14f23190214e78e68479083d221ddc43ca5e998076190a233f67", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650640693, "uuid": "095b2a37-7b79-4805-9b91-41f3fa915fc0", "value": "T1C7C301086FB7993CF057E5331912CCD4A2D53F183A617B1DA2ADF51588B2878F89AC1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650640693, "uuid": "2fc59be3-806e-444e-a748-49abeead6557", "value": "3072:516KXHIF/ehlx433zg0D8X2Mylw62KrTrQS27Q:76KXoFW/x4HzNA2X2KrTES27", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650640693, "uuid": "131c9d9d-fbb5-437a-8452-3c7d868c9428", "value": 118272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650640693, "uuid": "ed41dd96-2a3b-48af-961b-132a98b3d282", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650640693, "uuid": "f758fa8f-cd6c-4b36-a877-f13ab6cf2886", "value": "TT Application form.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7e5b804-c242-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1650635261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650635261, "uuid": "6b1df339-3c9a-473b-90d1-67d3e1ba7f44", "comment": "Malware payload (SnakeKeylogger)", "value": "79a2858fca525953161dc2efaf13d661", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650635261, "uuid": "65f2e288-6961-44ab-8e2a-f55d39810f2f", "comment": "Malware payload (SnakeKeylogger)", "value": "72bf26bdf472006b4c7bf9017bd5387bef26a76a1cb0ddae66a361dc45bffd71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650635261, "uuid": "464e03b4-5686-4fcf-95fc-56124e16d0a4", "comment": "Malware payload (SnakeKeylogger)", "value": "c770489dca11b776a8106c418402d0779709d5ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650635261, "uuid": "222e6334-380c-496f-885e-9269daee6362", "comment": "Malware payload (SnakeKeylogger)", "value": "d88d68e65e458db8a772814715417ffabb3119554694bdba0373d051891f8e4c4d5f2002d089b89315b1957a649bedb0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650635261, "uuid": "de547393-eb29-49b2-9be8-95be0172e543", "value": "T16C04A68CBD58802CDDA9EA71140FF573FE2A7F8AB54C9B54E4487FC63A72521024D935", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650635261, "uuid": "e1abb63f-07bf-481c-86f6-1004a08bdc23", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650635261, "uuid": "0be97987-5649-484b-9d14-5b0a0760a573", "value": "384:WB1O6U/txlA5V+Bmjkknfffffu7ky5w5SWmi8MYQmbFvDptYcFmVc03K:C1s1ROkjkyipmi8MYQm59tYcFmVc6K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650635261, "uuid": "580992f0-cb8f-4145-a539-adf1684b0236", "value": 184320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650635261, "uuid": "738a9aab-bc76-41cf-b796-4cef8b5a9764", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650635261, "uuid": "84e0fe3d-f867-4121-a1b1-6969fbad2376", "value": "SecuriteInfo.com.W32.AIDetectNet.01.22194.29508", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66cf0df2-c253-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650642400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650642400, "uuid": "d5121616-a6b8-4618-a140-b948ebe01361", "comment": "Malware payload", "value": "3c8687af935f7389c6a753129218d0c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650642400, "uuid": "c425bfb3-6e0d-446d-92a3-3edd719e7f85", "comment": "Malware payload", "value": "72bff27b507921776936b8252629e609513a48f6af2ce53f0f0511ea83c67b64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650642400, "uuid": "8cd92dc0-6a42-4fec-ab29-e9c218b8412f", "comment": "Malware payload", "value": "132570568affce6829ed20bbcbdc01409abf679f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650642400, "uuid": "83a00d95-22d0-4b6f-9592-c5f9b57246e1", "comment": "Malware payload", "value": "dc24622cca40b98e21d6796eb17f2b19aaa18cf0a13850a4606944d43e3a731c828e2e81901de18651e69ff3dab53698", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650642400, "uuid": "2b928326-6968-41ed-9ca8-c47802c7c92c", "value": "T1EAD49D11F6AC80B5E07BD13DC9A3875AE6713C9847B943C79255EB2A2E736E05D3E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650642400, "uuid": "c1ac1714-32c7-4c43-8b33-86974f2e2310", "value": "6ba79cbed2acbe9b8ecc8e14a572f100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650642400, "uuid": "c3568b90-c0e2-412c-a54a-5f701f03947d", "value": "12288:C1FIcocJwMTHzXO7N21BHiyzskF1CubVnmn:tco9MTHzXO7NA/115mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650642400, "uuid": "c0742a33-d10d-4260-92bf-e79c843eb5a9", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650642400, "uuid": "74d07e69-d449-4105-b149-b7489694bd9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650642400, "uuid": "14b0197f-54ec-42a5-9d4b-a1fcebda491c", "value": "3c8687af935f7389c6a753129218d0c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8360c74d-c254-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650642877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650642877, "uuid": "fa952cfb-a1fa-4eeb-b6a9-c698ab5d363b", "comment": "Malware payload", "value": "0831b5b8a0f761ffb094b2c7d7da53f9", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650642877, "uuid": "fc79435a-c17d-493c-9e16-a36d3ebf1bc9", "comment": "Malware payload", "value": "738109c172d12f55a5596101b07ff0a8200729a0c5c4170521656eae14cbd1b5", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650642877, "uuid": "70a3f220-e25a-4fa0-8cfe-4642c5139c48", "comment": "Malware payload", "value": "7f6ad225c6b4130eece0a597749f8f4e803d31e9", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650642877, "uuid": "30bfadb9-dd4f-405e-a2b1-3076f6b35e44", "comment": "Malware payload", "value": "a4dd172ad513b8c3ab4ee88703cd91e3751cf0eda916675fcfd53ce7365d508b5d5f32949954f46bc775807132499d1c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650642877, "uuid": "5e49d82f-387d-45df-932c-1b9bfd067c38", "value": "T12AF48D4BF77C84A6D16AC979C5639A8AE6717C454B71C34B4360FB3E6F337A05A2A300", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650642877, "uuid": "00a22152-6df7-4d65-bde5-e630520b3060", "value": "57b460f7cd0fab28b120cd121cfb7f9f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650642877, "uuid": "e98c905d-20fb-449e-adbf-1ca01e22e906", "value": "12288:aIabL1+x29hs+bDBLKhKmCKzTrjoi0I8PxiGhWzx+o8/NQfN7IT5p:XabLXhs7AZKzvjNT0hWzP8/yfRIT3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650642877, "uuid": "c03a7c2d-a3d5-4dd8-9d37-1a0965f9fd22", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650642877, "uuid": "d83edc6e-bb27-4bde-b042-c55274fd3981", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650642877, "uuid": "cc9f9ea4-282a-4d05-a3e6-c5c2ed462a9f", "value": "emotet_exe_e5_738109c172d12f55a5596101b07ff0a8200729a0c5c4170521656eae14cbd1b5_2022-04-22__155433.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bc5a896-c282-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650662568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650662568, "uuid": "609c6737-fbe6-4315-b8d3-f086919d7116", "comment": "Malware payload", "value": "8481e437470be231d21db55607220188", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650662568, "uuid": "b8499939-8a9f-4397-a55d-9ba352b9f735", "comment": "Malware payload", "value": "749dee65c73288011781c5aaab24030e1796ab2eeafb35c91840f793cdacee79", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650662568, "uuid": "641e2d60-7040-4f74-8470-25a18c1e9b84", "comment": "Malware payload", "value": "f9d72835d519662d48b0f930e7d32dfcbc2fac4f", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650662568, "uuid": "48182934-513a-49be-bf2e-1b1894ab11ec", "comment": "Malware payload", "value": "b16ffcfa8cf443d2bfe7f6292ba277470fe8f09744b6e19c234de6369dee85175158cf60529dba61ff547e1f1da5794c", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650662568, "uuid": "c73a7638-7a0e-485a-9795-d9f07c499a1a", "value": "T1D4C50216E8AC9879C593327F41674E5BFF28C0CD865EEB4B64B6210A8CB43671B1738D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650662568, "uuid": "6dc17dbf-a41d-41c7-94bf-a75d80aadff5", "value": "49152:MA782IvYWqiYu5h1/kUvATk5XlbEEw8yKcBFVyHye9afCHKhZx2Eu6po:MAg2rF800AglLw8yFAHwVZx5No", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650662568, "uuid": "e7717953-0aac-478f-8c30-575038546969", "value": 2700120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650662568, "uuid": "3e9da168-1c7f-4106-83c5-a1350ee37bad", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650662568, "uuid": "57084e88-f26c-48b5-88af-2d4c072e9383", "value": "OringoClient-1.7.1-everyone.malware.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c217957-c24f-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1650640584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640584, "uuid": "270eb7c9-ecbd-4746-8555-91b96399a22a", "comment": "Malware payload (SnakeKeylogger)", "value": "09811052c7560a413e9f6ab5adac8936", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640584, "uuid": "2a9cf147-61cf-4a1f-96ef-0e5233a37daf", "comment": "Malware payload (SnakeKeylogger)", "value": "74a26de947a6f1ae71a8f6a395477e06031a758e71fc2da72e701f08cabd6c49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640584, "uuid": "aa1dfd97-2623-4f6b-8204-3be2b556479d", "comment": "Malware payload (SnakeKeylogger)", "value": "f01ac18c203ca424530350e60e89e6df3a47c3a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640584, "uuid": "ec4e600f-3880-4604-89a1-c07e00f541c9", "comment": "Malware payload (SnakeKeylogger)", "value": "95e2142c0db01c76e255ea127dff68f59547e41a94d4ec5bce4965add94f6e010854a0644ae896761a272661cbcb7090", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650640584, "uuid": "6bf0b2a3-50e3-48f1-b077-4ca9b5c7484f", "value": "T1A1D45CDB2F90BC14D23F2774E958718086F172DF4A5FC35A4882B5EA77B1244A9FA1C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650640584, "uuid": "e47717c7-fd41-4285-90db-3c5473c3b224", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650640584, "uuid": "e1f840dd-0aaf-450f-949c-edb2d57bdf1d", "value": "6144:l+Wl8jC0M9kA48glk938SRkkIKPhQUUKs9IEVh9cm0ywoCBrmVCIYxxCZd6tppSg:Yn7A48L938Sz5+b9FLNwozY2OWO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650640584, "uuid": "2c38dacb-8ade-4513-ac8a-5ecec8c125bb", "value": 612352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650640584, "uuid": "bdfccc2f-2a26-4e35-895e-05dc6b12a47b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650640584, "uuid": "429f126b-abdb-43d3-844a-88bc5ceff9d4", "value": "Purchasing Ordersigned contract No.024Ducref06924-INVIII2022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d6ddccc-c221-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650620990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620990, "uuid": "c219bb2a-5535-41f7-9482-7c4bb3f97d58", "comment": "Malware payload", "value": "29917dd31814b4b22efa15cdda439ce8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620990, "uuid": "32bc4a80-9266-4a52-a49f-70da39976c33", "comment": "Malware payload", "value": "74b239b21d1a9b82c07004d6ac7d684b82d551530c7c4a9d70eb933593fa8e9f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620990, "uuid": "578c78ef-7d95-45ef-bedb-04bca959e655", "comment": "Malware payload", "value": "e5e6c897a8b5f8da647d3c902b9b603eb3e3f411", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620990, "uuid": "9ef820ab-2d55-4e55-b065-601134edd2fc", "comment": "Malware payload", "value": "f98c1a38dc5d9e280653e2bced48e29fcff4acdb1e5f5a0c639d5a8470ad57257a935f5f4eaef845dc99394fe95d3030", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620990, "uuid": "bf6fa022-82c8-42d7-b099-5ad36f942fef", "value": "T128365B23B244763ED46F0A3E8637EA14993F7BA279128C5667F04C8C8F39481767B647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620990, "uuid": "3295f562-b74d-421e-8f7c-a6a054b28209", "value": "7446cb8876221c8b32f6418f8d246a9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620990, "uuid": "79cb098e-adbb-4bd2-a1b2-d711a296a8f0", "value": "49152:CTBT1ptv3ycUZISFzBPhGYBF5hhMYU4uMlGpVneXgEMdY3MGZT6Vwjaqbf3:CTBTPb85hhMpTVeXOGqcaq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650620990, "uuid": "f4e114ef-4311-462e-9d19-dc3c4a53613a", "value": 5059072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650620990, "uuid": "c70eae1a-9d41-41f2-8e4b-5bfb5af76839", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620990, "uuid": "fd7e14b5-3886-430f-883a-a2ff1071a10e", "value": "SecuriteInfo.com.Trojan.DownLoader44.48008.27580.22037", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9666820d-c221-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650621005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621005, "uuid": "e627042a-d0ca-4a50-b03f-35d199ab2114", "comment": "Malware payload (Mirai)", "value": "5c99de03dc9fc861c5c626767f425825", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621005, "uuid": "a721cc0c-79a6-4a91-91c3-9c05d1bc8b80", "comment": "Malware payload (Mirai)", "value": "75a6ce1d3cfa043cf4465797d45fdfe10e8ccf9bd46c237fc9e5a1ebce349602", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621005, "uuid": "4801f5b7-0751-42cd-93ea-a66d9c5072d8", "comment": "Malware payload (Mirai)", "value": "ec12abfb793514543fdfa7a08621336ac9c1b860", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621005, "uuid": "955d0698-dfeb-407f-846b-0e99ccaf05a3", "comment": "Malware payload (Mirai)", "value": "e28dd4ed0e41169bdd93b90eeac2974f87af82f5301b8023efa98b952dcb4806db109299ec1268d14a690aa911357ef8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621005, "uuid": "adfcdc4c-8a07-4097-b64b-d287abbfad86", "value": "T1E0A2C0A1B3868E5EC57A4874E66DCA463705057C80EF3739026CD6682B4714349FC6CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621005, "uuid": "681ebb5c-78a6-49b9-bb48-7cbdc400c566", "value": "384:HVMYGg5FhxAuo5j0Sv5wD3liGvCrsLuk091G3I36Mx0/QeF9ziKljRvhymdGUopk:HVMYGcyHt0SE1NvnUqNMAQjavs3Uoz6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650621005, "uuid": "bd93cba1-f4a1-4aff-b7c9-669006f2624a", "value": 22468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650621005, "uuid": "b44ff8e3-6f97-40a1-a47a-73c804bac060", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621005, "uuid": "ff54f78b-8588-42c2-9861-26a07b6298de", "value": "b3astmode.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa012913-c23d-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1650633198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650633198, "uuid": "147fe136-aa8e-473c-87ea-e1678c92e014", "comment": "Malware payload (AgentTesla)", "value": "5ffe65d23d6b6b0b0c777270aa06b9ff", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650633198, "uuid": "b6bc0994-7c88-4687-a33d-278d8ee10af6", "comment": "Malware payload (AgentTesla)", "value": "75b98e0b461d91865e75a8e4e7dbc053389580464f22afdddc1a7bc772c2942f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650633198, "uuid": "1f8027f0-6925-4d83-9d8b-61abca919c49", "comment": "Malware payload (AgentTesla)", "value": "9da9735a4e7b6f42bc3e7b16f64773ca49ffbf9b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650633198, "uuid": "129f276f-7a4c-45af-b03a-f2861d8b9f2b", "comment": "Malware payload (AgentTesla)", "value": "1236f7b1a1b1d7140c789fc9a984ede762d39806c7fd9e88af8325a93b7ba695db7f78c79d549a1cbfd241fe00a40a7b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650633198, "uuid": "1bc437f6-0f52-49c0-89ad-7029401eaf4d", "value": "T1C7A44CBC7AE14A72FD1DD1B389018A08BB660F4372909BDF17DB25F9C74E2652D258C8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650633198, "uuid": "4f3d5c23-d145-4313-9a27-03e2237c7cc5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650633198, "uuid": "6afceb26-9cae-42c2-bc26-fb0937ada3b1", "value": "6144:SLF+9WRoAqhAW/YoMSUBPfJbRkQIhiTtZ1kuc+oWJyO/g6cCnsfbRyFplUz91:M+dAqhAWwQUB1le2XkpCgsoloYv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650633198, "uuid": "b14a3315-da3d-4b84-a2a3-c23e90377903", "value": 475648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650633198, "uuid": "44417769-b92b-4758-afb3-e0e1ea93ce06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650633198, "uuid": "44e92b08-ed9c-4d46-b108-242c24ef220f", "value": "MV PERFECT TBN VSL PARTICULARS.doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f4e3ff7-c1fd-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650605343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650605343, "uuid": "cf975575-40f4-4f9c-b795-a5b396e69354", "comment": "Malware payload", "value": "7801dda4db1b7adc546302f9859df92a", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650605343, "uuid": "cb7487e6-dde5-4b14-b94e-e312a72ed864", "comment": "Malware payload", "value": "76d2a46d1ef0c77e7e6dcc56a1e8ccbd9c2698baec2f023eb41428f5a21562f4", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650605343, "uuid": "68265924-457b-4f12-977c-a9286965ceec", "comment": "Malware payload", "value": "31a555dd5be3a3bdd64fac689065c5b0f0adbdf6", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650605343, "uuid": "33fcf5c7-99c7-4f38-b803-a9804a9a2f4d", "comment": "Malware payload", "value": "a1fa680bef6847401927792d2ffc009cc4c0bfede68a1c75a040974d9ea49123ba3843f558249123b4e217d23768bc2e", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650605343, "uuid": "7a3e71ea-51f7-4a19-a503-fffd713c8f8a", "value": "T1B0267E12B2A45D3EC05B1A3A4B37975459BBBA702922CC77D7F4286E4F3DC402A3E647", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650605343, "uuid": "6aa86c76-81d6-42ff-a9c2-c189ea17d9b3", "value": "98304:/Q0Hb8H3Y5i728C0m860//EeSBndHOYwA:/xb8H3qCjm0XEeS59", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650605343, "uuid": "7086701f-67e0-47d1-b8c3-79b97e03439c", "value": 4748288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650605343, "uuid": "e8a5c976-585d-4073-b2cc-a33509f61fc3", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650605343, "uuid": "cc8f47fa-773c-4e90-bc3d-ccfd3e3d22bc", "value": "FactsnowEndes.Impagada.MSI", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9d7cc20-c1e6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650595805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650595805, "uuid": "07b4efea-1fec-49e5-9b3b-5d26cf909b21", "comment": "Malware payload (Mirai)", "value": "9252a3510f8179a9dc535c5b68c86b88", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650595805, "uuid": "7848b522-96ba-4012-a745-5e676cd3737f", "comment": "Malware payload (Mirai)", "value": "76ef2c0ba9be33ecb46c7a15f9a98c77043ad1ee0b052e38f633ac806092b836", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650595805, "uuid": "f35acbe9-6ea3-45f2-945b-1f6027c74d74", "comment": "Malware payload (Mirai)", "value": "756579a8fc7fb2d1ffba103eb1c127708975ab58", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650595805, "uuid": "e92e69f1-4835-45b8-836e-37ede29e0fcf", "comment": "Malware payload (Mirai)", "value": "b301b78a4c27894d9bcc7bbfbbcbfbfbb04395157562a1dc4ee6530dedf1a87363992a2ec70808e9294ba863cc30b969", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650595805, "uuid": "a407b65e-2419-4e42-ad44-db45ec5a3e59", "value": "T144D34B46FB418F13C4D617BAF9AF424933229B94E3EB730649285FB43F8666E0E53905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650595805, "uuid": "b7764e17-e686-4a01-999f-093af0d01636", "value": "3072:f0DvinprSHrDqtVifB3RJxQds/neqfasb2mKM/9M/zrr:f0DvinprSHrDei3JxQds/eqfb2vM/9Mz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650595805, "uuid": "1750b3d9-7508-4a3a-ab28-aadd78d5da97", "value": 134572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650595805, "uuid": "cb62c911-a498-4b7f-bd4d-03b8ffe0b603", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650595805, "uuid": "532ba59d-c015-4fbd-a373-894d0f728826", "value": "mirai.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f5ab45e-c221-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650620939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620939, "uuid": "bc70d992-15da-4f1e-9405-295eb89ad325", "comment": "Malware payload", "value": "dff5bfd62e592c627077d49d2313743b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620939, "uuid": "ce40da3b-b2a7-4895-8dc7-050d5b8bc1ce", "comment": "Malware payload", "value": "77a67919b60f033524eed7b0cb122d62919eca3a93a7e6a0c32c1b94a0b55208", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620939, "uuid": "7e02d833-da1e-49e8-a29c-e27656de0bf3", "comment": "Malware payload", "value": "b730164a752a4844731a1b649b1ec6cdba4c7aa2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620939, "uuid": "6762d23e-73b6-4fc2-ad8e-d915705758a0", "comment": "Malware payload", "value": "0bb49a1ec71a806d46445485a28b0f1a36a7425bbd18935eba26041e4af149426ba8feaefa786cb14496b4b286e714d6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620939, "uuid": "867b923b-62ac-4d56-b7af-5ce97596a7db", "value": "T1CC064927B244A63EC49F0A3A5537A658993F6BB26912CC574BF4488CCF364813B7F607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620939, "uuid": "5f0bf4d5-6afc-4dd3-9cc7-872719819c7e", "value": "8d1fec45294feeb41a8e94a0b60fa2f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620939, "uuid": "73fc412a-ff67-4e9c-afb8-ab6f2905b848", "value": "49152:JsLyUgwh4SgQKqIVSmMrew9ZyVA9kzfTV0Gt:JsYrESQkzXt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650620939, "uuid": "8366000a-5880-4243-8e6d-30f23bde4079", "value": 3972608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650620939, "uuid": "f3abcb2c-52ac-4cc9-a7c0-6d4490bf17bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620939, "uuid": "4340d2f9-b3ca-47a5-bd38-b2742884cdcc", "value": "SecuriteInfo.com.Trojan.DownLoader44.44495.959.26776", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97d9143d-c248-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650637758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650637758, "uuid": "42cb0b37-993a-4ddf-bef7-4837620b7f27", "comment": "Malware payload (Mirai)", "value": "3fac1577c8694e8a5851a443862a670e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650637758, "uuid": "edaa199d-2a27-476a-ba55-6c9a44d61ee4", "comment": "Malware payload (Mirai)", "value": "77e3034f9ab5c953e15eb1dac303d70ac9a2d78a912ce7698ce46a7e2d34193d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650637758, "uuid": "f88fc412-5fb6-4c98-b01d-cbf2f1d3ff05", "comment": "Malware payload (Mirai)", "value": "ed3673cef587c52af4eecd0b4d7ed2ab9bb9b0ea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650637758, "uuid": "f286e8a8-c9ca-4458-96e9-f2c43efa794a", "comment": "Malware payload (Mirai)", "value": "9ff8981a88d028ee4ac02d260f08fb02716612b845bc71417d9d23691553d172bfdbc8ebea928571ce24824b6a00e99c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650637758, "uuid": "2bbfa72b-545d-4c8d-a715-6495eab7042b", "value": "T1FCC39517BB618FB7D81FDE33059A8902108DE58A12D96F6BB2B4C92CE74B94F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650637758, "uuid": "e986719f-ce94-41da-bd08-7d4a29c242fc", "value": "1536:/UHeTxCAms/Y8Zm3lKYA43gMJwSkJ8Ep/+DzUh8rmW+IFB1Df11hR/:/UyLqAmgMJM8EF+Dw8rmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650637758, "uuid": "fcdde2f1-921f-417d-8c77-d7832f5d9e62", "value": 126042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650637758, "uuid": "623787b4-671f-4b50-867a-4bfae4faefdb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650637758, "uuid": "32b7dfaa-2d4c-4623-9718-d256ba80596b", "value": "3fac1577c8694e8a5851a443862a670e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68d3f4fe-c253-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1650642403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650642403, "uuid": "ba6210aa-027a-43a8-b167-305cc454d2e7", "comment": "Malware payload (SilentBuilder)", "value": "7a823f96901623ca0ce09aee770e8702", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650642403, "uuid": "559cced9-e7e6-492e-89f3-f554b90d06e8", "comment": "Malware payload (SilentBuilder)", "value": "7981d1a76489f00f506d4730f780712b96cc51853bef0555706004aaf9682658", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650642403, "uuid": "d4554b94-b414-49ba-8ecf-2aa89d88dcca", "comment": "Malware payload (SilentBuilder)", "value": "88c369927707b381566ba736c462c07eec9fb6b2", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650642403, "uuid": "eec45c7a-361d-416e-8564-aae019b9e4d0", "comment": "Malware payload (SilentBuilder)", "value": "5f0138968bb7388b278eb7740be2184a2c26eae5aa077bee2210b612f522ebcaba59b444e40cd8a192d11916ca96cb61", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650642403, "uuid": "0e22819a-5809-4d7c-a0c5-af1393e32804", "value": "T11B23A696B6598869EA25873548E743E9B323FC205F6B4B873346F3257FF48A05B03217", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650642403, "uuid": "6f692563-6e6f-4adc-af6b-1147936f0f2e", "value": "768:uDM52tfQXi8vgLZkTOHkQT51Vp6AwPdM8gQ6JL/K9abdDKHGeWmqkySbuR/3ej7N:u62tfQXi8vgLZkTOHkQT51Vp6AwPe8gi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650642403, "uuid": "e7af09b8-a5e6-4b97-88a0-4bdd3e0f7576", "value": 49152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650642403, "uuid": "0ee1a315-c377-4775-8310-cc4859b6755b", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650642403, "uuid": "9f54dee4-af49-4871-b7f4-f7cddf38326b", "value": "7981d1a76489f00f506d4730f780712b96cc51853bef0555706004aaf9682658.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71b63290-c221-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650620943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620943, "uuid": "24c1933c-9624-41e9-bef3-449173fb3406", "comment": "Malware payload", "value": "b38d1d5bf25a28b8febdea418d283fb4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620943, "uuid": "03a44dd9-17d7-48ec-af13-a213562e2b0f", "comment": "Malware payload", "value": "79c4478c1c96470910d4621a2f1c2d70090fdeb3a6bb6821bc2dfd667cf2f40f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620943, "uuid": "f9641455-7a3c-4ab8-b2b1-352bd705fca8", "comment": "Malware payload", "value": "9602934b78864f6fae4bfb73395a43de20c902ee", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620943, "uuid": "29dfabb2-3327-4ae1-813a-0b131e14f126", "comment": "Malware payload", "value": "a46643a64d4ab4be995627e4c00255c93640bf5bf1c61d573bcbcc4e7a20ea00bde8a48dd1c70243bb0ff84518003ad2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620943, "uuid": "7d9c5eaf-c086-47bb-953e-2cd3f529e04f", "value": "T1BB363A7AB244763DC49F0E3A9533B628DA3F6B722912DC5747F4498C8E368902B7E507", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620943, "uuid": "6089a741-8d55-43a5-817a-9131723347ce", "value": "75e6f069ff1c78c21addabffac6a3e22", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620943, "uuid": "55e5dbd0-11f1-4d25-938c-11c1d710aa08", "value": "49152:LbhsLDlE+WuSYXLnvqyvERLA49FzTyOeVlEfWh:X+BQ9Fq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650620943, "uuid": "7e57c6f2-8546-49b7-af7a-18407035cded", "value": 4960768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650620943, "uuid": "45906453-b187-49c4-98f5-453340773718", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620943, "uuid": "5775e398-ca37-41ce-8af6-9da4747a4dc3", "value": "SecuriteInfo.com.Trojan.DownLoader44.45170.26286.27723", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfe27708-c26b-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650652911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650652911, "uuid": "c980c00b-c126-47cd-8eee-3a558ab6c732", "comment": "Malware payload", "value": "debc315f6ab9185c34a4da80086bf39d", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650652911, "uuid": "ac60e402-5228-4a9a-86ee-e58bcfe0c675", "comment": "Malware payload", "value": "79dca61a8b1f02ee76713ecf9649335a12c23bd4f247be57e3f68602d2688db7", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650652911, "uuid": "24180cab-9e21-4844-8b49-dbd5ac0dd8e0", "comment": "Malware payload", "value": "c510f896e72cb4537a605a3dd8f0a82e4b1f4ed2", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650652911, "uuid": "75dc2c13-c81d-4468-bac0-ea3536791d64", "comment": "Malware payload", "value": "943a18e6d2e17b6e6a34e42f5a67b9ebc4d94f45932fa8cc48e373f5d41af3f4b2d3095e3a76a5b047fe6833534af386", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650652911, "uuid": "fdbb55da-de64-4295-bb5c-9109d0ca8b51", "value": "T12E633B477549B86AE916CB3D4C974B99B613EC104B960B83BB09B3597FBA9B04E0310F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650652911, "uuid": "927e710c-9b1f-43f7-a93b-cc218de0049a", "value": "1536:tOKpb8rGYrMPe3q7Q0XV5xtezE8vG8UM+1YW/ESKQHS1yXJFa5etiv:AKpb8rGYrMPe3q7Q0XV5xtezE8vG8UMJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650652911, "uuid": "876a89ec-0078-43a1-a031-e6c8482ecbf0", "value": 71680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650652911, "uuid": "530f9e55-2f87-4dab-8152-2bf32e00be11", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650652911, "uuid": "d307aa94-81f2-4ad0-bc74-fdd426afd0e6", "value": "2022-04-22_1427-Statement.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26b14441-c1fd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1650605356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650605356, "uuid": "ceafd80b-36fc-40de-90a1-10074bc940e9", "comment": "Malware payload (Loki)", "value": "03d4e1aca25a73712a77951b25dc7e60", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650605356, "uuid": "740d2685-cf79-4b46-8aac-4d153ea9f8b3", "comment": "Malware payload (Loki)", "value": "7a69ccbb53eab4b289acab598cd8f4120d90fbcd45d74e4f0ae30de2b8d2de62", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650605356, "uuid": "251c1a39-52ac-42e1-9e55-52295a025186", "comment": "Malware payload (Loki)", "value": "40297d6680c1f6baba850705d970d6037b94fa2b", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650605356, "uuid": "079902d7-ef06-4646-bc25-0c230a810ca2", "comment": "Malware payload (Loki)", "value": "9298852da288487f61f8376f698c41afeea58a3e761745aec1fc332d8ca7b9e846a549fc81081f5141f2d15c5774aef1", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650605356, "uuid": "4e0dcc5b-88af-4fd6-b8f0-57d4cdfbe177", "value": "T10893F0FA77028417F2E0D7FA0E5F9734018A5CEB1886155894B273AC49FFAC3D2A6395", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650605356, "uuid": "7fabf0ad-2480-4cfe-b1da-db710c6ebd19", "value": "1536:/o+CHtp7OfcNMcHqcplMXv5ZNqeGbe/PrCrAlYVa6AESfyZyemu8pTk2L:/lCB2cHSPS6/PrZlZ6A8lh8pTkm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650605356, "uuid": "f8793636-30d9-4294-8a86-93fb56a78d35", "value": 95744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650605356, "uuid": "749ab407-40d6-495b-b28f-6b7989ef6d2b", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650605356, "uuid": "828acfd0-fdc9-4a77-8cd5-d8aa4436f6b1", "value": "79.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2882327-c225-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1650622743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650622743, "uuid": "08eeec8c-14db-4a0e-a3e0-6ea57ba7a2eb", "comment": "Malware payload (Loki)", "value": "c64f813073e0f774fd5765c25a3e0d3c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650622743, "uuid": "db9b4ca2-6438-4245-82e7-05757512e940", "comment": "Malware payload (Loki)", "value": "7b1da3704d0228cebf239b9c8935d500fef9b193c2ca2ba9e89cfd0724acd41c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650622743, "uuid": "2cc66891-9293-4782-9bd3-2d398985f9bc", "comment": "Malware payload (Loki)", "value": "e27a19d1cf59907ba20ef6b28d523d25ee11a11c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650622743, "uuid": "d2bd47e2-9328-4eff-bdbb-8a771e912f3e", "comment": "Malware payload (Loki)", "value": "408c5829494d844e0f808d1ddd01f85a5fa9bc0027cd346334c60e9b6b90fab4ffacacedb41e431996591c8966a284ef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650622743, "uuid": "abaa9011-d50e-4a91-9c05-3cf46c84a385", "value": "T1E7E301892390C177D8F34B321A7A66523FF9D81562B9430717101E9DBFB2282DB1FB5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650622743, "uuid": "3d2fe49f-e2ee-42ed-b8c7-b4f0219c1faf", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650622743, "uuid": "25e9c6ef-68ad-4b03-8c35-100e06fe0047", "value": "3072:l1NjcVVnLpPunbuLwGbCgeBcZ0KfX/np3xsXXv723bC6Rk2zre+mRqDY56W6E:HNeZmJ7o06xxsnv7l6qqe+mRyY56WZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650622743, "uuid": "c0217370-1670-4ad0-807c-37165977c771", "value": 153416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650622743, "uuid": "e2b7d666-ba6b-4d6b-a01f-b34660ed3372", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650622743, "uuid": "c614ce42-d40a-4ba8-98f4-89597b259a36", "value": "c64f813073e0f774fd5765c25a3e0d3c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4249cd90-c1fd-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1650605402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650605402, "uuid": "ffb963c0-c52c-49b4-b017-2620256812d6", "comment": "Malware payload (AgentTesla)", "value": "031079aac0fda7fff40b8c80a92c981c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650605402, "uuid": "d57488a2-e880-40b3-a074-afbe91972f76", "comment": "Malware payload (AgentTesla)", "value": "7c835a1ec99de45d4a35e6c82b4e3d619c924fa15090e7cdece0e1777473cf48", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650605402, "uuid": "ce02bbd8-7d6b-414a-9eae-fd61f7ffc0f1", "comment": "Malware payload (AgentTesla)", "value": "154f0b9e17ab469db6f2255dabbe34accf09b700", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650605402, "uuid": "f9a417a0-fe54-4e11-92d4-7dfc6dbc8082", "comment": "Malware payload (AgentTesla)", "value": "080c689df6000b9809934a4a149dd5c402ae5b362e304f1d61560384b6cea0cb579dd1f55fb117c574c4fbffe669c3bd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650605402, "uuid": "d092e867-f555-4766-8b1a-bf9bdaafc669", "value": "T1C9D4018756E4D963CFED49F6FCA2181981749F421406BFA4B9E7F36842F52882D093E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650605402, "uuid": "c60ddd06-25d6-48e9-932b-8073fd6da247", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650605402, "uuid": "deee099d-30ec-4eec-8e5c-3da973a4ebe2", "value": "12288:rhZd67Ysv+IJUl9/og/nVf8zimUJIZmV0mOFSDAYtv/hX:lls1Sl9QGVf8VUJIYxGSDBdhX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650605402, "uuid": "5b0532cf-2523-44fb-aaa7-63c3374f6a98", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650605402, "uuid": "9903ceaa-7898-4d35-b0ae-aeeecfaa4e33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650605402, "uuid": "065981c6-89e6-4341-aeb1-e3688964be88", "value": "SecuriteInfo.com.W32.AIDetectNet.01.28318.29714", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2078b48d-c1e3-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1650594178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650594178, "uuid": "78c9160f-2b5b-4de7-81d0-8e8aa7f76225", "comment": "Malware payload (AgentTesla)", "value": "37f63cd8cfcae006ac51fb25bb41cef2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650594178, "uuid": "eb4d41b5-bc4d-442d-b26b-8a29936c5456", "comment": "Malware payload (AgentTesla)", "value": "7cb0ddd90bd112042db6fe2dd4c007e1a055a1b0d6316458363a591e9bf711b2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650594178, "uuid": "b94bfd1a-6db5-4d3e-a0a8-1a9fde0e557c", "comment": "Malware payload (AgentTesla)", "value": "311e826373ace17ed7385b076eaea7b4bc8bcc27", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650594178, "uuid": "39cd7bc5-b8da-4afb-8155-1a064489329f", "comment": "Malware payload (AgentTesla)", "value": "60c09dc3ea7e00c2a27fce45b6570b617c58497df401bf04c838de814986b4f5bc13768e35c2c8c09eb2b10dc7c8d538", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650594178, "uuid": "e1d7f23f-be7c-4dfa-9b5d-02d50b6c7d67", "value": "T1A3C48E98795171CFC487C971C995ECB0BBA4B4BB470FF38BB0534AA86E8D496CE006B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650594178, "uuid": "e41242b7-5d79-4f7d-8c8d-1c053acedefe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650594178, "uuid": "d24f7c6c-e852-486a-bad4-debcc8f6ad01", "value": "12288:8UrrUs3PhOWb2XRVhtiHQqt5+g6iru75ilE0CXdypB47vo7Jrx:ncmPhOy2XRViQq76hs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650594178, "uuid": "8da8bb80-a804-4afd-982b-d8cf558a637e", "value": 544256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650594178, "uuid": "320f34bc-6533-41af-a3a2-e93e3d426dfc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650594178, "uuid": "bb330a2a-3cfd-4030-a2e1-60c7c6a615d5", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3620c09-c275-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650657104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650657104, "uuid": "5531f5bc-1b4a-422f-8ef3-1baad166ea98", "comment": "Malware payload", "value": "7b34f5ecb7c14244aaa6e330c620584a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HiddenTear", "colour": "#331792", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650657104, "uuid": "e9dc3044-79b5-49b5-b1fa-c920d0ffd93f", "comment": "Malware payload", "value": "7cdd7e30c7091fd2fa3e879dd70087517412a165bf14c4ea4fd354337f22c415", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HiddenTear", "colour": "#331792", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650657104, "uuid": "e8d34889-3b17-4d04-a540-d3dbdb63a01f", "comment": "Malware payload", "value": "6458f256381d5fb99e01abb0736c1ae4bb906ea1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HiddenTear", "colour": "#331792", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650657104, "uuid": "eda25665-c3c0-4bb4-ab80-443cf0fd8036", "comment": "Malware payload", "value": "bebadf8bf0025513663e486d223879be814f1deb697b5e39ff051f0c85329cdbe3e2765282952feadadea4dd82714558", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HiddenTear", "colour": "#331792", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650657104, "uuid": "2890c765-decc-4b7e-8c5c-6e67c309b6fd", "value": "T11D2435E1A740C465D8A796B9843BDAA7A433A24EDC6C490C3D92FF0B7D723474027D9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650657104, "uuid": "94ee81c3-ba21-4f50-ac9a-ec4d92276b25", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650657104, "uuid": "f746f0f2-3a8f-4f43-8e96-3b32688144ac", "value": "3072:nKxM+lmsolAIrRuw+mqv9j1MWLQ5MTmmsolNIrRuw+mqv9j1MWLQUod:nz+lDAAfTmDANy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650657104, "uuid": "23dbb132-862f-487a-bb6e-b4ec267eb551", "value": 220160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650657104, "uuid": "dccc2c23-aba9-43c0-bbe5-ff8872be5ec6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650657104, "uuid": "6d49339d-750f-4341-a0f6-2a84ff4d8a15", "value": "Marozka.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d99c29c-c221-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650620937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620937, "uuid": "3ba3c10c-178e-49cd-b343-b605d69f1370", "comment": "Malware payload", "value": "a62ad2ed0d68cf5424757edbb12529f9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620937, "uuid": "8c5dcdfa-1f75-4e9b-93ac-30dadbedb530", "comment": "Malware payload", "value": "7ddc71a84d02c35047853e73a120a4216e51debe73146d1f62a35bb05ac53dd8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620937, "uuid": "941148e1-1856-403c-b71e-e7f1209f33b8", "comment": "Malware payload", "value": "b55c778714dea238340f3d5e009a36655419097f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620937, "uuid": "dfefa9b7-c035-4866-ab1f-8ae1e0fe76d9", "comment": "Malware payload", "value": "9b12c31416d61ceb0db27c71511dfefb265e636c374384fbc9da01ae6c1f30ed065ca7f83ad22f2dbebae66b94b7dfc5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620937, "uuid": "fb1842bf-6719-45d4-b4d9-db8bb505a82f", "value": "T13AD55B23F244B63EC56F1A3A5537A2549D3FB76165229C5B1BF48C8C8F364812B3E60B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620937, "uuid": "3d672dd3-3423-4d9b-85e7-49b935f8e231", "value": "1da9c1d644e2b4c3e552350a191f516f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620937, "uuid": "9fcee563-6469-4cb5-9db7-3511b8327483", "value": "49152:P0u8EF2nTjpYSERv+YDH531s0OeG1HiTx9:MFn45qHe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650620937, "uuid": "2c473d19-2176-43e2-8ae1-c6704c1b1ee8", "value": 2962944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650620937, "uuid": "1d393913-c4c0-4dc1-a72a-9f01c46fa759", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620937, "uuid": "cbd8ffc4-b8e5-407f-b2aa-3c593699cedd", "value": "SecuriteInfo.com.Trojan.DownLoader44.45171.7235.10198", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56e3c26a-c20a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650611020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650611020, "uuid": "cb23865e-fea9-4a41-9942-904a1742959c", "comment": "Malware payload (Mirai)", "value": "d57986c127b16026034c8f7cdd556db1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650611020, "uuid": "39360545-ebfd-473d-846e-50038c4a9da4", "comment": "Malware payload (Mirai)", "value": "7e7aa3d39d0decf0a5d684a3a7b524167b77262470de9807d7d5269a96de8400", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650611020, "uuid": "d8bd27e2-a3fe-4435-8b87-606f5d90daf9", "comment": "Malware payload (Mirai)", "value": "c2f247b8c21ff7e6129a06004d2cfe2d0f428813", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650611020, "uuid": "3b305b6c-4383-4c1e-b34e-9e007ddd041d", "comment": "Malware payload (Mirai)", "value": "c41693758f56377c7d7bd38597d332b5e969cb9e755cd51d0a0a5c7952d2eb3670137b2ae4cbf27a1dacd426c6b9ac59", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650611020, "uuid": "ad6fc7c0-2fc0-4c3f-8cba-51cbd963e2c8", "value": "T104636DD5B4019E7EFC0BE37A40160B0DF52162645BA30F2BA69BFDA37C720996E17E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650611020, "uuid": "f33064c4-12a7-47a2-8e01-f68aecfab7b5", "value": "1536:HujJdF9PmbbWpNSnHCVtPsskfzvG3K8Jip:HA7PQbWpNSnHCXUzve2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650611020, "uuid": "c7577e9b-1d32-4c9b-8b3b-6377108a098d", "value": 71588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650611020, "uuid": "2deced57-a1d0-48db-aeaf-b2f73231b5b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650611020, "uuid": "9e2968b8-fba3-4a13-9f48-fac83a66baed", "value": "d57986c127b16026034c8f7cdd556db1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d90eb6f-c24d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650639673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650639673, "uuid": "b2edf1d2-9a92-4860-8807-c6026414fa0d", "comment": "Malware payload (Mirai)", "value": "226cc224e6aab407bb10df01ea2086e5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650639673, "uuid": "84ddc6c0-50bf-4957-ab94-434322f514a4", "comment": "Malware payload (Mirai)", "value": "7f4d2e47451ef499483db859a21f8c1a5a09ad712be30d75acddfce7841beaf1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650639673, "uuid": "3bd1c7cb-81ac-4019-9e11-bad75807a70e", "comment": "Malware payload (Mirai)", "value": "9cf6b31219207f909bf7a4d819d0761b155fd318", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650639673, "uuid": "fea9aba3-447d-4647-a1f7-9e5ff9d457cd", "comment": "Malware payload (Mirai)", "value": "5ed2e6e971ef3d3407f3092d525e2113686f5aaf5546e6baf1260f01cc110b79bb98c593f42583951db6ace3348205a5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650639673, "uuid": "4925d284-548e-4736-920c-c382689a9c18", "value": "T14503F251F101B310FD764E76E7AC421E238F9E3660963113666B9E448AF128DC7BEE93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650639673, "uuid": "4d5e9362-2e81-4287-bbd0-cecbb1631cb8", "value": "768:UT4xdC2QZhJgd5gtA2jzVJdvlOvOFUAVBIWOcevvhx1o0DWHXM9fojq3UIGv:U4U2QLvtDjpvlOm5VWcovzWHgj+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650639673, "uuid": "c7c29a98-dde3-44ab-9a45-166bc56e0a0c", "value": 41048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650639673, "uuid": "40e858ab-fa56-4a2c-9995-aefa888af627", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650639673, "uuid": "bf2fd55e-fa96-4e6e-adf1-12c13aad4bb8", "value": "arm6-20220422-1501", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1af5364c-c242-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650634971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650634971, "uuid": "69cc9d7f-513a-4474-b32a-db5ea5de621d", "comment": "Malware payload", "value": "704e754d219a2f7953c8b41b4f932028", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650634971, "uuid": "1896780f-133e-4232-b697-241538fe27e6", "comment": "Malware payload", "value": "7f681bfcd494f81cd045221de260a7218c1e27b40f5e25cc728ee0bde0e6f2cb", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650634971, "uuid": "82cb152c-aeb1-4a9d-a05d-2ea43268f4bf", "comment": "Malware payload", "value": "8e957d5b1c16c3119a9391824d9f9327a528bcfb", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650634971, "uuid": "06723b67-eb35-4481-b613-13ffd5cae16d", "comment": "Malware payload", "value": "5e4094c51a0587c6baeb81a5d446ff798234798fa69ee002311fecccfa2c096edd0dbd8567f350f942b85c36e3148876", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650634971, "uuid": "dc03cb4c-b2f1-43eb-84c5-dd2feae258ee", "value": "T1FBD49D11F6AC80B5E07BD13DC9A3875AE6713C9847B943C79255EB2A2E736E05D3E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650634971, "uuid": "47f81a24-e7ea-4c88-92b5-ba39b3b28cc1", "value": "6ba79cbed2acbe9b8ecc8e14a572f100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650634971, "uuid": "8163aed2-fda6-405e-8c9e-1dbd095e8f52", "value": "12288:C1FIcocJwMTHzXO7N2EBHiyzskF1CubVnmn:tco9MTHzXO7Nd/115mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650634971, "uuid": "ca8d9d8e-b929-4eed-86d4-1ce5dbf54739", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650634971, "uuid": "161a0e9c-d320-4490-ac46-ff7edfc22d19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650634971, "uuid": "38d10b8e-74a9-489f-8fdb-05fe63c78327", "value": "TXk8xrPeq.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "981bea18-c26a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Chaos)", "timestamp": 1650652361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650652361, "uuid": "0c94f18e-c1cf-4359-aac4-df6db9465210", "comment": "Malware payload (Chaos)", "value": "d619445e564a6e64fb88101a35675ef5", "object_relation": "md5", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Yashma", "colour": "#EFD02D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650652361, "uuid": "639cf7bb-3e31-45b7-8243-cd2f8d192729", "comment": "Malware payload (Chaos)", "value": "7ff02d597c1d6d81252edc66749f979c3f61b5e2ebd76ecbbec75859c21baf83", "object_relation": "sha256", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Yashma", "colour": "#EFD02D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650652361, "uuid": "38a75af7-7c19-456d-907b-5585ba522d16", "comment": "Malware payload (Chaos)", "value": "fb813e713df734f368163214506a52dbc364c954", "object_relation": "sha1", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Yashma", "colour": "#EFD02D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650652361, "uuid": "2f890783-2d8b-4b64-b65c-093a4a153bf6", "comment": "Malware payload (Chaos)", "value": "8895575707a8cb73955360e4ff7413cb359f6593490232a70a48c79d64875053b25a46f81c7a4e5363860104914f5862", "object_relation": "sha3-384", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Yashma", "colour": "#EFD02D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650652361, "uuid": "821f2cc4-ef55-4c6d-94cb-7e33494e501e", "value": "T1D3145B243EEB5019F3B3AF794BE4B5AECA6FB6733B06945D109103460623E41DD91B3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650652361, "uuid": "7eb9a19c-e5a6-448e-b02f-679e228d6ccd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650652361, "uuid": "5b8366d4-b165-4341-9a12-a8b67a9344e1", "value": "3072:BPyiYB9qPDKsxGDVdBz9rfZ6zUhEeoDjMtVGZFhFdyjU7C8qWEcMK:YlB948Dv1pZ68EeoDjmG7xyEFM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650652361, "uuid": "de785b9a-17ab-4065-ad0d-20c4d56faadb", "value": 192000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650652361, "uuid": "5d960ae0-f894-47a2-b35d-33253f8a9043", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650652361, "uuid": "c1ff5afa-fab6-4de2-a537-43935d5c20c2", "value": "yashma-encrypt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cfa7060-c221-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650620962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620962, "uuid": "f326d5ab-d284-4597-9c1e-d3df73c4c263", "comment": "Malware payload", "value": "09ce20248b25ba264fd583d86547b635", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620962, "uuid": "357ea3a4-6a55-4417-9115-5a303f1eca9d", "comment": "Malware payload", "value": "8002ceba7b939d6f22fb0e1051c789fbc98a3ecdd166247122aff9791a6a1f25", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620962, "uuid": "eff4a111-72ea-4cd4-9044-d9d9772898b4", "comment": "Malware payload", "value": "6a9b91201144f3996f32059fc4f9487c9705dc5d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620962, "uuid": "47e77aa9-20ec-4eb6-b6ab-df146a025a2b", "comment": "Malware payload", "value": "2c34e9444c1faf157d84b79803dbb1914da7a9c0fae6672d936ca0825949615da31a07a97f1ed0f980c1eb9df1ad588f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620962, "uuid": "c82d6866-5187-4cc0-88cd-f4101dc29e43", "value": "T147E55B27B245653BC06B0A3A9937E63C993B7A7E25168C5B5FF0488C8F359413B3E607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620962, "uuid": "ecb31083-7cad-4c75-8fd6-f4fe137eb93d", "value": "2a97021eabc6fcdb9ad8a5df08c6771d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620962, "uuid": "cc5def2b-b4c3-43c6-a6ce-6724dfa1dcd0", "value": "24576:0k4Hue5RlXVZwPjn6PnxKwnBGNIjgcyDkpBKStTPUKA5X/UADuu6vssCNHFMrQs0:ze4yvjikpoSFUKObDuubzNmxKTt5r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650620962, "uuid": "f05b3ea5-cc7f-4560-9136-ff2180539ebc", "value": 3138560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650620962, "uuid": "1b57086a-6d65-4a63-894f-1d8af25b35bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620962, "uuid": "ddc4868e-31fe-4d16-bbae-173036fbb7af", "value": "SecuriteInfo.com.Trojan.DownLoader44.44921.913.24240", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efebb04b-c26b-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650652938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650652938, "uuid": "6b30d9fb-a888-4d16-8bc8-c2f0c9224f42", "comment": "Malware payload", "value": "bb95c004b44db0912525e082550550e2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650652938, "uuid": "484938d4-a3f7-4b24-81cb-e54503d62a91", "comment": "Malware payload", "value": "817725e0ecec527183120ce6b7d748c2bb86d9f9ca5cc4e271252438dbe0f5cf", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650652938, "uuid": "0e7ff614-4247-4226-8490-bf6e97d917f1", "comment": "Malware payload", "value": "32f51fd105a0b7a2ad3c7d2243772b9cafea503f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650652938, "uuid": "34f2ff8c-9e8c-4345-b20b-3068be4eb903", "comment": "Malware payload", "value": "88826f54c3187ecd35f027ba8c9586c6db7a61c442ef3d965c6bb99eace9466d9b0b84f2956723fc68d807ffb02a76c8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650652938, "uuid": "60488fe1-8f4b-41bd-9d36-0081444b5798", "value": "T15BD49D11F6AC80B5E07BD13DC9A3875AE6713C9847B943C79255EB2A2E736E05D3E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650652938, "uuid": "b2a576d4-2cad-4e20-b17f-b8295a673641", "value": "6ba79cbed2acbe9b8ecc8e14a572f100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650652938, "uuid": "6ea01b59-df1e-4921-8a1b-6e68b55ce5a5", "value": "12288:C1FIcocJwMTHzXO7N2DBHiyzskF1CubVnmn:tco9MTHzXO7Nq/115mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650652938, "uuid": "fd1b38d5-3991-4f31-afb8-6e850feed5a3", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650652938, "uuid": "0049400a-0d21-430b-b519-a7e2d8349025", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650652938, "uuid": "0e77b315-9fb6-4022-944a-6b268db254e3", "value": "o8RSr0SvX7m4UxPsZOct9RZv.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a23530e4-c290-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650668699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650668699, "uuid": "ff7186a1-bd85-47f0-9023-9fdc3e40d0bd", "comment": "Malware payload", "value": "27ecb12cdbbd1348b38195e2444e7d6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650668699, "uuid": "5b11f3f5-a3b8-48c9-af6f-bd8015bdafbc", "comment": "Malware payload", "value": "8225891e8597eba3ada37f4698cd23f6b76e5ebc7d6eaa67397274d3c0a7f7c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650668699, "uuid": "d3c85869-feea-49df-ac73-5d5192e7fe94", "comment": "Malware payload", "value": "341be8c51e749e2ae830a631b7a2d2936037c134", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650668699, "uuid": "3fcdfbc7-3114-4103-b13c-253c7aa407aa", "comment": "Malware payload", "value": "c88849ad12546e35e6a657dc345598ec441199958922c400f91e57daebe64bc78ebd9afabb96be61bbd3cdce8ccb7fc8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650668699, "uuid": "0dc10eba-90ce-4983-8aec-22fa2fb5924e", "value": "T17CD49D11F6AC80B5E07BD13DC9A3875AE6713C9847B943C79255EB2A2E736E05D3E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650668699, "uuid": "a5e3ee5a-6e1b-4606-944d-f71cb5548a37", "value": "6ba79cbed2acbe9b8ecc8e14a572f100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650668699, "uuid": "9964ac22-de87-4936-b3d2-5474f4dc3f8f", "value": "12288:C1FIcocJwMTHzXO7N2YBHiyzskF1CubVnmn:tco9MTHzXO7N1/115mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650668699, "uuid": "9f0fcc20-9e55-4a38-950b-51ceabe78096", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650668699, "uuid": "76e1e1c3-1b9a-4176-8601-d0ae1cb5c959", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650668699, "uuid": "35a97801-72e3-4392-ada2-9e581533c415", "value": "27ecb12cdbbd1348b38195e2444e7d6d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de77e85d-c23a-11ec-8e58-42010a9c0032", "comment": "Malware payload (GuLoader)", "timestamp": 1650631863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631863, "uuid": "b9e8ebf8-b614-4c3f-8506-0b8de640d71b", "comment": "Malware payload (GuLoader)", "value": "7bbae22fc45e185a09d2a03ff4370246", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631863, "uuid": "f99f7340-1b5d-41d5-88c2-fdfb359bc366", "comment": "Malware payload (GuLoader)", "value": "8264960c598c7f785cbfbf4c91aec0e6242b4ea59b28db03c768f47a769c7743", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631863, "uuid": "2918cd5a-7e74-481a-8bbe-d2c78265aeed", "comment": "Malware payload (GuLoader)", "value": "2d91259ec6421f4c3f08afa5e1ee73474ffd24b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631863, "uuid": "e216eeb3-f776-44f8-9558-19138025c96f", "comment": "Malware payload (GuLoader)", "value": "07f0dfb64f192f3cbff302dff1cc05320ecddcfc4497962dbef22bf043598b884f50d87a5e5b5156d09e41c5dd2f41aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650631863, "uuid": "1f368bf0-0915-4475-9804-4586dcc6c38c", "value": "T19AB4C46E736196B8F45889B44933CC604A676C484B95C7DBB39CF32F147B9C9C20E8E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650631863, "uuid": "4d44140f-0eee-4735-8497-33c54a23492f", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650631863, "uuid": "05fff281-8e92-43ea-aef2-07ab568826e1", "value": "6144:aYa6OpR9xyBMc+6/FSU78YxjrH8BwPnfUg9Uh:aYk/9xyBMX6/FSU78Yxjrc4fxUh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650631863, "uuid": "a8a89971-722c-44a4-a9c3-2df8ef98fbfb", "value": 536424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650631863, "uuid": "5a1ce02f-09a4-4768-995a-9d7efe56ac89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650631863, "uuid": "471fb0c8-4c90-4c04-bb21-74f56302f404", "value": "FRACCIONAMIENTO 1722403906461L.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26a90d36-c24f-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1650640574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640574, "uuid": "e6e776ac-6a75-489b-8838-f352d7dc6d7e", "comment": "Malware payload (RedLineStealer)", "value": "33f05baa377b7a1051add3f54d5a7fc3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640574, "uuid": "9dba0ebb-fcab-43d4-b6be-8caec47258c9", "comment": "Malware payload (RedLineStealer)", "value": "834e50de368ff0ffa989df6be94fcbadb448c5d6e5239971aa7028ad0c1daf1c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640574, "uuid": "68886367-e2da-4f38-bb73-fce28cb325d0", "comment": "Malware payload (RedLineStealer)", "value": "90c5ae0d57331d699a3a44bd6e3efed21d65c12d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640574, "uuid": "1f227079-14b8-4297-b09d-1ae04015887f", "comment": "Malware payload (RedLineStealer)", "value": "9ef4068c751d1e0ddf910b8266bcf793a246303278044477686c76e260b69d8ddeb64971295aa3c7c566ba5e2fe7f8b8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650640574, "uuid": "2679e035-5623-4b78-ab47-91715f3a1f7d", "value": "T152B33BA873DC4A14E5FF8E7478B111D546F0F1937C02E79F4EC5A0DA0E26B90EA52AB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650640574, "uuid": "cc7b7284-557b-4ab3-adb8-4750de8aa742", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650640574, "uuid": "ad09215a-1c6a-489b-8d88-b3b70ab65982", "value": "1536:URxqkCrHQ2IxAvcGFZySXt18x0artfAH03puXbuZgrf7By0wuei68Lr:sCrHQIpjNartfAH6QfzByhu/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650640574, "uuid": "43c466b8-d584-4b80-b066-4430458379ad", "value": 108544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650640574, "uuid": "8c3b0567-9ede-45cb-bd74-b5a30367a27b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650640574, "uuid": "06400ae2-593d-413f-b920-377561def68a", "value": "33f05baa377b7a1051add3f54d5a7fc3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2771ac46-c205-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650608793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650608793, "uuid": "22ae18c6-1c3c-4098-a1de-70d57887eba6", "comment": "Malware payload", "value": "db18e71e0d42818980c961c0b0c4b063", "object_relation": "md5", "Tag": [ { "name": "136-144-41-237", "colour": "#FAB5CC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650608793, "uuid": "33dbb1c8-a277-42d1-83b1-25bd982f5119", "comment": "Malware payload", "value": "8367e3017dfa63773c2d1aa96ff6aa416b8c875058471fec9c555e98c4da8185", "object_relation": "sha256", "Tag": [ { "name": "136-144-41-237", "colour": "#FAB5CC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650608793, "uuid": "ea38b247-e9f5-4533-a63d-a7f18d18d5a4", "comment": "Malware payload", "value": "8cfb68d7396bc23c53164c44f8df8791637777ef", "object_relation": "sha1", "Tag": [ { "name": "136-144-41-237", "colour": "#FAB5CC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650608793, "uuid": "5bb0ca0d-b29a-49e8-ba4f-b5d750ff3156", "comment": "Malware payload", "value": "f77ebda182fc2bf932bafc97c9f3299ea94c1f37d43c13187370ff0bb0da4314aac6b8e7cd79da23ca64e92c9524f44e", "object_relation": "sha3-384", "Tag": [ { "name": "136-144-41-237", "colour": "#FAB5CC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650608793, "uuid": "ff18a277-e3b2-41ee-a624-c4d69ff313ad", "value": "T10521D78E510A2C3BE3C182FCC10BCBD4C3B8A756922609CD53739398E44AD85ACF95D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650608793, "uuid": "c7645f8f-eeea-4cfb-8aa6-d0e33d72520e", "value": "24:9oeqKuExQgh6fsOhEX9KV2HYjZJarOnYsFeWeRi+RDbqU0wKE/CB:9oe1xQiqAI2HuaGtg40L/E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650608793, "uuid": "3d78cac2-3dd2-469c-8ac7-9c434e6a69a5", "value": 1193, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650608793, "uuid": "0d2b9562-ad06-4991-b8a0-8a1541b9a9f1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650608793, "uuid": "f822b845-f42c-46e7-aea8-d75242d5b5c5", "value": "2022-04-15.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08c0ef34-c262-11ec-8e58-42010a9c0032", "comment": "Malware payload (njrat)", "timestamp": 1650648685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650648685, "uuid": "9f1aa593-f9af-41bf-b018-8de60fc1980e", "comment": "Malware payload (njrat)", "value": "a40a85db39f75ffcbc1b6124e53e0f16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650648685, "uuid": "33482077-75ad-437a-8233-d99245dac398", "comment": "Malware payload (njrat)", "value": "840afb2a98a6834f74b52cb6558dc63c68059c68ee34ea23d653c2d2c4a85a14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650648685, "uuid": "a67026c3-00e6-4174-a24f-3203c6bf3456", "comment": "Malware payload (njrat)", "value": "7502e1649b50076d83bbd2c3b0ad76080ef41b3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650648685, "uuid": "2c183275-d671-4de5-9a87-991125ac4014", "comment": "Malware payload (njrat)", "value": "7666a36d36cf6175f390c17ce9d88f85d2590a6205df718d6c85e81b9267414f497a1ca137434637cdd218592a61592c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650648685, "uuid": "8c55b15e-c01a-4393-bc8a-95c8034809a5", "value": "T1F0032A4D7FE18168C5FD0A7B05B2D412077AE04B6E23D90E8EF564EA37636C18B50AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650648685, "uuid": "f948db30-ce42-43f7-8edf-862c78754f50", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650648685, "uuid": "e3c164e8-8c98-4f6f-bf31-955a24332201", "value": "384:fgevEiTb1vpWNcZ0y8f5C9THl2Lkiuxu0rAF+rMRTyN/0L+EcoinblneHQM3epzn:4eRTZ38f5C9T09uPrM+rMRa8NuNRt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650648685, "uuid": "0ab1584b-7da0-4e26-99d8-5e481ad867ad", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650648685, "uuid": "5f0716f5-3af1-48ea-ad39-66469f67bf48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650648685, "uuid": "1a35ce72-138c-4a67-b666-ab93080f6fb2", "value": "a40a85db39f75ffcbc1b6124e53e0f16.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95ed8838-c242-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650635178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650635178, "uuid": "2182cd15-c547-4d42-89af-11183a885d6e", "comment": "Malware payload", "value": "e157623a78c45641e110221172f52a21", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650635178, "uuid": "f48ee76d-67ea-41ad-a61c-c38a1fb07839", "comment": "Malware payload", "value": "842c480a469c010ed318bc3ffb75c2b012ccb5edcaac3e9e2151168df26fd052", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650635178, "uuid": "af7d18f7-7690-4fa0-b380-953d8c642c17", "comment": "Malware payload", "value": "831d89fc656bc041d994e0df97f2bce6f16e6787", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650635178, "uuid": "c8550939-51fc-4913-b90d-824d094b5c8c", "comment": "Malware payload", "value": "a61f58a2ea866535b68057d9507cede479b1b7df5a997319e3d7ea82a079feb0e8e48fd61ac90e67e155792eb02a244d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650635178, "uuid": "b4d6e935-88a5-4166-9571-65a9324d5dee", "value": "T153D49D11F6AC80B5E07BD13DC9A3875AE6713C9847B943C79255EB2A2E736E05D3E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650635178, "uuid": "7093da90-9d7b-43d4-adda-e1cd89bf3b19", "value": "6ba79cbed2acbe9b8ecc8e14a572f100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650635178, "uuid": "1ee7b99e-2915-43be-984a-5ce1859bc834", "value": "12288:C1FIcocJwMTHzXO7N2LBHiyzskF1CubVnmn:tco9MTHzXO7Nu/115mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650635178, "uuid": "fe8330a8-4a33-46d4-af6f-7bdf42c7d43f", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650635178, "uuid": "b8d7204f-a4b4-4a94-a8ff-acbf476b613f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650635178, "uuid": "2c016e84-ac54-43b0-87aa-2bc807d8f2d8", "value": "kjaEDtvknPVw8gt2k4ALc5sW2c.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64d6f0d9-c213-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650614909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650614909, "uuid": "e803f6ec-7ed4-4807-b173-581c4f8d6fcb", "comment": "Malware payload (Mirai)", "value": "34f293e99c2dbf11a64783c2c0eb9467", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650614909, "uuid": "39632c10-6fa6-45ae-afc0-26e2acd68a8a", "comment": "Malware payload (Mirai)", "value": "843ef6ac643082ada3f17565dc133cb6a303f99f10ba5c30630a032320daaf05", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650614909, "uuid": "4afc9c1e-588c-4542-af18-393b2c328e16", "comment": "Malware payload (Mirai)", "value": "e9a87da73a380ea4c98dfae73a4f1db668573e14", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650614909, "uuid": "aef4a060-f4b5-436f-af98-fd2e73a76078", "comment": "Malware payload (Mirai)", "value": "3005b8983472ff20ba24f0572f511ac615f969c06d9419fe005d1924d6efbb6651bd44025b6cfcdf2bf722ba4f421aea", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650614909, "uuid": "55a82001-73f7-43b6-91d4-a3c167502dee", "value": "T198234B21793A2E17C4D0A87A62F74758B2F5565E2AE8CB5E3C730E4FFF10A40A5076B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650614909, "uuid": "b98cb52e-708e-4546-a104-acb435a4fd3e", "value": "768:DuojcB+7q9Y1tPu4hpvv2UBz+IxwnFrVO+iVgj:DuYcB+7SY1tPu4hpvvZz+fr17", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650614909, "uuid": "29e8f6fc-48cd-4962-8854-91b20a910fd5", "value": 49004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650614909, "uuid": "4031a76f-4da4-4782-8ebf-5a0004727c61", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650614909, "uuid": "c89071f4-1014-4b46-b208-912f17b67a8d", "value": "34f293e99c2dbf11a64783c2c0eb9467", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59b1331a-c22e-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1650626487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650626487, "uuid": "8b095998-46c9-4c6d-8fc4-b4aebd820a2c", "comment": "Malware payload (AveMariaRAT)", "value": "699b0b56aacc0f57406f67b929f3dd48", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650626487, "uuid": "84e78dd9-d242-45a1-a9d6-8a6cb9a569c2", "comment": "Malware payload (AveMariaRAT)", "value": "84d5ccba988508bb603f776e189e83bc500a7e96ff59fafe824a8418526b4cfc", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650626487, "uuid": "2979d4c8-020f-452a-b4c9-28257aef93d6", "comment": "Malware payload (AveMariaRAT)", "value": "9ef0cb537a0eed43482e104242376416d0db9a8d", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650626487, "uuid": "a717b81e-6652-4161-bc6a-7c78b91111fa", "comment": "Malware payload (AveMariaRAT)", "value": "4ab20a67987c1b6decac7dff5a7f7d9f431b99ced15823bcf07dfb47ec946923f860b3faa2c6b079e3d3381dd5acd716", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650626487, "uuid": "b6f6bf4d-8da0-4e97-8e07-36b33f8cf464", "value": "T1E11432D02B5ADCBBFB88B574660199B13E8EBAE3F5D641DE30DD624E1A235B144F0C18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650626487, "uuid": "eba8132b-1f75-45d4-960d-ecd84a8f16e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650626487, "uuid": "28354aca-c1b6-4e08-a285-91288186ff5f", "value": "384:psuFY6RW5/a5VrQAR4LfffffmAa8IllBSIMgp3eRWdL4WnptYcFmVc03K:JYJfug2NSIMgRbtYcFmVc6K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650626487, "uuid": "6687cb33-b64d-4359-8440-1667ffdbd542", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650626487, "uuid": "a0107f3d-9bb7-46e7-a53f-4adcf2f4a92e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650626487, "uuid": "f6acc8a7-1d68-4c1f-8a57-b18b83121423", "value": "ordine_STAR_PROGETTI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d01ca6b6-c242-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650635275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650635275, "uuid": "6bbccdaf-3234-4d6a-a5df-f9e123f86074", "comment": "Malware payload", "value": "7d33bfc7ba3913e1b645a0231161cdfb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650635275, "uuid": "73ddf01e-837b-4736-bbc6-e468b22c0d46", "comment": "Malware payload", "value": "86e74d3b9468e40306575865c541707fb669f832f1c2a1535dcda04976d78f28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650635275, "uuid": "8d3d849e-1c89-476b-9ff6-28dc50e4e944", "comment": "Malware payload", "value": "8ced57728df1c78fd8c18eb7f6b9f58cd1bed7c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650635275, "uuid": "5c7651ce-71bc-4be5-bd08-937d5d9f58da", "comment": "Malware payload", "value": "5d36c93cb989e4ef11ca89b17061069c9b88e6c7afc8e98939f41a053165491a0cbdbe2923eea2a3a9bba8f7b90ce134", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650635275, "uuid": "4af1cdc1-0708-4471-a37a-7921c52e1d0c", "value": "T12DB44B2C3B4D5A72FDDED93189062A18BB660F1323E0A9D257DB15CB8B4F1F52D05E88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650635275, "uuid": "aac7f2af-fc29-4516-a064-f71ea40b1b8c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650635275, "uuid": "94176a18-b8be-4a5d-8abf-1fddd8638db9", "value": "12288:K7ueJ4R0Vh0XHreuypWuzXkfbfK+HKVqPf:oZ7jrk9KkPf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650635275, "uuid": "6329007b-be8b-4892-a35f-b0ec25157dc2", "value": 515072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650635275, "uuid": "0b960a49-0e08-4cf7-b5e4-8a6e347e30ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650635275, "uuid": "814360b3-06a4-4eed-904d-10d7f640e96a", "value": "MV GIORGIS - VESSEL PARTICULARS.xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88d59f4f-c23e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gozi)", "timestamp": 1650633438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650633438, "uuid": "f6d7b91b-8832-4eec-95f5-b97f45d8a678", "comment": "Malware payload (Gozi)", "value": "b8eea1c2963c2f26ff4ffe8de869c3cc", "object_relation": "md5", "Tag": [ { "name": "999", "colour": "#62BA7B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650633438, "uuid": "eaaac1a3-82e8-4e61-b98a-4447c1052202", "comment": "Malware payload (Gozi)", "value": "86ef41e44779b109e70b7d34c011b341c2d90654b149a718a380205287256bef", "object_relation": "sha256", "Tag": [ { "name": "999", "colour": "#62BA7B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650633438, "uuid": "a89780da-7a2e-405b-91df-84ee27bd91ae", "comment": "Malware payload (Gozi)", "value": "2a8a13db7afd001f093a2c6f82bc6ed93b1884c5", "object_relation": "sha1", "Tag": [ { "name": "999", "colour": "#62BA7B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650633438, "uuid": "ee6b0498-58ed-49a4-b9af-ef47b8d5d669", "comment": "Malware payload (Gozi)", "value": "76ec8c7020334d496a53691c6dec1bbf73dcc6e4a89b7adc123d462c13ce93a309db37b9431193bf041b0b5db8e6ab1d", "object_relation": "sha3-384", "Tag": [ { "name": "999", "colour": "#62BA7B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650633438, "uuid": "423d2f02-a5ed-4a56-a7d6-897bd682fdac", "value": "T165D4BD1A029B2102EBB6CE78A751636C55174CE09B01E2CFC9190DA395E34FBF4FA5ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650633438, "uuid": "24234d74-6ff4-42c5-87c2-f14bb2a9655c", "value": "fd1c62e6f93e304a27347077f6d2b44c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650633438, "uuid": "5f218cab-69dc-4911-997b-e860e41b9519", "value": "12288:+w1lEKREbddtOYRbHzcPwka1dCjc3N8ZFB:+w1lEKOpuYxiwkkgjAN8ZFB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650633438, "uuid": "950a9ba3-d915-4516-b715-7b0e12127ed1", "value": 641885, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650633438, "uuid": "0e98b76a-80b5-4aa3-90be-3823207dda48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650633438, "uuid": "e9939099-5954-437e-b8fe-887387fb4699", "value": "pDut.azdgC", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be0630bd-c236-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1650630091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630091, "uuid": "09190822-eb35-4373-bff2-22f045921e22", "comment": "Malware payload (SilentBuilder)", "value": "30e5a3c541817bd7e5638204312d3329", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630091, "uuid": "f8397005-f6ba-400f-aa25-d3bb10d3a88b", "comment": "Malware payload (SilentBuilder)", "value": "872a2223d1b6f87468d3709141f2e514df568aad119629bb1143981719177ad6", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630091, "uuid": "6352e037-4c0d-49e8-92ba-3ab55b55edde", "comment": "Malware payload (SilentBuilder)", "value": "9cc4b0f4117366ba84fd38311e14feeb583a1fd9", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630091, "uuid": "a52edd72-03bc-476c-aa3e-7cd7b0a1845b", "comment": "Malware payload (SilentBuilder)", "value": "fdb99445adb50413d24dfd0fddbc7705df62e8bbe0b421a1e5aabbafc430ba35b32443531c4fa4c6bc22b867a4b36d8a", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630091, "uuid": "e41d8c94-2353-45d6-97cc-6b876bd3822b", "value": "T15023B646BA5D9859E9258B7548E743E9B333FC201F6B0B833616B3257FF49E05A03207", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630091, "uuid": "7a2911cb-07e0-4486-a8aa-e616811c1083", "value": "768:4DM52tfQXi8vgLZkTOHkQT51Vp6AwPdM8gQ6JT5X6DGwUdh+pqjeSLjcvLtzrxFm:462tfQXi8vgLZkTOHkQT51Vp6AwPe8gz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650630091, "uuid": "1a2251fe-75fe-40f4-8371-b7e0598e4b9b", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650630091, "uuid": "2da7daf0-aae1-42e2-b64d-9ae9f22083db", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630091, "uuid": "34fe75d3-fa87-4ab4-ac73-34ba88ad6a60", "value": "Recent money transfer details.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9d2385d-c236-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1650630084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630084, "uuid": "cab3f4a7-1990-4bd5-9ff8-f65add1b5c78", "comment": "Malware payload (AveMariaRAT)", "value": "027eb87a272d99c3cb67e529bf29cdb0", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630084, "uuid": "917426df-7570-478d-961a-0e34a69f9ea6", "comment": "Malware payload (AveMariaRAT)", "value": "87b49f5381e9870bfda19fe73f05fbead0fa012553ed7a4ca03e69228bd0618c", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630084, "uuid": "bc7e671b-08bf-4ca1-ad00-fc66f66806d3", "comment": "Malware payload (AveMariaRAT)", "value": "4d3b045c6fb5b27be85c2a026ef02d7082a79ae0", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630084, "uuid": "679718d7-a6ef-4b54-88ce-a548f9136831", "comment": "Malware payload (AveMariaRAT)", "value": "3d63c93da1388e684497d454ea985c28d909da37bb738b8a502be6fc2091bfe89406dc32d82c5b13fbed7e9288b95af8", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630084, "uuid": "d10bcc84-5170-4c5a-8dbb-c0a121da2ecb", "value": "T1E315E002EBB1DEB1C671093B56197665AF3D6C200B30BA8F7388B16C6FB1890D635797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630084, "uuid": "35783f77-4daf-41b8-9664-ec8a91fc4ff0", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630084, "uuid": "c7fadf6d-2cf8-4538-bbfe-e62ad222a94d", "value": "24576:khvJVJdM0AnVvFa0/G7I2l7CAfvvxFCpaaJ:k3dueS2wAf6pB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650630084, "uuid": "39e94464-5158-4647-8f7f-caaafe0b7f87", "value": 958569, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650630084, "uuid": "ffd28ff9-e080-42ff-b169-c7eb4358ccfc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630084, "uuid": "9f4e35e2-63f0-4fb5-bd81-6804021f2a51", "value": "Odeme_Fatura.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef560068-c230-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1650627597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650627597, "uuid": "e1ef83f3-7e79-4e17-a6f1-a5798e0e3e44", "comment": "Malware payload (RemcosRAT)", "value": "4cd7b07df5a12d44907c067b66724133", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650627597, "uuid": "c4dce0c8-c538-4cc3-bf7a-e2cfec5f5b37", "comment": "Malware payload (RemcosRAT)", "value": "87ffd4cb4adf6c300a521038f7309d0ed3194fa8da73da8237c7c500013ef0b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650627597, "uuid": "d3ef83a7-6729-43ae-812a-dec35e507e4d", "comment": "Malware payload (RemcosRAT)", "value": "8d4f5dce0273a915e7f8576cd438d844db223d4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650627597, "uuid": "bfa3c6f1-bd17-4aab-9a2d-3a92dcc63bfe", "comment": "Malware payload (RemcosRAT)", "value": "14470332dc69f1b68388c60d7eddd75338fc2490a5299170c3e79c6d730767b21bfff2270eea1df057957a80241b9775", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650627597, "uuid": "0eeeb22a-a51e-4042-b7a4-9692def25ce2", "value": "T12E255B31A1A105F2E0624E718E1E9275BFA6BE00DA20954ED6F4FDD83A377C1E1152FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650627597, "uuid": "ea4d8521-b66a-4238-9fd5-ec7c858c463a", "value": "9ce2f30aeb19f24c41844bd28f56defc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650627597, "uuid": "0b62fd63-3228-4973-86b0-76312714a096", "value": "12288:ueiJMC6q9g89SmxrmogsE43GWpy8YlEvGjBjufY8afqUKzaRHr:tiuCq89SmxysECLtY2vCqaynz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650627597, "uuid": "7e331125-df80-4748-9e8a-faff9a489532", "value": 966656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650627597, "uuid": "637f4043-f3f8-4980-ab84-d02bf39619ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650627597, "uuid": "e24b4272-5484-4ee9-9712-c565d8c4b958", "value": "SecuriteInfo.com.Variant.Jaik.66705.15103.21360", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b4d1612-c248-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650637737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650637737, "uuid": "7015a002-c4b0-4a57-908e-81ca57c19206", "comment": "Malware payload (Mirai)", "value": "b050b31ad9dac4f294274e79fb33ba13", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650637737, "uuid": "6f0a68af-eadd-4c91-8b1e-f42f3e346f1a", "comment": "Malware payload (Mirai)", "value": "886d27e677a1f11c0f03f954ac02d52e09d79ba25798ee8d2efca505f7545d8f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650637737, "uuid": "18fe649d-d341-459a-b205-18621135ef3a", "comment": "Malware payload (Mirai)", "value": "61791de68039935b6b2fb71236c6b1b2a283a00f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650637737, "uuid": "f9982b37-2fef-4c37-bed9-cfbeaa03c73f", "comment": "Malware payload (Mirai)", "value": "6490e92b528e6812de183c579522577b84d3fca06c5990cbb00a1d2b20520c4cf3d6e960d959168e932ad45b0c22e0a5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650637737, "uuid": "5903cc64-7f41-4ce9-be12-66f9107ccc07", "value": "T1F3933A47B71C0B53C59B5AF12DAB3BF08B69B9E113D76185A10AEFD00372EB12412FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650637737, "uuid": "da64b35b-1dcd-404e-8ff3-5bd3ad5eb213", "value": "1536:QQK1n7bzX9jajzvxRq57wBRcGCMCZDxeBk+8ll4umXxVqDrstKfz9e:Q97vk51RcG7A7l4umXxVqDrIKfz9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650637737, "uuid": "1804fbcf-1611-470a-a90a-c8204a065954", "value": 93907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650637737, "uuid": "1e2cdf87-f8c6-4abb-b19a-d5ca2a214409", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650637737, "uuid": "88159828-19e0-4785-bc5f-810f7f830e89", "value": "b050b31ad9dac4f294274e79fb33ba13", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7f1c33d-c24f-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1650640818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640818, "uuid": "8312ad01-136a-4e82-b50d-2f484997d2b5", "comment": "Malware payload (AgentTesla)", "value": "eff21b954f05c57947ea8b1ff8dd0a97", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640818, "uuid": "648b33a4-7842-4aae-98d4-2f9b4b12d779", "comment": "Malware payload (AgentTesla)", "value": "88b3d6137dab7366119bd7c0e1939d2b63a5e7eb54f41fc443d6d9ea7e6d2113", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640818, "uuid": "0827a4db-2b47-41df-95d9-5cee433d32b1", "comment": "Malware payload (AgentTesla)", "value": "fd589f4168b444b1024846cdd297ab8b652f36db", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640818, "uuid": "41d740ea-a757-4375-8be4-4103fcd6c4a7", "comment": "Malware payload (AgentTesla)", "value": "5dcf095999f83ed3989d1719edf885b096e68f4547d682bf0d55f20a477f401a3f56bdc051c1e906b059daa12fcbd3d6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650640818, "uuid": "35fa84d2-e897-410d-b4b6-c0b5a467deac", "value": "T15BC422A0BBF4A316D2B9CBF519B0091643F576253541EB040DFAF4EB2DB178027A9D8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650640818, "uuid": "b83e3f82-5ced-4ee1-a410-b070d033fd59", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650640818, "uuid": "5ecfc352-20aa-4853-9942-3d18bda984fe", "value": "12288:WCAYtv/h/irdadlCgn2RwUnTF9j6pSPhF8B0xIyHELH:dBdhSda12Rw2TfSY80CyE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650640818, "uuid": "05f6a795-d68e-483d-b856-6b89df5648ab", "value": 561664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650640818, "uuid": "520c0941-8baf-4070-a332-22f101f769be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650640818, "uuid": "33911150-9807-4c2c-8131-494543f4e3b3", "value": "T\u00fcrkiye\u00a0\u0130\u015f Bankas\u0131 swift Bildirimi_xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49bd47ee-c242-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1650635050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650635050, "uuid": "e8d5df63-1649-40d2-a5ec-9c48221a7915", "comment": "Malware payload (Formbook)", "value": "0defc11a963d8c25ab22aeccefed7564", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650635050, "uuid": "31543c6a-34fb-4b64-89c0-e78d6e6e5d7e", "comment": "Malware payload (Formbook)", "value": "8936c1cd18e085f39f8cb1c4ebacd04573a291e555d420acfb4845320e401aae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650635050, "uuid": "de9f7479-ba69-4105-921c-f6ea5eee0489", "comment": "Malware payload (Formbook)", "value": "989b504c0206753e5f5e7d4e9ed1370c7561959c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650635050, "uuid": "02cc7679-5512-4501-a5a3-9a5a5835df21", "comment": "Malware payload (Formbook)", "value": "d5b7eed95c6d98b74720f315dbb26f07aa9d42e80fccb0fef1b6abb06cc641bbd739bd3e89249431f79d7ed05b7b39bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650635050, "uuid": "467e6b18-8317-4c8e-a7fa-231104a763a0", "value": "T1C3C412113BB4C2A1C87DFBBA64C2254B93F5CA63630D938D1D67627B7961380125E78F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650635050, "uuid": "678662e2-1945-49fb-ae4a-d6e2d2d253d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650635050, "uuid": "47abc81e-2c3a-4a06-9b48-9b06ef25ec94", "value": "12288:hVy+5c8Xy0Ld1mkEzi+xmMJryTi4RWCQldzLLWoMv786MKAYtv/h:bL5c8Xy0J1Ii+xm0dCQldzLLDMvB3Bdh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650635050, "uuid": "e12bbc0b-e5b1-4a0e-bb35-31557a18060b", "value": 555008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650635050, "uuid": "229f5369-2ded-4c68-ac36-da53dc45b65d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650635050, "uuid": "157d6acd-5c2b-49b9-b0a0-82c28f0de397", "value": "obizx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67ed1e69-c221-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650620927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620927, "uuid": "9361a059-41bd-4316-a70a-a56c8251ac53", "comment": "Malware payload", "value": "751704c52b1770bc2edd8ceaa5f4d934", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620927, "uuid": "aefcc68f-1bef-4c6d-b80a-288da4d14d3a", "comment": "Malware payload", "value": "8998dd99bc384ca1768ebc54ab100dbe408d6da03f427d6518bfba7db464728d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620927, "uuid": "cafbc4d0-831c-479d-b123-b626f382f1bb", "comment": "Malware payload", "value": "32cdaf4e6e590c0ad06bc7ec0d02a029e91e7fd4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620927, "uuid": "e874e7d4-3a11-4bac-8d42-b3ce647f5a15", "comment": "Malware payload", "value": "87af56ff73b58fc1af6e550bbf23fc2c6e3783cd51af5932628f91b3af90018d5f5faac13469a9dfd3622c708ec41ec8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620927, "uuid": "b80f024d-201c-47a0-a89e-e25a8731c73b", "value": "T136D54C22B144627ED06B1A3A482F9654A93F7E613A258C5F2BE43D4C8F355807F3F64B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620927, "uuid": "3e94a14c-7130-4b56-8341-30fce62a4b6b", "value": "340215883a6ce77bac0d37d2c63a9327", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620927, "uuid": "a7c9fa9a-1b39-41c2-8cae-0edca346c47d", "value": "49152:aOlP/a3vmcOw+wGTRmzASuSX6uNmorF0qYaiHA1TjWRGp+:a0PC3vmcOw+wGTR/WWa9W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650620927, "uuid": "473a0367-fbec-4805-a332-654c697cffa1", "value": 2941952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650620927, "uuid": "11c69fb9-f216-458a-a99b-c1cdb58ff987", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620927, "uuid": "dfbdfc9f-ec36-4754-b394-79621fffa194", "value": "SecuriteInfo.com.Trojan.DownLoader41.9379.29587.21890", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54d5ccfa-c216-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1650616171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650616171, "uuid": "90a39c4c-99dc-4375-80ad-0ae546970ac7", "comment": "Malware payload (Formbook)", "value": "4301331e07f644d4b6024f17e4b91e3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650616171, "uuid": "a4f47516-0c78-46c9-ae78-dd82dd9c1b1a", "comment": "Malware payload (Formbook)", "value": "8a6679079682f15d6b372c3255e7d9b994c78ec104fc519f408a8bac2b936ef8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650616171, "uuid": "f91cca9b-ba04-43a6-92c5-108da97e8051", "comment": "Malware payload (Formbook)", "value": "b039e7148a81236efa97ca1a21c2168675e37c31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650616171, "uuid": "c48687b1-eec0-4346-b840-91d140187a82", "comment": "Malware payload (Formbook)", "value": "332462c114977c6f3c1168b1e83d7361c6b34d1ed22286e33b0c424b6526e3a60ffba2e832d66a46ead23b01aca1659d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650616171, "uuid": "f1bebff6-f644-4e0c-86e7-ceeab86bb40a", "value": "T1737344E1B61ADDD9D8060BF20C76966000675E4D88A9D50E30EE3F3F77B335328A6D5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650616171, "uuid": "8a84477f-8c67-4e76-9dc2-a44ef60a71ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650616171, "uuid": "1a556f42-dc60-47d3-b060-84e8b6538ddc", "value": "768:WjKv//BgFgSU2Ip4jBqltCF0AxEjenoB69+Fxj:W23/SFgSFHBWAxEjc+r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650616171, "uuid": "5212afd4-3786-41da-a8a0-8192ad30f7d8", "value": 80384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650616171, "uuid": "c6d9b194-ee08-4d0b-a945-27da1fab1949", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650616171, "uuid": "7cda99af-5083-4cbe-8882-700516fecfe5", "value": "Outstanding invoice-Pdf.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7fb8225-c26b-11ec-8e58-42010a9c0032", "comment": "Malware payload (DCRat)", "timestamp": 1650652871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650652871, "uuid": "dee884a1-ab2a-4c5a-917c-7c4f23eb385e", "comment": "Malware payload (DCRat)", "value": "a2472619aec1b1be33436b05b27359f6", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650652871, "uuid": "1ffe8b83-013b-4ab7-983e-4374da21c778", "comment": "Malware payload (DCRat)", "value": "8afc46661f87c6c9e0b4fc2d6654809ac04049a02907ded2332a173a5f006f3e", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650652871, "uuid": "7087771a-c18d-4028-94d7-cf2c70e5b41e", "comment": "Malware payload (DCRat)", "value": "e4c15e2db9ea734202b27b6258b9460b6d94fcf1", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650652871, "uuid": "01b9ae55-dcc3-4b33-ab4c-f1a3716372ca", "comment": "Malware payload (DCRat)", "value": "c7108688c5b2e86956d68d3a62445c25ffd104fde1a99e2c4e5a2aa19f2ccc6ba7e5f09f2ecc4cf5c357c3b41442ea1e", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650652871, "uuid": "f5f59682-c492-4769-9ba3-3b87a3d8c835", "value": "T1F9658C027F40DB12E0A45237C2EFDA5843A0ED456AA6E31F7DAA336D15017A77C8D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650652871, "uuid": "1879d47d-a129-4d65-aa29-56f2c2e103fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650652871, "uuid": "535aacce-c131-4cd7-b531-c2baafccc5ba", "value": "24576:0lmyJ5FqJipBpreVaMkk6wjjvhHP0cXM3BVc7cDsue:Vyfxp696wfecOVcAY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650652871, "uuid": "f1eb50ce-5407-4d0b-bbbf-1bb0d16aed31", "value": 1525248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650652871, "uuid": "fea9ac14-1005-4cae-bcd0-034cda578dbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650652871, "uuid": "aa3d2865-a551-4543-be24-6b4f3e7c8bc4", "value": "a2472619aec1b1be33436b05b27359f6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86ce4ea8-c221-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650620979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620979, "uuid": "1deea440-1401-4a41-ac8b-be391ded0c21", "comment": "Malware payload", "value": "ee3d858b1402bccf41d781dd5eb4ecc9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620979, "uuid": "e85108ca-fed4-4e33-a6a9-a8e28bf4951a", "comment": "Malware payload", "value": "8bbf243dc3cdaf4f2a9f85680e8085e14a1764742dcc578c817feb3d7133c679", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620979, "uuid": "d5d48e07-f9f1-429f-bec7-84a7c0fc1294", "comment": "Malware payload", "value": "d02b5b3fec03967c462c5c136142fa033a512c62", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620979, "uuid": "89b45dcd-c97b-4e60-a273-b39027a84537", "comment": "Malware payload", "value": "dffe214ddc41b8cad8f8e5b2f0dd8d839226c94eb4541c35f4a67228f757291f51558eecb3e46782dc150cab14890572", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620979, "uuid": "6f2e9e5b-54c4-4eda-9b5b-045bf9677914", "value": "T104162992B2C56539C06A3F364937A6D8993FAF516602CCDE17A43BCCCF37441252AE1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620979, "uuid": "a7992dea-d3fd-45df-8485-56fcfc14fcba", "value": "d1064e22b9d7099d148327a96198f297", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620979, "uuid": "72cc3d28-0ea4-4fb8-ad57-4e67d8c7fd7d", "value": "49152:7gOtny7uutfSJCKY56SH4jFsz3wmbfBfRLHg32TugZwqh6oOe:7g4yu840AmFIYh6o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650620979, "uuid": "27495501-50a6-4d91-81e1-fb6347b43b71", "value": 4363776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650620979, "uuid": "169ffe58-8336-4ac5-a5e1-35e0cb0b5d03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620979, "uuid": "5f377ab1-e9a6-4a1d-976c-3c40c50357a0", "value": "SecuriteInfo.com.Trojan.DownLoader44.47619.25148.31463", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43f0146b-c289-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1650665534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650665534, "uuid": "076ab200-d6cc-4b21-94b8-9b1aa65bc55a", "comment": "Malware payload (Gafgyt)", "value": "d36f442a2777694b24d31fbe56ec559e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650665534, "uuid": "f525ae6b-d82e-42fd-985a-925abf942c78", "comment": "Malware payload (Gafgyt)", "value": "8c87c034680e6ecf8193b81a37907c7cc41de0f8bd64bf87f9c81ad5e9344c2b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650665534, "uuid": "0630084a-4e3a-4998-879c-61eddd804a3a", "comment": "Malware payload (Gafgyt)", "value": "45d75b3a5ecf74731ff094537852de920320e372", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650665534, "uuid": "f5b4e14e-ba30-4a55-8c4a-90febe974dc8", "comment": "Malware payload (Gafgyt)", "value": "018da875c1f55548f3fabb70b900ac12075629caa196ce9ff193856ca4f3b69ce7722a533075c4311836cc64c7b76c5b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650665534, "uuid": "5c27090f-62dc-4e90-8401-35d6f12d7ae4", "value": "T1C4B3E857FB11CEB3C85FDD730AA68A01108DA99746D57B6BB3B4DA5CE74684B08E3C80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650665534, "uuid": "c18a479e-8967-4214-bc54-6bd9058efa9e", "value": "1536:Tgz/qzNLW/fMiZIX98U0I/QwErQNOZ5hVwbfKdwwjF9GhCPR1Ae:Tgz/5f5g8utg95hVwjKdwwjF9GhsR1Ae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650665534, "uuid": "1f17fd1e-dfb7-42f3-bcfd-2879e8e0a243", "value": 116647, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650665534, "uuid": "774ce045-c897-4b58-b792-6f65faf459cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650665534, "uuid": "dad9f31f-b14c-4590-b480-11d83919462f", "value": "d36f442a2777694b24d31fbe56ec559e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9f18091-c236-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1650630057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630057, "uuid": "85606555-ed27-4aab-a7db-9169868f4d6c", "comment": "Malware payload (SilentBuilder)", "value": "ab016380a483433696a989fc419b7b83", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630057, "uuid": "03a1cee5-8019-4901-aff1-01fcddc059b0", "comment": "Malware payload (SilentBuilder)", "value": "8cc4ebd15cec1af10990ba8d86fdcae9d976097f87bd05e19dc113eac2c7368c", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630057, "uuid": "b7fb56e4-ad40-4993-9f0b-aa1a4f5c466c", "comment": "Malware payload (SilentBuilder)", "value": "58ea598eb3b67e1cf6b741d9c1d8ee6a66c75b98", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630057, "uuid": "c1c6cf99-60d0-4efb-9c10-d802490f6674", "comment": "Malware payload (SilentBuilder)", "value": "38004c9f27bff1dafacee87084780ffabcba605a36999813cb554831615fac0422aba3847654dbc3ce591df9d1fe6e07", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630057, "uuid": "4fdc0a60-9b26-4907-be4c-509d7780cffc", "value": "T1C423B646BA5D9859E9258B7548E743E9B333FC201F6B0B833616B3257FF49E05A03207", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630057, "uuid": "f88020bb-c312-47f3-8e6e-86ac9d8c50ce", "value": "768:4DM52tfQXi8vgLZkTOHkQT51Vp6AwPdM8gQ6JT5X6DGwUdh+pqjeSLjcvLtzrxF6:462tfQXi8vgLZkTOHkQT51Vp6AwPe8g/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650630057, "uuid": "b41775ad-b6df-4c1d-b9b9-8bc259bd20be", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650630057, "uuid": "acf3986c-465c-4e86-88f3-956d235873a5", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630057, "uuid": "de0b3c3b-497f-4d81-88f0-7167dcfe4444", "value": "iMedPub LTD.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9abaf67b-c23b-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650632179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650632179, "uuid": "75860f35-8644-4be6-87dd-b2266d92d243", "comment": "Malware payload", "value": "19126022e2267e271483d6c9de349892", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650632179, "uuid": "26c1cf86-6991-42ea-8a02-4053394c46de", "comment": "Malware payload", "value": "8d51cd7147ab1575bad2a6ab12e9938878b6c26d20622665da096906374441d4", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650632179, "uuid": "38403a3b-7fbb-4f6d-be0b-8d9929620d82", "comment": "Malware payload", "value": "a3078049041d52844113ae762cd700a6b654b0ef", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650632179, "uuid": "3118db32-a62d-4245-80b0-a563ecfcdcfb", "comment": "Malware payload", "value": "ada96bb828c6df06f1e80f215e7cb57b5cb23da4bfbb0cfa43d8de82a11102c0c2d4e6892112257a40c4fba67b3c4657", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650632179, "uuid": "90b55416-0d1a-4282-af0d-0110839b3356", "value": "T16423B646BA5D9859E9258B7548E743E9B333FC201F6B0B833616B3257FF49E05A03207", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650632179, "uuid": "73d48368-9473-4ad1-a239-9bdf29492bd3", "value": "768:4DM52tfQXi8vgLZkTOHkQT51Vp6AwPdM8gQ6JT5X6DGwUdh+pqjeSLjcvLtzrxFG:462tfQXi8vgLZkTOHkQT51Vp6AwPe8gT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650632179, "uuid": "39f58a5d-710f-46d3-9d42-83056fbe0a85", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650632179, "uuid": "9e429053-212d-4672-b5d1-a8291fe67d2f", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650632179, "uuid": "764cf537-aa47-4656-8fd7-8331190a41a6", "value": "Details 2022.22.04_1300.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ff761ed-c24d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650639677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650639677, "uuid": "a56e154b-1c9e-498b-848d-6196db819c53", "comment": "Malware payload (Mirai)", "value": "851f7a7ea81b13dbc2b3b42eca3419bf", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650639677, "uuid": "1c62540a-06e4-4db2-91bc-da806d986558", "comment": "Malware payload (Mirai)", "value": "8d76f18e9a2e147eec5784a1b17c5b984157ec63686456007529ef256de7b613", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650639677, "uuid": "86039eae-9062-45e1-9aa2-21903f40af26", "comment": "Malware payload (Mirai)", "value": "9fe743cb828468a90dd8e4606094ee2983e1d1e6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650639677, "uuid": "0f68567a-6c36-436c-b69a-521eafd52c12", "comment": "Malware payload (Mirai)", "value": "e5c1b3531559d16e365d0c86209736b794aaa9b9e88bc8f3f128b3d1125184705628757066a12df58ab7cf39cd92231e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650639677, "uuid": "3435ffb2-2daf-4112-899e-ef2259b5ddc0", "value": "T15C03F22A135B71B3EE10C4FE7AD6077245728EA28457848B7004F6EB1F86261B1C7BF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650639677, "uuid": "f33cfccd-68e1-4246-ae67-b54e24a19706", "value": "768:iZeAjweFCsCOi2GawMDnfZpcMlsF27+7J9y8pEQbe5ITANn9jnAJgGlzDpUYsx:mjMnO7rhfZt42mJ9pY5JNn9jnAVqYi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650639677, "uuid": "523ee56f-3ef3-4a68-8ae9-72b71f0b9a1a", "value": 38032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650639677, "uuid": "2af5b2bb-659a-4cef-9d91-bd27e31be552", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650639677, "uuid": "535582af-62a5-4596-8b9d-c593dd7065a0", "value": "mips-20220422-1501", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8090fcb-c262-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650649032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650649032, "uuid": "56fcbb1f-73cd-498d-89cf-e58564c7072f", "comment": "Malware payload", "value": "7754cdc1a67e7d5f97b803448999ab1a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650649032, "uuid": "9fcc75ae-46eb-423f-9a15-48461e31825e", "comment": "Malware payload", "value": "8dea6adacdf2dc133a1891adbd5ad6399b684920406591092051d20a23b1d637", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650649032, "uuid": "09d9c9b7-c5e5-4d09-add1-07068a730458", "comment": "Malware payload", "value": "50cc58c4d82ae7f58253b99a33ec5097be3bd745", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650649032, "uuid": "ed0c3488-0a0c-4763-8cbb-e3f8f9435863", "comment": "Malware payload", "value": "022825e22fb0a134530e6d9a60a546d3862df9fc67f94424825896d759caaf3d67c7d9da00a51569319efbeec7e8a380", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650649032, "uuid": "a1e90583-cb56-4012-b8f4-3d69f2c532f9", "value": "T1D3F48D4BF77C84A6D16AC979C5639A8AE6717C454B71C34B4360FB3E6F337A05A2A300", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650649032, "uuid": "cf094cbd-4acd-4076-87d8-6b84b584a5af", "value": "57b460f7cd0fab28b120cd121cfb7f9f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650649032, "uuid": "f26e8e8d-3189-4786-8662-e57869712d12", "value": "12288:aIabL1+x29hs+bDBLKhKmCKzTrj5i0I8PxiGhWzx+o8/NQfN7IT5p:XabLXhs7AZKzvjkT0hWzP8/yfRIT3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650649032, "uuid": "a69e44e6-a7fe-4984-8c4e-6ff164b5259a", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650649032, "uuid": "3036c211-24b3-4d68-897f-f993d75c5b39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650649032, "uuid": "a2b07c74-d461-4c2f-ba20-d3c8f3bf3a12", "value": "CDZu.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a71aee2e-c221-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650621033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621033, "uuid": "6d2a5cbf-b8c8-4bf2-93f6-e6823d6b7b17", "comment": "Malware payload", "value": "da78b9aad3923c7c0346ac36fb4b825a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621033, "uuid": "4190f5a3-4849-49a4-8fe1-3d81272610e5", "comment": "Malware payload", "value": "8ea48df661531db5e51eefd4210dc1ddd9b79c89dda6817f8a05834ef1767bb7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621033, "uuid": "479f4a35-61e7-48b5-af7c-5735a6866b2b", "comment": "Malware payload", "value": "6aa0a4cde7c017fdc2f09ad9739fd5824dc7f60e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621033, "uuid": "50bb48e5-b4de-4561-95c3-d8ed036c99e3", "comment": "Malware payload", "value": "cf45dd58bb7393122554bdc9d1151db7d3478d398706f437242c1e07a19def55a042dc089496f150f9e24cf9a31a9547", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621033, "uuid": "d8ccf6b1-e1c3-401a-8f0b-8525a36fc95f", "value": "T1C0E55C33B245B53EC0AB197A963BB75C993B7A612622CD5B47F0098CCF355802B3E647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621033, "uuid": "3acce7f8-c5c3-44f5-9cab-7bc1d8cac428", "value": "6b5fa3fe4fb76af7f62b44540e533bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621033, "uuid": "a9a6513a-68ba-4622-9b58-f41ede3a6daa", "value": "49152:l1BMUy7zcotBJyJnhpSwCaDlgB0qMTjTOKzhGYC3A:l1BMjRyDm0TTvhGY+A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650621033, "uuid": "5223eeeb-1b35-4838-ada7-d6b332b82bcd", "value": 3144192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650621033, "uuid": "798c906d-299f-4478-adac-02c4e3055ee2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621033, "uuid": "4459023d-1858-4322-9ee2-c8da92979219", "value": "SecuriteInfo.com.Trojan.DownLoader44.37160.25777.2914", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59f4422d-c211-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650614032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650614032, "uuid": "f6317068-9402-4add-b01d-17b61531fe09", "comment": "Malware payload (Mirai)", "value": "59401319d416fc7b6fd8d0bcfa4be0da", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650614032, "uuid": "5ee15324-0b41-4750-bd70-3f49baa4f1a3", "comment": "Malware payload (Mirai)", "value": "8f98ee78c18a3d910df9f3c9a77ce0e16020e11edc0a06e4df61a97c15ba9cb2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650614032, "uuid": "f984a6ba-4adc-4b7b-91ba-a9e514946b8c", "comment": "Malware payload (Mirai)", "value": "978e92785b47446fca604de3bfc65170a7bac0bd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650614032, "uuid": "80f5b105-3706-4cd5-bf74-0b1bc04e0a8a", "comment": "Malware payload (Mirai)", "value": "fe52d82d7e31181a35b9329311b24ce9e2f99bb649a947b6c9a3edd10de4dd7ee6cf61a8a303600cf7bb6db510769aec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650614032, "uuid": "24f1cf93-484f-4b4d-afd0-acfabef14915", "value": "T105135CC4A903EDF4EC1506B03276F7329F77F13A216CED5BC7998923A842681D64B29D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650614032, "uuid": "75082d95-3dd0-4a3f-a755-17f0a6e06624", "value": "768:SebUJCHJV+IVojHXHVMgjx4dD/rzxA1l2YhXGWXmVE8fVpSMf:SebUkHJV+IVoj3HVMgjx4dDjzSplGW2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650614032, "uuid": "64c92e6e-39b9-44a0-be8a-3b604597b282", "value": 41560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650614032, "uuid": "29d21efd-3522-409d-8732-1b1752c3ae3b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650614032, "uuid": "729c9151-7fc1-4149-bebf-03fa1307233d", "value": "59401319d416fc7b6fd8d0bcfa4be0da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cad251f-c289-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1650665603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650665603, "uuid": "b1409b9f-753d-47c9-b8da-b2f1f3a6fb93", "comment": "Malware payload (Gafgyt)", "value": "3806e031846718b9c392d6ecec747ea1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650665603, "uuid": "4f19cb99-9ee6-4a44-a07f-4a55e0955d7e", "comment": "Malware payload (Gafgyt)", "value": "91b70aa19e6220d61ccdfc182b1f52ae41a1007f2a699948e1bec62716d2dc14", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650665603, "uuid": "635b9a0f-fdb3-4c7d-8552-ac5ea816a976", "comment": "Malware payload (Gafgyt)", "value": "5f6976913bde79b03b39b7baab9c28305db375b8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650665603, "uuid": "bdfa2837-207e-44fe-961b-8b81accf7abd", "comment": "Malware payload (Gafgyt)", "value": "7ee43cb8e3104caae641a364009da596ad15bb39691d74345c6843dfccfe434f52371dabe28572efd9ba5069b87c9c3a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650665603, "uuid": "e74f2026-028c-49c3-8fae-2916fd24ca64", "value": "T137933B07B71C4F43C1DB59F029BB2BF15769B9E112A36181B91BAEC05B33AB81523F94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650665603, "uuid": "217b3c9d-b9ed-456f-a927-c317947ea4ee", "value": "1536:T3oCu/OcwUBvPsTbwHH3P6zMSIHsiO6aRv/lz5I5hLg6wOFO6V6qDjjofSee:T43/qUBvPs6X03IHsi2/M5hL7wOFO6Vt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650665603, "uuid": "835b7fde-25b1-4a84-abe3-36d204360598", "value": 92720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650665603, "uuid": "803b70cf-7414-4da9-b012-c8ebf653f3f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650665603, "uuid": "8801cf8f-29d8-4480-9d88-31129a428f90", "value": "3806e031846718b9c392d6ecec747ea1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d02cb36f-c23a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1650631839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631839, "uuid": "4512eecd-741c-43ff-8fc5-b56212388f35", "comment": "Malware payload (Formbook)", "value": "5e67fd2b1d17ebc9ea88d2ed0f870616", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631839, "uuid": "c215d0e2-69c3-4bd8-9bb1-b6d252f4c156", "comment": "Malware payload (Formbook)", "value": "922445967d9f0fd85ea49040191928dd0ac2e34c35eec90411e7c5bc227b21eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631839, "uuid": "71900ebd-a7ad-416f-a087-813f06d935c6", "comment": "Malware payload (Formbook)", "value": "64a49038e10d6399e0c764494735dab9aee3ec20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631839, "uuid": "359ce598-2b51-46a9-8e45-5fd8be9c2e82", "comment": "Malware payload (Formbook)", "value": "5866909973950be5a17d042a7f368c437642483157c04d9e53cd5cc2c9dd7022dbd87ca0773dc5a8ddbd3b9d904d873c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650631839, "uuid": "953c2a80-1a03-4336-8888-ce5b5791851c", "value": "T19BC41242B3B08151C4BEABB5A4E2585B47F5C3135B08998C1D67A2BF6A70340676FF8F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650631839, "uuid": "b4b90865-0bf2-47b2-8838-4e7426a3247e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650631839, "uuid": "92629de7-904b-4149-bf2b-54700ef0c1b6", "value": "12288:KINhpk91k87YPUOy2fBI83gujILE5rpAa8VqMoizeU20AYtv/h:dhq91JQyZ8JjqE5rruzeoBdh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650631839, "uuid": "f966d137-ad8a-4ac6-8546-13d348c2390c", "value": 544256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650631839, "uuid": "a167f19f-19f5-4fc5-9a57-3ace76647b06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650631839, "uuid": "f8536075-3777-43a5-9383-63b56f376034", "value": "NEW ORDER CF 2022-24400.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ec6f817-c211-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650614040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650614040, "uuid": "387f442e-54b6-4546-bec3-fd13bc32eb6e", "comment": "Malware payload (Mirai)", "value": "92de5d13161b1333787a6b4b69788640", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650614040, "uuid": "7b5f7ba4-b2d3-49b4-a088-9ae670bf1f81", "comment": "Malware payload (Mirai)", "value": "92785acfe1175a25165f31df8a045973f7289cfe457746f0419134fe48ae46ee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650614040, "uuid": "8b5a0a82-34c3-4644-861c-1bfcd57095bf", "comment": "Malware payload (Mirai)", "value": "14e431cff7e7d10c58b40ff945fdd1565b0e209b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650614040, "uuid": "f8752793-e1d2-496b-ae60-6a92f28ae84c", "comment": "Malware payload (Mirai)", "value": "56dd66b38f8434902d26565c49ad600da02c4b9beb3abab84db97da8bb9aa46ab38c17bd3b7e9c4e4967ccc27c0a34a2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650614040, "uuid": "2ded679d-9538-4ac4-bb27-ccd4e1465094", "value": "T1FB2319D6B801AD3CF95FEABE85970A08F631735151930B3667EBFDD36C321984E12982", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650614040, "uuid": "6c3c17c9-edad-4aaa-92b4-2b06d6aa5a9c", "value": "768:xEeAVRJaA7pPDZWidw17G87jwBZJqhnlw9NKgUv8CL:6BVLH7pgii7Gsjy6nlwTKgi8M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650614040, "uuid": "1c75e3c2-631f-4f8a-8425-33075b2b4ab2", "value": 45888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650614040, "uuid": "89344665-bb7b-46db-bc4c-f2c3860ee721", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650614040, "uuid": "197df9aa-0d5f-4a82-b284-3c0400cebfb6", "value": "92de5d13161b1333787a6b4b69788640", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eec51b63-c204-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1650608698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650608698, "uuid": "d9fc53e0-6b29-45f6-a9c7-e06efe17534d", "comment": "Malware payload (SilentBuilder)", "value": "4d69b854ee90d61913670a3fc32357ca", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650608698, "uuid": "fb2504c5-2926-4792-8171-c42a179fa991", "comment": "Malware payload (SilentBuilder)", "value": "929781955e71206d22c216e23fb7b8eaa45d195e197694b399329d9f1462ea10", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650608698, "uuid": "f4607ed8-a18d-4d6e-a8e4-71010ea5aa70", "comment": "Malware payload (SilentBuilder)", "value": "0f8d7a6ab0b6eb26b65b828c7cc6357a7f1759ba", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650608698, "uuid": "f81c783a-462b-4e21-8a5e-997def381014", "comment": "Malware payload (SilentBuilder)", "value": "70bf79525db98d562d27b3156243bd9b85ea1e8e77babb8bc9ee32bd5f3668e70eb4896b387fcad7d71a459e43966c17", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650608698, "uuid": "7bd68cfb-d3bc-4540-9be4-498dd09b10be", "value": "T1F123B646BA5D9859E9258B7548E743E9B333FC201F6B0B833616B3257FF49E05A03207", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650608698, "uuid": "d2f7a9e4-b675-4900-a056-dc47a6ba05b3", "value": "768:4DM52tfQXi8vgLZkTOHkQT51Vp6AwPdM8gQ6JT5X6DGwUdh+pqjeSLjcvLtzrxF2:462tfQXi8vgLZkTOHkQT51Vp6AwPe8gj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650608698, "uuid": "f2fe91b3-5322-4291-b39f-69b6c4365720", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650608698, "uuid": "f559d39e-1c4e-4a22-b40f-d079fb5dc42c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650608698, "uuid": "8f549944-5f80-4d37-9e67-e9a602ed0a98", "value": "Money transfer details.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63287909-c205-11ec-8e58-42010a9c0032", "comment": "Malware payload (Babadeda)", "timestamp": 1650608893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650608893, "uuid": "730d226b-56e8-4bf7-921c-eec669e38e69", "comment": "Malware payload (Babadeda)", "value": "6b710cf2a68a161214b9bc995dd5272f", "object_relation": "md5", "Tag": [ { "name": "136-144-41-237", "colour": "#FAB5CC", "exportable": true, "hide_tag": false }, { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650608893, "uuid": "be5ff0c6-01a6-46ae-9669-45a894b36f9c", "comment": "Malware payload (Babadeda)", "value": "9301ac144b986ed91bdfb0861b051c0f62e7eef8060799df30985bab135a46e1", "object_relation": "sha256", "Tag": [ { "name": "136-144-41-237", "colour": "#FAB5CC", "exportable": true, "hide_tag": false }, { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650608893, "uuid": "a61e9a69-8361-4d61-836a-d2870af11105", "comment": "Malware payload (Babadeda)", "value": "a39bad68f4bc2506a17f9cce01e43f6c1e03dbc2", "object_relation": "sha1", "Tag": [ { "name": "136-144-41-237", "colour": "#FAB5CC", "exportable": true, "hide_tag": false }, { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650608893, "uuid": "856c1638-e863-41fa-97bb-54b4cbf5869f", "comment": "Malware payload (Babadeda)", "value": "7ea916719da451801d2b70f6d76fde9271cd9ee582d1cad17865bf13a3caf60d3b0baa0b3acac91910d01d8206540f78", "object_relation": "sha3-384", "Tag": [ { "name": "136-144-41-237", "colour": "#FAB5CC", "exportable": true, "hide_tag": false }, { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650608893, "uuid": "751b63e3-b225-4fb5-9a81-7a367cedf8fd", "value": "T16D84D042B29581A3D6D124350FB1E03A6335AE6C6B149ED7A3DC3D477ABD68366303F8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650608893, "uuid": "262d173a-4905-4ceb-8b64-91261144134e", "value": "5877688b4859ffd051f6be3b8e0cd533", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650608893, "uuid": "bb19347f-4583-434c-b6c6-72e563c28fa8", "value": "6144:ZzBkLL2NTBXAm7nA/tiuc2utAtKcI0ZuUpUxioM:ZKyNTFAutAXIJx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650608893, "uuid": "96c0640d-68da-4762-9eeb-d2f895db7069", "value": 396872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650608893, "uuid": "e54da35a-a6de-4f95-ae9a-c31d54112fe0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650608893, "uuid": "690ecfc8-3ab1-40bc-a15e-280df0f7d659", "value": "video000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "423e6403-c1fa-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1650604113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650604113, "uuid": "e0099641-bf62-4132-8970-ff20ca52a7b7", "comment": "Malware payload (AgentTesla)", "value": "47b4c58be69f4816288964be37ebdc6b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650604113, "uuid": "a79df8a3-94e1-41bb-94ec-9d0180d9afda", "comment": "Malware payload (AgentTesla)", "value": "93b394ec5cb5014041698c3554e5db8a32ad66874f457a9a3c252b97903d6599", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650604113, "uuid": "4bd07a63-7dc6-4349-a145-a2f858d41b0d", "comment": "Malware payload (AgentTesla)", "value": "738c2ba36b14da18db92e51c316804d9446f5a0f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650604113, "uuid": "74619d6a-6f32-49e7-924d-d0a2340f58e9", "comment": "Malware payload (AgentTesla)", "value": "d042dc6473acac2e81df7d1a8cf35793e2f9889a9e85f161595efc498148d44c4213fb6304e8f4b38952203c67e0a12d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650604113, "uuid": "3a0add13-54f1-4ef9-8de2-8d75808861f2", "value": "T116B48D98755171CFC587C972C9D6DCB0BA60B4AB470BE38BB0534BA8AE8D497CE006F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650604113, "uuid": "c0fa9ec4-b8fd-4542-839c-1af055d52234", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650604113, "uuid": "ac1e0372-356c-4f66-b843-a358a2c5e75f", "value": "12288:y3X1PFOVvXX5qpT54a0SQWUfw9mYvJi1hpN/P77Pbezp/Jrx:yVPkV/X5qpT5zQWUfw9thi1W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650604113, "uuid": "d86ec5a5-86bd-42dd-8513-61fc3d451f5d", "value": 542720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650604113, "uuid": "a38a52f9-6214-43c5-a938-1d371701b314", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650604113, "uuid": "ae3589fc-42a8-4c9e-990d-d1aa4d082593", "value": "SHIPPING ADVICE#SHELLSEA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8b453ef-c236-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1650630055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630055, "uuid": "ac961747-ea9e-4efb-a5a5-8ac6a7edf6d3", "comment": "Malware payload (SilentBuilder)", "value": "cae7e1179136fe3bf35b6e514d7704f4", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630055, "uuid": "fbbbad91-64c9-4540-b844-68aa7081a4a5", "comment": "Malware payload (SilentBuilder)", "value": "93e52d07730acea1d9889788f30e7fb3cda27af7244e2657377245473355b98f", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630055, "uuid": "e428cc6b-6e0e-466a-b801-02b46f817f66", "comment": "Malware payload (SilentBuilder)", "value": "b0b9613b4d3e1e77b78cb8c76594e90a3a603e8c", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630055, "uuid": "45cbf3ef-7cee-411c-bd54-b287a3ee8ae4", "comment": "Malware payload (SilentBuilder)", "value": "346050459468ab4e7d5bbc4ca4c7532ae93d02d939b3d58863022f0dc76883adc8631830f28cc06cc287028d3394af3b", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630055, "uuid": "0d6500b0-fc52-44af-9257-c7b3d28904d5", "value": "T1F123B646BA5D9859E9258B7548E743E9B333FC201F6B0B833616B3257FF49E05A03207", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630055, "uuid": "33ed0409-76ef-4487-99c1-9db7a89b0429", "value": "768:4DM52tfQXi8vgLZkTOHkQT51Vp6AwPdM8gQ6JT5X6DGwUdh+pqjeSLjcvLtzrxF2:462tfQXi8vgLZkTOHkQT51Vp6AwPe8gj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650630055, "uuid": "a00df82d-33e9-4d3e-8693-8629f70ba174", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650630055, "uuid": "4b160a05-6086-4e43-a810-f60013765c9e", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630055, "uuid": "47e5bb11-3caf-4039-9a3e-e645284c886c", "value": "iMedPub LTD_1.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "708a0341-c221-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650620941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620941, "uuid": "b1d4753b-6980-463f-87b5-1566b4d14dd6", "comment": "Malware payload", "value": "ed47092def12ab4617169789db044897", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620941, "uuid": "5f496a24-4a7c-4daf-b391-5bb3e8202241", "comment": "Malware payload", "value": "940d165e6670809fd9858a213753c9e9e63e67a8cffa59801b02a2481ef8e1e5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620941, "uuid": "8d3fdd7a-78b1-4d08-9cbd-93e4487b0be0", "comment": "Malware payload", "value": "2c910dfece4febb6b7b41ec10b7f03551cd1fd47", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620941, "uuid": "7f376a65-ff94-4df6-a501-b4362758d7c3", "comment": "Malware payload", "value": "0572b368b4d3bd95db46c8ebd7bca11a0311afd49b3dd4a123954c0741993e626284d7d2b4fc8ec9baa6c88e061d91e9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620941, "uuid": "943fa2df-499c-41c0-9f22-38dac0063d66", "value": "T1F1F55D23F388BA39C46F0B7A4537A258993F7B617512CC1767F4098C8F3A6417A3A617", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620941, "uuid": "4f687273-e7b6-4df2-9718-c0c5aec58c6d", "value": "1e238367cb5874b164f70d7ebb08db75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620941, "uuid": "026f2613-044b-4dc8-8905-25db18555d27", "value": "49152:BCyJQ/hYHr3l52SuLlN/6vutBYZyxCRSTzQ1R:BCyJch+3pGUZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650620941, "uuid": "b32ffbd8-b03b-42d8-a501-3be2060b5b81", "value": 3531776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650620941, "uuid": "1f869919-bcca-4aa3-95bc-0687df8b531d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620941, "uuid": "2bb95529-7bdd-4bc1-af5d-bc6beee00a2e", "value": "SecuriteInfo.com.Trojan.DownLoader44.44917.16932.28382", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73d71de9-c221-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650620947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620947, "uuid": "89ab77d0-d6b2-4bb4-80de-98944aec1768", "comment": "Malware payload", "value": "40eb71fcfb83c2f7ec45faebffa86857", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620947, "uuid": "9bc52753-fe20-42e7-ae65-a0a5a28d7e68", "comment": "Malware payload", "value": "9521b263ec94b8d8b9743f44eaa74605ba60e0960c0f77f9e8ae0cad45edb2e0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620947, "uuid": "d36c68e5-0b56-4978-bfa4-f92a3849a0c7", "comment": "Malware payload", "value": "bee885b4725a1f5ae9c795488f4b4e9fd4d4c83e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620947, "uuid": "30f0f7b5-1051-45dd-8c5e-36d9bbde4fee", "comment": "Malware payload", "value": "9e578ba046c186579a2448a378b0eb37978db4bc734f03fe60c6ada87630a848b51ef02258b0d6c263c6efc84fdcdf7e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620947, "uuid": "ef00bc29-5de2-405e-bfd5-41c5ac843fba", "value": "T133066D23F388BA39C46F0B7A4537E358993FBB616512CC1767F4094C8E3A6417A3A617", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620947, "uuid": "94a9ce2d-62ca-495f-9d5e-17a7dae2a07d", "value": "1e238367cb5874b164f70d7ebb08db75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620947, "uuid": "8c693ebd-25d6-4ace-936a-4869f8eecdf3", "value": "49152:BCyJQ/hYHr3l52SuLlN/6vutBYZyxCRSTzQ1RwGYf3A:BCyJch+3pGUZCGYfA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650620947, "uuid": "76b571bc-d879-4daa-bc5b-8963261ce871", "value": 3734016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650620947, "uuid": "24e22082-6b4a-4c38-abdf-446387c03c9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620947, "uuid": "c650577d-0360-4809-8ea8-b35fa731b58a", "value": "SecuriteInfo.com.Trojan.DownLoader44.44917.15123.19343", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e905189-c221-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650620938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620938, "uuid": "5e16874e-7193-4385-a96a-061317527fb4", "comment": "Malware payload", "value": "dd09b6564b22a9a7cdee35f625020a0d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620938, "uuid": "1503da95-c2c7-4fdc-85e4-525f1c244fa4", "comment": "Malware payload", "value": "95a37a301590fd79db831d821b04ac65ec68cbd41a08217d7f4e46c749cb2e43", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620938, "uuid": "c1c590ca-3632-4c9d-aabc-0c8bfbe71c0a", "comment": "Malware payload", "value": "71a3b57011c1f72f15c757c5b9e76fb75fd8bef7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620938, "uuid": "f1c51756-e7d9-4095-8802-4f32eab8091c", "comment": "Malware payload", "value": "bb6bd0bae66dea34b6e5598c0617ead3255c96dfdd911c7c7ffc924fdd7e6a72673106bd56247cdbfcd64be2065cd7b7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620938, "uuid": "6674ca99-e811-484d-bdb6-e20e0efb3087", "value": "T1FF74AE1373C4C13AC5DB0175A61A43724AFAB4708972929FABCD436D2FB66C2E3663C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620938, "uuid": "a6d6ef38-0e9e-45ec-9455-d758a8cdd59d", "value": "9957bfdb6f7078196a235a87cd0fe46b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620938, "uuid": "77843d29-2ab5-4453-9ffc-8a9af76f8edb", "value": "6144:JHsXmHCojK+JCtIGoPLOy0/Ffm2R86YLP8fid6/qlPrX8:JHsXLoe+JI7oO1/F+2RfYL+itlPr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650620938, "uuid": "2edb8ad3-57eb-43eb-8a67-23da714dba1b", "value": 362496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650620938, "uuid": "27d081fe-b0b9-4a21-874f-db7cabf579d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620938, "uuid": "29635236-0929-4564-9a9b-3399f1ac37c5", "value": "SecuriteInfo.com.Heur.10200.4484", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5df03915-c213-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650614897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650614897, "uuid": "58b9634f-aac5-46b8-aded-a4a0ca82314c", "comment": "Malware payload (Mirai)", "value": "fc87429f50bcec3798cf8128ec72bf41", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650614897, "uuid": "a97748c8-4a59-45f4-9ae1-3d786149f4c0", "comment": "Malware payload (Mirai)", "value": "968eda436c104326ee405f0efc3382ea70075799b9aa5667165af11124acf1b6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650614897, "uuid": "db925dc5-5e45-4efb-a2c5-6e093fe08053", "comment": "Malware payload (Mirai)", "value": "3183d5ca731126e99edd53b06061423f9522b659", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650614897, "uuid": "2b28f97a-3ac3-41f0-aff8-617ab691e0d2", "comment": "Malware payload (Mirai)", "value": "9952816f2b34bdbe87d7080c4b42b68bb46a206b3031640f42dda68693d30fdfa39d3bee2dba5840a4aca98f05ee93f3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650614897, "uuid": "f24987e1-4c0a-492d-ad35-cbf41e9a09dc", "value": "T195539119BF650FBBEC6FDC370AA9270524CC651B21A93B397934D818F21B25B59F3860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650614897, "uuid": "70517d97-e774-4641-b7a8-c7e6f9a5c9ca", "value": "768:jdan27FfaOMcS6uwMiUyJwReG5GyeweVKe/O4kR9DXiLwF1d3:jd+27FfUcI1xBxIKiO4k/b1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650614897, "uuid": "3813d832-00a5-46e7-b698-1a8e33d976fd", "value": 63356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650614897, "uuid": "d452447d-46ae-48ec-9595-be8f7353e1aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650614897, "uuid": "3ab8a5c8-ff69-4d77-8263-c9dd0a3ab549", "value": "fc87429f50bcec3798cf8128ec72bf41", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5e1baed-c295-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650670987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650670987, "uuid": "1e8afe97-6cba-4590-877e-ded11b8bb218", "comment": "Malware payload", "value": "1e8ab44c3023def06c0f68cfe35e29f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650670987, "uuid": "e25d2d6c-02ae-4a00-9222-06c40045d0eb", "comment": "Malware payload", "value": "981cfd53d3d553cf52c326636c287332afc4d987407e4dfae5f8a90b14d0ecb7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650670987, "uuid": "02d2a6c2-e927-43f7-bd93-f4fd8fc74a19", "comment": "Malware payload", "value": "e64e41e09f4e7c09629e42a552746a773e00d494", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650670987, "uuid": "dc90dd12-d52d-4f63-9161-a28f299d37df", "comment": "Malware payload", "value": "f94f7c42289d99536c79c1dc4279f52780509ead303e7c4d986f97930b7dd82bab78e373675015a2f4ecf9d588cd4d72", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650670987, "uuid": "2708268a-01d0-4fa9-b51e-83f71bd17a56", "value": "T11ED49D11F6AC80B5E07BD13DC9A3875AE6713C9847B943C79255EB2A2E736E05D3E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650670987, "uuid": "49ab40eb-602c-4e4f-8572-d096f285e849", "value": "6ba79cbed2acbe9b8ecc8e14a572f100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650670987, "uuid": "836b1e76-05e7-4f95-bca5-0a75b41c69cc", "value": "12288:C1FIcocJwMTHzXO7N2fBHiyzskF1CubVnmn:tco9MTHzXO7Ni/115mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650670987, "uuid": "06166da6-f146-4465-99cd-25ab4346518c", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650670987, "uuid": "40707023-8b37-4c8d-a6f0-7fa516223062", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650670987, "uuid": "eec3ec78-1cd5-4159-91f2-20368e3298db", "value": "1e8ab44c3023def06c0f68cfe35e29f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32f068d6-c212-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1650614396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650614396, "uuid": "014ad40e-7db3-4d89-b2e2-95df0dfd5f47", "comment": "Malware payload (SilentBuilder)", "value": "417d46771c48f7670d32013ab6b2f201", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650614396, "uuid": "51839acb-bdb8-471e-afe6-23617674e641", "comment": "Malware payload (SilentBuilder)", "value": "98b02812e0a70abc3fcdd8e75e8da7639dc9450a27da5e94a526d3501edf3fcd", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650614396, "uuid": "aa847c46-0a05-4d05-b566-f63ebd2af0da", "comment": "Malware payload (SilentBuilder)", "value": "cfe4af35a9969b3b46d9e629f00238c10cdca5b3", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650614396, "uuid": "8c750fb7-1c17-4ffa-a4b6-937a99e062e0", "comment": "Malware payload (SilentBuilder)", "value": "f55fb354d2d7fabd2f62e1a2abb432b9c3d6ff7e088c9e07d152371ae1a0b75fc131de8d9d1b13ae4a2054ffcf7af42a", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650614396, "uuid": "4d53d12d-83ae-4fae-ae18-82a1a1a273e6", "value": "T10423B646BA5D9859E9258B7548E743E9B333FC201F6B0B833616B3257FF49E05A03207", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650614396, "uuid": "ff9abc3a-5ee6-4df1-8e7e-2b6995f7896e", "value": "768:4DM52tfQXi8vgLZkTOHkQT51Vp6AwPdM8gQ6JT5X6DGwUdh+pqjeSLjcvLtzrxFq:462tfQXi8vgLZkTOHkQT51Vp6AwPe8gP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650614396, "uuid": "7da7f124-e869-418a-bbac-706c2d9cada5", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650614396, "uuid": "496c6dbb-d888-41a9-a8e4-cfc495f2dd92", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650614396, "uuid": "fb51c952-e883-49b4-a856-369fd6efa76b", "value": "Rech 2022.22.04_0957.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b0bac01-c24d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650639669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650639669, "uuid": "6e2e0d75-5e66-4781-af0b-626ece00c90b", "comment": "Malware payload (Mirai)", "value": "21c3124251d346ca4e4ec92ee2ecc7d4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650639669, "uuid": "3953afa4-879d-410a-9309-912cbf5cbb58", "comment": "Malware payload (Mirai)", "value": "9bfae8b4936a3a8a5b621411d39e2c9546e0f38b070373e35a8ebe3258db200e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650639669, "uuid": "dd688a67-b03b-49dc-a8bb-9dc7c181a30f", "comment": "Malware payload (Mirai)", "value": "44b6749088df48ce48f4fc3b317b4dfacfeaa9e6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650639669, "uuid": "5ab3b1d2-f4fc-41b1-b8f0-164c951d2557", "comment": "Malware payload (Mirai)", "value": "1d2cd56a2da07103ba0071f74c7d98f2c89c3d0b90dff06d4986a663fa94294367d0d017553862b8973941a9b92d99e7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650639669, "uuid": "708b3dc2-f8b7-466d-8603-3403f000b5b5", "value": "T15AF2E09053A58DD6EE36017888ADBD0A51B0222EC8450D545BDC393AEB9FFBF1DD82E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650639669, "uuid": "e4046544-42e1-4d04-b8f3-00c6b52719cb", "value": "768:GXtzx7DGGawr1AF4ilXhWcIXy/gOH2Npt2WY39nbcuyD7UVyqP:GXtRawZIpRWNzYNnouy8sqP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650639669, "uuid": "dd1a4876-5c0d-4126-82f3-07f518243845", "value": 36732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650639669, "uuid": "29513333-7903-4494-9ea0-67769ae9c927", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650639669, "uuid": "b226b1fe-76b8-4be7-8998-da69f7933b55", "value": "x86_64-20220422-1501", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2bda5eb-c258-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650644729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650644729, "uuid": "b22fed3d-8fb5-4ac7-9f3f-79939b37c18f", "comment": "Malware payload", "value": "a7486ada0a9f9c8c2f06886b26810135", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650644729, "uuid": "f45edb2b-07d2-4c03-be9f-5b713b803e73", "comment": "Malware payload", "value": "9c528258677701a47fcd65ccddc4f0d688cf68137c724a78944fdf19370cce0f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650644729, "uuid": "63d60827-8438-4700-8d01-329a34399401", "comment": "Malware payload", "value": "5225145761884266ae96bd2d9738f8f63b7c743f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650644729, "uuid": "889c2f43-e4d4-40a0-b081-156903f28200", "comment": "Malware payload", "value": "dd3e2a79606b3c58a8d7ae64d64f9d55ae617df01f431998bdd165d8b414f67e70101e8e42d37209a377770f9ab500c1", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650644729, "uuid": "e4757b07-1c02-418d-97ae-75d0fa42e1f1", "value": "T132D49D11F6AC80B5E07BD13DC9A3875AE6713C9847B943C79255EB2A2E736E05D3E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650644729, "uuid": "a0bd30e9-8acb-4cfd-82ea-04ca0f882564", "value": "6ba79cbed2acbe9b8ecc8e14a572f100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650644729, "uuid": "12f34f8a-ba0f-4c99-ab2c-f7c41061077f", "value": "12288:C1FIcocJwMTHzXO7N2HBHiyzskF1CubVnmn:tco9MTHzXO7N+/115mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650644729, "uuid": "a5ee21fc-d6ec-47bd-b732-a789d013ef5b", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650644729, "uuid": "7e568884-351c-4200-b188-f3fd5d386826", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650644729, "uuid": "9299c632-cbdd-4de0-9e8b-d196b0fb49e3", "value": "3fUqvsN4.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c01f8d45-c283-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650663166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650663166, "uuid": "f5e3e6f2-ee6e-4b1c-b725-bd035503f18f", "comment": "Malware payload", "value": "9a0adaadb9953ad3795e5f7c729c8c73", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650663166, "uuid": "7dde2659-a10d-4aa0-a4ba-421646ca92db", "comment": "Malware payload", "value": "9dae403f212ae5bd6b6565b4bf05cba88175b5917fb09d980d74e267bb4cb001", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650663166, "uuid": "b74bfba3-9a53-4b8c-9d88-b16be0d73255", "comment": "Malware payload", "value": "c670bef8ff137960e7d053e24dcb1ea6b53510b0", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650663166, "uuid": "a4afb33c-3ba2-44be-b0f1-a519db8da7ba", "comment": "Malware payload", "value": "ad931dd2a467079dbcf8662f9b529a638840acf2a0f993e23a4cdb068a7c23e6dac1c2c3f72747f0d010da72be82059a", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650663166, "uuid": "36c207b7-12a5-4999-ab04-cc064ab5ce0e", "value": "T166F32379DC17F20FF32790B634D370A12BE566C8D578D90CA141E748A19BCC4A9AF1BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650663166, "uuid": "c0aca003-db15-420a-89c3-313dd3008b53", "value": "3072:lSa1l9f0ZonVymDlm5R7/A1DOUjiCjXvwIW9+Ga/d1J4+yS:Bl9q0fxm5qe6XIIa+H/+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650663166, "uuid": "4079d142-1c18-4366-abe4-020fea863c5d", "value": 168883, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650663166, "uuid": "09cf7f75-d73a-48a0-852c-37233d652e99", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650663166, "uuid": "4ce54976-f573-4c95-a08b-42c33e632d7b", "value": "WorldDownloader-forge-4.1.1.0-mc1.8.9.malware.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d36a03c-c289-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1650665577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650665577, "uuid": "e8c0faea-03f3-4795-af4e-5a072b1f26ff", "comment": "Malware payload (Gafgyt)", "value": "1267d92d608a669866e2145a1c4ef05f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650665577, "uuid": "30ace45a-38a7-442c-82c9-de496821a6fe", "comment": "Malware payload (Gafgyt)", "value": "9db9aef49b1c8bac74cd33a5f2de13200b6e6aa0cb2483a99ffaf858cb76d9b8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650665577, "uuid": "28c8cd11-3288-4663-aa92-ec1e72628bfc", "comment": "Malware payload (Gafgyt)", "value": "23c64c60ee50beee3ba6bc9b109074531b1bdad4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650665577, "uuid": "a3edf7ea-6d27-4742-8794-31ae26bf417f", "comment": "Malware payload (Gafgyt)", "value": "c14eb8536ad5ccbb6e1570d7bf1b211126c155f9216fb55b54ab48f7baac6272c719316af678c6997e0b510a1ba933c2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650665577, "uuid": "9a41cacb-14b7-419b-b242-cd6cda4d36cd", "value": "T14F835C03AC664F77C043A9F925A759314B13FDA30B6B274671389DF40A875CEB81ABE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650665577, "uuid": "93a67907-4ce6-4583-9980-1e292c61eafe", "value": "1536:cmbMTBvKFdlz53jhHJkyAlbCJ5hQk+XzgByfhdV6ZLzQfSP6:f4TByFNjhHUbk5hQk+UofhdV6ZHQfSP6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650665577, "uuid": "c4bdb95f-fb08-4058-972d-8027d49b50e5", "value": 85545, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650665577, "uuid": "9fe4df80-3abf-45d3-b40b-f19ee76c6d50", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650665577, "uuid": "95b14158-e114-413c-8be2-9fad1b1798a2", "value": "1267d92d608a669866e2145a1c4ef05f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6efe4cc-c290-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650668707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650668707, "uuid": "67b84016-c231-4777-aa88-e5e03ff0853c", "comment": "Malware payload", "value": "822c13e7756baed9fa487c7da348084d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650668707, "uuid": "1e6a984e-1dd6-483b-b736-5a7867ab9feb", "comment": "Malware payload", "value": "9dc209ab187341dacc6e6a9bdd6082b3b0a26fef5c040988980d07cd0651c42a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650668707, "uuid": "ee6123c6-ebe3-4da0-8f62-eb7d94c51db1", "comment": "Malware payload", "value": "c6c43cb180fe8a457961db8174be63e73d4ab75c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650668707, "uuid": "dc96fa08-b133-4030-b72c-3f074c37ffc1", "comment": "Malware payload", "value": "c64be1ea4715620182ecd5267c04772fd88ac22864f901ded9bec2e7b03877203e9f79bffc509f35df32ee9332066b52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650668707, "uuid": "64e66a7a-5e5d-4f49-af39-9bff810645ed", "value": "T1AED49D11F6AC80B5E07BD13DC9A3875AE6713C9847B943C79255EB2A2E736E05D3E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650668707, "uuid": "7c06a326-489f-4464-bef5-91211be5a23c", "value": "6ba79cbed2acbe9b8ecc8e14a572f100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650668707, "uuid": "49a7bdca-880f-497c-b247-e16d7b280663", "value": "12288:C1FIcocJwMTHzXO7N2EBHiyzskF1CubVnmn:tco9MTHzXO7Np/115mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650668707, "uuid": "d8e31df1-d4b3-4a1f-a415-43b1bdc6a831", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650668707, "uuid": "aef80f25-dba6-4fb4-88f1-ea7a15cd0eab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650668707, "uuid": "04a707ad-1619-4c7b-9690-9a33e14bce2f", "value": "822c13e7756baed9fa487c7da348084d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "786396b9-c239-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650631263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631263, "uuid": "87cc8ba1-3224-4187-81db-ab633d83c0d4", "comment": "Malware payload (Mirai)", "value": "03af132f78b8f10ea6c8702c6e563648", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631263, "uuid": "9c995b90-ce72-4cd5-b435-c2e332bcd2f9", "comment": "Malware payload (Mirai)", "value": "9e527c0872d07f5fddd00dcd5a518d2e5615f86cdd35013ef87bc8704a1798ab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631263, "uuid": "3cbb1ade-4b8f-46e6-90b7-808a10c6af01", "comment": "Malware payload (Mirai)", "value": "efd7d4086ebc38327b5a13e1421ce97db678d293", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631263, "uuid": "0cfc6343-ce6f-44f6-a39f-e686cdc48552", "comment": "Malware payload (Mirai)", "value": "3021e296f0570bba8527104b6728ba7bd14cfb7369688d68148b3dd6b85a60e5c757f4aea2dddafc25dcf569f2a99161", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650631263, "uuid": "595c5ba1-5296-4f3a-a6ae-dbf473035bcb", "value": "T1BBA31997F800DF72F40AD67204D74B15B670BBE24E932622731739A6AE722D53823F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650631263, "uuid": "91364cc8-696b-49a2-920a-bbe253275d25", "value": "3072:wx+I/6nsw7M7ye0Lvgf3lJ3KtbmuxVqDr78fz1e:wUI/6nqyecgtJ3KtbmuxVqDr78fz1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650631263, "uuid": "56f57d98-2e1f-4acf-87e8-df8e1baa8afb", "value": 104224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650631263, "uuid": "5ccadf88-5933-4536-9a68-336c9ab3fa34", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650631263, "uuid": "006f6885-676c-47c9-b8d3-ae20d8d7ff33", "value": "03af132f78b8f10ea6c8702c6e563648", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf270ef6-c203-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650608215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650608215, "uuid": "f358ba1c-b8c9-4582-bc39-a8f11cfd9276", "comment": "Malware payload", "value": "7f09dffd1e426fcd973c82ad91908ec4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650608215, "uuid": "4560b655-bc6f-4b75-b311-1475325c508d", "comment": "Malware payload", "value": "9fe0bc72c5f016e8008e1cd2c99c2200df020b0fb64b38bff0f5595fc95112f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650608215, "uuid": "37ef3534-e527-40ef-9e6f-9a2df15c29de", "comment": "Malware payload", "value": "6a5531e059030eb2b25894359c5324cfd392bf25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650608215, "uuid": "add4c9fd-8077-4f1a-a9d1-9bf10ac25204", "comment": "Malware payload", "value": "5da75b5b31667d94223fbe26147ba954175435dd349f546b2c3e8ce58c7997f330e0318148d8ebcb5d525668ca4d8855", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650608215, "uuid": "bdf00263-ddda-4b71-b897-9a85cb430e82", "value": "T1EF23F61628915629C5E47BF868B0629753366CE60124C28BFCFD7F29AF72313DDC21AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650608215, "uuid": "03bf0ca3-0c8f-422b-8af9-8620e0ab4a50", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650608215, "uuid": "2330fd33-9d97-484c-a794-4bba5396f89c", "value": "768:fhXCFXWdclMMwCKa3deVD+ztYcFmVc6K:fsRWda30VD+jmVcl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650608215, "uuid": "db1f09b6-9406-474b-8669-dfa415f7ff49", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650608215, "uuid": "d7b5ceec-bf52-408a-be0b-d43e5bdf75c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650608215, "uuid": "326edf50-70a7-496a-bf5c-56194309704b", "value": "no. DGBM0052U12187DQNAWS220405859.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cb278c3-c269-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650651832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650651832, "uuid": "60cec2d5-6405-4437-957e-fbc74c55cd97", "comment": "Malware payload", "value": "6885142918413739d76131c85dad6c2f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650651832, "uuid": "f00b42ca-12f7-4b9f-85ba-39f30bd51579", "comment": "Malware payload", "value": "a036890d9758a12d7ce44372cc59b603a6ba4a121fe00bca1a27b9f2f5ef091a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650651832, "uuid": "ee9c2958-d8c0-41cf-ab2c-6f2b3b5c27b9", "comment": "Malware payload", "value": "9fed2fbcabf8906114693f8f305fff0063c1e965", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650651832, "uuid": "4da0bfd5-46ce-46be-9c2d-3ea961c5ab58", "comment": "Malware payload", "value": "f341511a744678edc6737b692f11c8975d7a7b30853f0780463af61ebdf78ff7c53502882e46c5719cd7c46892b462fc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650651832, "uuid": "7f9394f0-784f-4b7a-a1a0-c58e01aaad87", "value": "T193D4CF1176D1C07AC1AF12715946D39E73F2EA508FB99A837FD00F2E3EB81939A38255", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650651832, "uuid": "a459c118-a7b0-4893-aa9a-7253c91a9fd9", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650651832, "uuid": "8c2023a5-f0e6-4969-ac56-6d0c1772f2ee", "value": "12288:g6O4TpP0XjxCCFJuf07j+Xk7hc8rLneTfABCJoWRWwfps:BeCCF88j+X58OTYA7ps", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650651832, "uuid": "f16ea946-7758-44fd-9afc-8d0971040a2b", "value": 655280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650651832, "uuid": "a727a07a-fc5b-4459-b48f-a63b47c0382c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650651832, "uuid": "5c5266eb-4cfa-4986-8e90-abe5d3ad72ca", "value": "emotet_exe_e5_a036890d9758a12d7ce44372cc59b603a6ba4a121fe00bca1a27b9f2f5ef091a_2022-04-22__182344.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ba01744-c25a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1650645441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650645441, "uuid": "a7314591-41bb-4c94-8c97-fa35645f831e", "comment": "Malware payload (Formbook)", "value": "9930c7ce66492907351a69a44dae1c3d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650645441, "uuid": "cfe3390c-3886-455c-a5a4-fcad6be02e9e", "comment": "Malware payload (Formbook)", "value": "a086b9d9deac0634ed22d5556aeb9616922d530ba2651c94bff0c87fbc0a47ef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650645441, "uuid": "0ecedfb8-39b1-4185-b9e9-5147634e750b", "comment": "Malware payload (Formbook)", "value": "3472e3b0f37095ff1f3ff5f9e22487391f730a98", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650645441, "uuid": "63567e97-1e25-4458-afd7-14c67c0e4049", "comment": "Malware payload (Formbook)", "value": "3937d72238c70093734be7bb309886628340f942fe5b54d57488520a1ba5c030399457acde2032924094c7d4012c1463", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650645441, "uuid": "4a5dfc9c-ef5f-4c3b-b3eb-b11c184f979a", "value": "T1A5E4120033CB9B41C9891EF4C0D3192023F2AE9B6577D6063AC5A2596F163E5CBE97DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650645441, "uuid": "7ef2aba9-2950-48e9-9742-11c6f59a4253", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650645441, "uuid": "45746a39-8dff-4785-bf09-f66a1cdd0302", "value": "12288:eMg1Z8YYzfuTRm6KAJjDTFaxPHV3GX24fXb+H0TTeu4:etZ8YYzWRfyftG5DDTW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650645441, "uuid": "7a8593f0-7ae4-4627-85e1-15308bee2b36", "value": 678912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650645441, "uuid": "b07a8c4f-e9f2-4863-93ec-d9124361f230", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650645441, "uuid": "fd1833b6-0fca-461a-b8e7-a8943e623439", "value": "9930c7ce66492907351a69a44dae1c3d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "739f115d-c257-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650644139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650644139, "uuid": "3d75e8db-9565-4c98-af7c-2db62740a84b", "comment": "Malware payload", "value": "87fcd59ef01f015e881c9c6723436bba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650644139, "uuid": "79131d80-9f3a-49e5-a575-4a8cab8bcf02", "comment": "Malware payload", "value": "a08879c1080dc1203fdc6249433fc3787c81fa6a7165cd65c77283a11bb585a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650644139, "uuid": "6cee7093-bdd9-464e-ae83-8302a674a71d", "comment": "Malware payload", "value": "1a2842a50528fa92b7ed2ec475c2d19b95396c98", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650644139, "uuid": "90a353dd-21c7-461f-b1c7-f7f055836b05", "comment": "Malware payload", "value": "6f1fc7b2db723af3838a537b5d96f0cd8715481362a1d4e6b25b36f8d0d7a189a50253f4c0ecff2dc3de7150d4578b15", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650644139, "uuid": "7d0db643-732d-4844-812a-8488b8283af2", "value": "T12F830A41FD418B17C2C327BAF79F435D37356A6497DB33016A386EB42BC67982E29220", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650644139, "uuid": "77c10723-2bd2-4678-9af4-6c6ebc7fccb6", "value": "1536:2TxGIBAIxQJ8x5OEVBvFB3n1U8OYSUmZhBQ4Kb3RXFFj:WBa8hBb3y8OY5mZhBQ4KjRXFFj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650644139, "uuid": "c7928df1-7926-4bb9-bed0-61246e07fd6e", "value": 85249, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650644139, "uuid": "d5f1a31a-cf33-4c96-8adf-9660588cd7c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650644139, "uuid": "c07ce3ef-a877-4f74-8bef-1d0d57ddbbc1", "value": "card.o", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c68ad996-c257-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650644279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650644279, "uuid": "599068af-37bf-43e2-ad7a-3fe3cdd5fee6", "comment": "Malware payload", "value": "29d066c99a214f30787af490343e5d6c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "superh", "colour": "#ED86EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650644279, "uuid": "8a3bda83-f10d-4a2a-a4cf-c4a3c5727f50", "comment": "Malware payload", "value": "a08d3414f8b84be6f1d7d2b71a2f307e0e813c68a66c3a369cecc1a3264d89fd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "superh", "colour": "#ED86EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650644279, "uuid": "75b1abbb-26a6-4d90-bec1-af44e952f2b5", "comment": "Malware payload", "value": "3181635ea7bb1e14b23e59e57424d9728e1ecae3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "superh", "colour": "#ED86EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650644279, "uuid": "c194ba5d-3567-45c0-ad8b-fdf98ab989c5", "comment": "Malware payload", "value": "0d07a93f751a899908bc80d64a1499f3b5bcc1260f529a4acaea0fde12032281dc8c393bac6a1d9513bcc73187f1a903", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "superh", "colour": "#ED86EE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650644279, "uuid": "a93b80ff-546f-420e-b1f1-f0b464557f37", "value": "T161732A03A8619FB7C0876EB525EA5E300B17F8911F4B1B46717DAAF4064B6CDB80EB74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650644279, "uuid": "d5572417-8eb8-400e-9cc1-6856e9db468e", "value": "1536:HcluQ/5eIffAuKFmhFmrS6CtWqvqLbxmPO0VPYLDzf60X:8lt/0I6I/6a6mG0VPYvzf60X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650644279, "uuid": "6584ea7d-6702-44fc-8e4d-b7f9efabf361", "value": 78576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650644279, "uuid": "927a6ac5-7e24-4adc-9c2c-12f77fafe1fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650644279, "uuid": "184f030e-6ced-4f80-b1ca-36057f053511", "value": "SuperH-2.o", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbbb6e8d-c1fd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Worm.Ramnit)", "timestamp": 1650605606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650605606, "uuid": "68078bd4-44ee-42eb-9c68-5e366b156b68", "comment": "Malware payload (Worm.Ramnit)", "value": "231f493686386cf4efc01627c675ffa8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Ramnit", "colour": "#8B8B76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650605606, "uuid": "d79aad83-187f-4a12-a87c-a58579a71eed", "comment": "Malware payload (Worm.Ramnit)", "value": "a0cf2db65431fdf824968ec5e5444affcd60614aec5b34fcc4fa6ec69178a0cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Ramnit", "colour": "#8B8B76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650605606, "uuid": "5de17779-9c0c-4ba6-912e-8eb96a7046b3", "comment": "Malware payload (Worm.Ramnit)", "value": "2de3c132972491594421629937cad3847ffd9f06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Ramnit", "colour": "#8B8B76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650605606, "uuid": "3417666c-f7fb-4b0b-9c3e-248a3b6b391f", "comment": "Malware payload (Worm.Ramnit)", "value": "c1a30a28295365ed7751f248b846a3770c9004b617e7912e1e67c18d5e7364acee5cc26db206a9ada755c8074a9cec42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Ramnit", "colour": "#8B8B76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650605606, "uuid": "44ad29c4-9064-4ed0-9bcc-34dee0e1a9f0", "value": "T17A92BFA38FC088FFC4DA367220D33713CB7B493096B965AFA25144773D56A00DC675A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650605606, "uuid": "3c742059-ab18-484d-8d73-a28d67f7d095", "value": "a96d166ab17e011e8049d87211158ae5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650605606, "uuid": "ea981d88-92a9-422a-adbf-7f142d37f545", "value": "384:1FhSiXZQaD7U8iu4YsAa7ZA0UvH2lsRv21yW7GbAxur6+Y9PffPz:02QGPL4vzZq2o9W7GsxBbPr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650605606, "uuid": "bb733624-19f0-45ea-9207-a28f363eacaf", "value": 19456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650605606, "uuid": "bad961bf-101d-44e3-a644-c24be8020495", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650605606, "uuid": "f7086bd5-2ae4-4071-a7f1-d82819d0e724", "value": "ESE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70b6c8ec-c240-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650634256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650634256, "uuid": "a422e2be-fc09-42b2-95f4-a344145b23be", "comment": "Malware payload", "value": "cdbe2fb0b3e2a9e499a8ca2397b0e71b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650634256, "uuid": "e9494e60-f3c4-4bad-a46e-fc2627eddb7a", "comment": "Malware payload", "value": "a0e91bcb989a9ffcd557d5a52740ad1de8c7ae7bb32c47979e190591142eecd6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650634256, "uuid": "bc3f5390-151e-48c9-96df-e12ca520bf77", "comment": "Malware payload", "value": "94e9614050a77d5443fe04e32f4440d4f8ae0dad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650634256, "uuid": "767931fc-dc73-454b-b009-cb79ebc4ac4c", "comment": "Malware payload", "value": "bfa2d66731169bb686495dcf8be4ade8cc6208e6a29cc784ffb7ebb5b29d65749db52d3a88f27d8681b8bdcf8d41a0f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650634256, "uuid": "938c852e-51d2-48e9-ae15-906218ea2173", "value": "T1CAD49D11F6AC80B5E07BD13DC9A3875AE6713C9847B943C79255EB2A2E736E05D3E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650634256, "uuid": "adf2e5bc-2ca7-4db2-a81c-6330a633b234", "value": "6ba79cbed2acbe9b8ecc8e14a572f100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650634256, "uuid": "4f4c289d-de65-41cc-91b7-5e6fa525e344", "value": "12288:C1FIcocJwMTHzXO7N2ABHiyzskF1CubVnmn:tco9MTHzXO7NZ/115mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650634256, "uuid": "bd61db47-65bc-48cd-9ea7-3c654e4a3b14", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650634256, "uuid": "290c74f4-b96f-4d18-87ee-46dec77cf9cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650634256, "uuid": "e5e1fc45-1883-428f-a840-cfff29c69fd3", "value": "cdbe2fb0b3e2a9e499a8ca2397b0e71b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81d68248-c221-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650620970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620970, "uuid": "d55e38ce-09e7-4869-b174-cd18b0e277ff", "comment": "Malware payload", "value": "3a44da096d0df43a37019f063ea3a242", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620970, "uuid": "fd1db1c7-baaf-44f7-aad5-0fd47af85092", "comment": "Malware payload", "value": "a173ce62240b837a2ddf51de6d34f01667f57041acb9b7296ea5f69b7f691013", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620970, "uuid": "0f13d857-9d7b-4942-bc61-cdf0021a99aa", "comment": "Malware payload", "value": "ee4479ae3a436e89f46a2f0bf2117f42ea9b77b4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620970, "uuid": "3f60e874-41fd-4636-bc26-a52340d69099", "comment": "Malware payload", "value": "88d2060930d82a894b591ec489406d4d77bb841304bdeaf75d536be3910df7e63d37e5ead3ca07bc2fdd7214c2427ae7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620970, "uuid": "30ab3f7d-5bc3-467d-8237-17222cd763af", "value": "T1ECF56C26BA446E3EC46B0A3A4937A658993F7B713A13CC5B17F4088D8E355416B3EF07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620970, "uuid": "b77b83e3-aa57-4372-ac84-5d364370bdac", "value": "4831e1860a5df2882b4114737aba5ca4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620970, "uuid": "b722e757-5a7f-41b5-a0e4-adcb03d8e6bd", "value": "49152:80qIimTJgxBNSeM2BCSc9d2tMwKsVSeRHkz5KDQThp2MAt:80TimSLwsxHkzN23t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650620970, "uuid": "cc5ed4b3-b0ae-4a7b-9109-c9678c501e26", "value": 3429376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650620970, "uuid": "bfcd37a3-e8cc-496a-ad52-f8e793296a72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620970, "uuid": "c7803e2a-6bae-4e05-bbf4-8fe99b594787", "value": "SecuriteInfo.com.Trojan.DownLoader44.45991.21693.25868", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60215212-c1db-11ec-8e58-42010a9c0032", "comment": "Malware payload (NetWire)", "timestamp": 1650590849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650590849, "uuid": "93d8a25a-cd0f-4657-a8d6-00b178feab7b", "comment": "Malware payload (NetWire)", "value": "b84eda22e2586aaed37a1d2e0a42889b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650590849, "uuid": "4b980fe9-1bc7-4e8d-8824-241f5a8e7b21", "comment": "Malware payload (NetWire)", "value": "a2700363ab4167505a43f933449a4b25a9036f8fae65e46e28b9bb1ce319e9cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650590849, "uuid": "828e590b-d01c-491d-8d76-81adb99e6da3", "comment": "Malware payload (NetWire)", "value": "b03644bed42cd7cece52bc51907aebe3283e4ce1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650590849, "uuid": "f367b445-6cee-4674-b4a1-5423bd44bd8f", "comment": "Malware payload (NetWire)", "value": "6dcb74180fe4283b1e3d4a648e52ec09f39fb6e4ce6fcb88e726913546755d1074b19d06281ff7260a9093d1dce30caa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650590849, "uuid": "0e1b9f2b-99da-492c-866f-d5f63d7af260", "value": "T1B0456B8A2714E11BE245BA3D44106AB803C74E996C84F7D835EC7FC77476E8AC5E82F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650590849, "uuid": "ee0e23d9-06c9-45ad-bf29-5e3c9e129572", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650590849, "uuid": "c2ac09d4-8fe5-42fc-a247-9eb7bfec2320", "value": "24576:5nE6O/jUfu9J+1/lQjyhC1MafJxAGQs7p:tE6E/J+thCFfJxAGQs7p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650590849, "uuid": "7a4ffc86-97f1-42ca-ab1f-f65581ef8f15", "value": 1169408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650590849, "uuid": "62a60b51-a70c-45de-b706-7dbacaa2c2db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650590849, "uuid": "b70af73e-e607-4e91-b76f-d6ee067f67b9", "value": "84433.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7224a06b-c289-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1650665612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650665612, "uuid": "07b4e88e-3ab5-4e35-83ba-5fe27716c37f", "comment": "Malware payload (Gafgyt)", "value": "a7e128b62fe16cc240df3e6918f4b858", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650665612, "uuid": "7727f29f-3329-446b-adef-95a9c52f58e0", "comment": "Malware payload (Gafgyt)", "value": "a357411f1bb6b69f2aafe2a8475ee09609344ad6068e5e1fc7118d4d2766bddc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650665612, "uuid": "ba9f4b6c-1527-4e13-ad39-cf0412d0dfd4", "comment": "Malware payload (Gafgyt)", "value": "69e9a67cf7ba4aa3d6c730008af3a727b8845a9c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650665612, "uuid": "585d0bfc-9571-4dbd-ae45-ae3671c09ace", "comment": "Malware payload (Gafgyt)", "value": "610d25c74f5fbc0a28d30741e998495a61377a51dd1517477250ea8a2b1636e5dd061e3a2da0a2710b6830ee61fa72db", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650665612, "uuid": "251ebb50-4484-4bc8-ae78-7be777329f93", "value": "T157E34B09F6408B53C0D32776B68F534537239BA5A3DB33069928AFF43FC27A94E22955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650665612, "uuid": "b2227cbc-c916-4264-a224-4fe0840bc2c6", "value": "3072:tdntU2haO5H1XacBoGmh9H5J5hDiGRvEM/9f9T637m5wTsL/Qpyn:ntVhaO5H1qEc9Hb5hDiGRcM/9l+7m5wS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650665612, "uuid": "9c65ccfa-c5b2-4c99-9adb-400d68f7e5f3", "value": 156296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650665612, "uuid": "3198559f-96ca-42e3-9837-2fd42b53b901", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650665612, "uuid": "7fd8b9c8-0cf7-4ad4-9fcc-707b6f99285d", "value": "a7e128b62fe16cc240df3e6918f4b858", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "983f7da4-c21a-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650618002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650618002, "uuid": "b54a859a-d5ca-4bde-8527-4d1b51ae1c0e", "comment": "Malware payload", "value": "3a11f0f45092ac8d89e45d364e1fc9fc", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650618002, "uuid": "574a28b2-f578-4acd-8196-4378cd5d059f", "comment": "Malware payload", "value": "a3840d4e7beb16db8d016d53374263336760cf2749fed621308e41efc30cd7df", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650618002, "uuid": "615e772c-0be6-4266-b10f-98467635898b", "comment": "Malware payload", "value": "38ca9bfe3853064f693b9703d84acafb9e89bd8d", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650618002, "uuid": "42a3d662-baba-4959-a5cd-b2b710b9a4d0", "comment": "Malware payload", "value": "391938a48a908a8f773139db5de3b8440ef78caef5d05c021ac546d7541971cf3accbb4f481c9fd38d3c2ae8c03718ad", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650618002, "uuid": "ae8a6a56-4ab4-4387-b7f7-0b6907ffcc3c", "value": "T16D8412812BC3B77BF0AB69F4B704C588596DCEA113BB7097B06E78C61B71ED4295801E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650618002, "uuid": "0c00133d-befc-463c-be11-35fcca390325", "value": "6144:LzdArDbRb5UncVMK93lsOW+LdLWCC5uI09LbkRvsVsRcsrBub41jX5cmzKwaOdCQ:CrDbRtUncVF3+OVZLWCCon/kJqQlubN8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650618002, "uuid": "e2a5d226-630a-47a1-b576-7982d70df1ac", "value": 392704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650618002, "uuid": "668d6622-eb91-4034-8249-89fe03285d40", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650618002, "uuid": "74e95b3c-6376-4fa5-a1ef-575ef8858c6f", "value": "Scan copy 1.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12494365-c233-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1650628514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650628514, "uuid": "234fd1db-5fd2-430b-86fd-705cc55885ae", "comment": "Malware payload (AveMariaRAT)", "value": "b8f7392ae0df1c179327ae80f65ddd00", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650628514, "uuid": "23a29d11-ae9e-4a6c-b096-fa27655bddfc", "comment": "Malware payload (AveMariaRAT)", "value": "a3bbcb8b3a7aca39a9e369b889156f701dfa742c363b07be3aa2ee37c2109f75", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650628514, "uuid": "2df0991f-1db7-4e45-8f25-c215ba796d10", "comment": "Malware payload (AveMariaRAT)", "value": "9e90e7a7963068f93931d3edef81b7f000cdb8d2", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650628514, "uuid": "074a502c-4f1d-41c0-85b0-18c475717ac2", "comment": "Malware payload (AveMariaRAT)", "value": "492e7c51bfd413fb575663acda9e0c37586b5f72b70081b871b6bd361e78e80c4a98381f011044517c17b8f1d2cd1c4c", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650628514, "uuid": "0a7f7c0b-c18c-44f9-a64a-aaac4dbc6f81", "value": "T1FBB412663FB45F26D57CCBFA09A0185187B066E93515E7080CE9E4EF2E607801B99F8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650628514, "uuid": "e570b260-6006-42a3-98a6-68e44cfd2013", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650628514, "uuid": "b1a6daf4-1174-46f2-924c-ee628fd5a58f", "value": "12288:jvAYtv/h/+/MsXdTQbIQd32V8/IFrWwsNeyiKhzY:zBdhe9XdUProUev", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650628514, "uuid": "69354645-c833-4258-b714-5ea0649e58f6", "value": 514048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650628514, "uuid": "b0cff5fe-beb7-4899-a4fd-8a78536e5670", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650628514, "uuid": "9a927e7d-07f7-488c-be10-cebea5d87e23", "value": "INQUIRY-DRAWING.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1dd8383-c236-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1650630044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630044, "uuid": "abdfc02e-b912-4214-9339-b1410c329908", "comment": "Malware payload (SilentBuilder)", "value": "99db67f0ec5acfd84eb0db2767941c48", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630044, "uuid": "5f023bda-da0d-4631-ae0d-8f2303f5bbf6", "comment": "Malware payload (SilentBuilder)", "value": "a4486fffef0a8a89323d6721b869f0a8756ed355fdc8e26e92996454b1a9b4f1", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630044, "uuid": "0c9249a6-4725-40b7-bc57-7960dda11cdd", "comment": "Malware payload (SilentBuilder)", "value": "ac35985eb5f79e7e245b69dd2db7f55e871090a9", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630044, "uuid": "b5457e86-0ae0-48cf-8bc5-d3dffc55c2bc", "comment": "Malware payload (SilentBuilder)", "value": "ffe4e13ecf8022bf5122e84cdaf071d251dd61b3743accea79f22453b6cee39fc013df93173f3152552cc297be3b191a", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630044, "uuid": "ad67aedb-d101-4dff-812a-5668185a3d6f", "value": "T1B923B646BA5D9859E9258B7548E743E9B333FC201F6B0B833616B3257FF49E05A03207", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630044, "uuid": "366226d3-7c37-4d7c-8f5f-487b3cb82be1", "value": "768:4DM52tfQXi8vgLZkTOHkQT51Vp6AwPdM8gQ6JT5X6DGwUdh+pqjeSLjcvLtzrxFK:462tfQXi8vgLZkTOHkQT51Vp6AwPe8gv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650630044, "uuid": "a5acc5de-9321-4d84-8703-6f85164ac4e7", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650630044, "uuid": "e3b1016c-00e0-4741-96e2-32d2f383ad5a", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630044, "uuid": "357ff391-eae9-4c70-9515-d47fd365a4ba", "value": "2022-04-22_0942.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fe981c7-c221-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650621021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621021, "uuid": "e752754e-1c22-4169-bc0b-c1ff9ac58b28", "comment": "Malware payload", "value": "09ca6c748dfa9a7c0f899f0287cb597e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621021, "uuid": "916cf05d-5e5d-48ff-94fa-ddeee8f20ea3", "comment": "Malware payload", "value": "a50162c30dc5014525796fc1aff698e85e91cbe26a5a7acb67858e89b26332b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621021, "uuid": "0c54d905-4f3d-41ab-bc44-c84226f24ee8", "comment": "Malware payload", "value": "e815bf7aa44016da3b938430d1da19f76e6bc27f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621021, "uuid": "8ac8ded5-242a-4527-b262-6cbae1a2c644", "comment": "Malware payload", "value": "8cf563685b66e68be6cf589d1237b74111f30753de39c21009a03accfedcf819f8b4be354c2e91886323432c2e70b9af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621021, "uuid": "3b896819-c644-412c-bd9c-8402d4751947", "value": "T1CAB5121AB5D18A33C0470231594BAB385B75EC380BB14A1367D5BB9D3FB35A4A3B71CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621021, "uuid": "1e12c8a8-1c54-4acf-9d4f-3087108265a1", "value": "c377cf1b13d4701516128f66c2e9f564", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621021, "uuid": "cd0aee92-6228-4521-aa31-eef0c865e4f5", "value": "49152:gNbwAQYDYyeZgaSkMjsrz3FOZ+gXUBuQSGV1OTeqReYYs42R:gNbLYyJaTprz3MZ+KUBLM1SU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650621021, "uuid": "3337313b-a036-453c-8313-8bfdcd23ccb0", "value": 2291949, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650621021, "uuid": "ea7d5bd5-4851-4c33-b1f1-63aebbbdd193", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621021, "uuid": "c375b98a-80db-4248-82a3-8e9977ed91cc", "value": "SecuriteInfo.com.AdWare.MyWay.at.9379.2942", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95d00909-c221-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650621004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621004, "uuid": "a8290a87-5c74-4a6d-ae48-ff75ccd8e7d2", "comment": "Malware payload (Mirai)", "value": "c247415f0b8a5060d2f684376dc297c7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621004, "uuid": "b42d46cf-8483-488c-8ad4-c7c1486403ef", "comment": "Malware payload (Mirai)", "value": "a6408e93695ecd631b55691a655b516db04688be124ef34dab9116f91618f79a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621004, "uuid": "5373944c-cd39-4520-9720-93106168330e", "comment": "Malware payload (Mirai)", "value": "f7be1f3c84fe0bf19f37d62a8db5ea5ec5d961f6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621004, "uuid": "d00bcddb-6ff6-4ece-a675-cf74001363f4", "comment": "Malware payload (Mirai)", "value": "0fe79a8d36ae664bfb225a896d97184fb184625ae65b2a22c92a2bd1e2bded183d82e19e999d735eafabafe3754b7122", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621004, "uuid": "7c0f0e29-3a96-4956-9331-6cf00e98a798", "value": "T18FA2D119B9318FFECA99F5B2C554846963C0B4E20FD5D31AC7836D43615310BAAA0DFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621004, "uuid": "2452b32e-4310-485e-9bb8-2be519881c4b", "value": "384:MKkS+lhSPvMN1yzdYAGwg6OEqfrq+PCEhd0XHCs32FTQVKF/SzFDNyW:izzGzRGtpE8hCPXNGl/qYW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650621004, "uuid": "510e3f30-7a19-4613-a959-269c7b3dc432", "value": 21908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650621004, "uuid": "3b942eaf-e9e3-4641-bdc7-da52845488ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621004, "uuid": "5a8e6e40-b299-416a-8ce4-9ac739ce9df0", "value": "b3astmode.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "332de6a5-c1fd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1650605377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650605377, "uuid": "e4724328-2b61-4930-98c8-5e970e2530b8", "comment": "Malware payload (Loki)", "value": "3a60abae3a4aa9fc0bb1af62fef3eb6d", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650605377, "uuid": "981d865e-034f-492d-92d8-9db57ac5f3a6", "comment": "Malware payload (Loki)", "value": "a8081a2915c0d14dd59d0195efa44b0f5dfdd77741cc0aa84782cb97200667fd", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650605377, "uuid": "9f852cd9-8d21-42f5-b0b6-7326a33751b3", "comment": "Malware payload (Loki)", "value": "dc0cee1d3bb2bb5d63665da3995a5165bde2ba5c", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650605377, "uuid": "87192a67-98fb-45fc-91e7-ef42582bf2d4", "comment": "Malware payload (Loki)", "value": "e0246011dfe0dbabe7f462f92b69020eff8b3b754e5c93fa4e27e434a4f37bd10c960a1dc1bf92939e6b78f358d2bee0", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650605377, "uuid": "2faf04da-3c7b-4876-93f8-2861d4884e48", "value": "T13C93F08F1F024111E94457BD8B1EC09B39D0DDADCC51EEA165B2B976AC36B83C1523ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650605377, "uuid": "980f3243-866d-4994-827f-cd58add17dba", "value": "1536:HWs7A/QDEm7S4ucRuI+yve00dOxKAu9MHmiDBMuiDnoD2qWOJ6:Hy7mOZc+00dOJuYmi9MR0D2qWO0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650605377, "uuid": "992da483-e168-419e-a1c1-55f5912d05cc", "value": 96768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650605377, "uuid": "3073e9b0-2648-48a2-b576-0d8d5848477f", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650605377, "uuid": "31c869dd-b502-40ac-8a4d-4ca9d3d2b99b", "value": "78.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b744115-c24f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1650640690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640690, "uuid": "10e1f6c6-c906-421c-a190-eb4387bcbe15", "comment": "Malware payload (Formbook)", "value": "92fc61ba91bfc893305f7f397f89e33b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640690, "uuid": "458466fa-6a6e-48db-8660-572de9df558f", "comment": "Malware payload (Formbook)", "value": "a871171fbba261b5e76211ee9fe65878e7b824f6fb1ba5c917e2bbb8aeb36e1d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640690, "uuid": "e43c2c3e-e3ed-4239-91e0-3c66b66f80bd", "comment": "Malware payload (Formbook)", "value": "af3455cee9f2d401590b7a648c9a4d07160844d0", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640690, "uuid": "66942ad9-4221-40fa-9500-96bba14730af", "comment": "Malware payload (Formbook)", "value": "72cc371686823d4dbac1a7c1dba622c4fa94997070db03562bca6fc379a2d52dd586329be7667291f8b0e53b5613feae", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650640690, "uuid": "57e80103-e3e8-42b6-adb2-25e96da2337b", "value": "T11D34127C73F0886EEDF8AA363892EE544077DE72654643260E50F848DC7A9B07465F38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650640690, "uuid": "bceddecb-8b99-41a0-aad0-db2a091831c7", "value": "6144:neHZQFBA7KtfbcXsI8kybmVKju520ILYtIjIpB2qVzfmViut7yVcb6:neHCFBHtjcXsI8ktVK3Pct5zfmUuf2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650640690, "uuid": "b66ecec1-6d36-4599-9643-9c0a0a4bdcd9", "value": 236920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650640690, "uuid": "32bf39a1-90f7-49cf-b97c-f527e70b66b6", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650640690, "uuid": "119f8d9b-9eed-4445-a9ba-563f7c099fed", "value": "QUOTATION REQUEST - SUPPLY OF PRODUCTS - DTD APRIL 2022.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27121a9a-c210-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1650613517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650613517, "uuid": "8750f711-f3e4-4441-a635-f7fd88b0ec8a", "comment": "Malware payload (AgentTesla)", "value": "1ffbce058da3305634e4d2d56bf7f17e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650613517, "uuid": "62a30fbb-9c07-4441-a73c-8592a1faa40c", "comment": "Malware payload (AgentTesla)", "value": "a8aa7d49c7292086bd38e39a597ab8babf8991fe463fcbba26ff4cbac5473ed6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650613517, "uuid": "28c78199-ef1c-4716-8983-6456fa7bd654", "comment": "Malware payload (AgentTesla)", "value": "0179176e98104c4079a386ba9bf572cdbd65a574", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650613517, "uuid": "233f4a9d-a0fc-45a7-a2d6-400a0c9bfe6e", "comment": "Malware payload (AgentTesla)", "value": "b7e72b79bdc48328193a0962d7003fc233fd9bb251c3e5e7a55fa94304d6b8a19c353423f3bc70de0eb663da388be6b9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650613517, "uuid": "d6e1c0c5-0b4a-4c6c-8552-920ccfccac0e", "value": "T1A7B47D98765171CFC487C972C995ECB0BA60B4BB470FE38BB0534BA86E8D496CE106F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650613517, "uuid": "5df26a08-85de-4a81-9247-a99e8085d30a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650613517, "uuid": "5687b4ac-6501-4987-8c2e-791c20eec402", "value": "12288:FycBeZcY9htOEdIxBWShP0HRxxE7TrG5vaNGNJcsO6HgohigJrx:FycBevPd2kGCx4Trkj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650613517, "uuid": "51d78fa8-9d07-4233-838f-226b3120d07e", "value": 533504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650613517, "uuid": "e54472b5-293f-46e7-941b-f857d7c6e3fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650613517, "uuid": "a9ea3821-e39e-48c4-ab57-88fd4e2f9677", "value": "No. TIM-0372022e-I003.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4536135-c216-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1650616358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650616358, "uuid": "1f477978-c91a-479b-8282-5ec9cba17a9f", "comment": "Malware payload (AgentTesla)", "value": "afba93557618e5cf3cc1ff3da8cd30a4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650616358, "uuid": "9792bee9-507a-4db1-b5a1-535352d9a57c", "comment": "Malware payload (AgentTesla)", "value": "a9394c83b0d854b8f5de050acb34fa7d06cdb1ecf5f515b2de51425df135d0f2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650616358, "uuid": "b94341ef-741a-470b-894d-1fae6488fc2a", "comment": "Malware payload (AgentTesla)", "value": "88d41b08432774c04379525f7f6d183dfbc34814", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650616358, "uuid": "07df97fb-15d9-41ba-8143-bbaa9e3bc7ab", "comment": "Malware payload (AgentTesla)", "value": "f7da795dc9da3a35215cfbdeda444cf9faf3b9eab9d6cc311ec4c6d417052d12a1acf05d32ba3b399f3d9380b519c5c4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650616358, "uuid": "522e56e2-749a-437d-9fb9-3990a235ad5f", "value": "T186C42302F2D42B21D6BC8FF55C901A819BB2B06B6415EB081DD6B0DF2761FD02F5AE93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650616358, "uuid": "b77c8403-e2da-4051-82f9-3b25e28ca4b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650616358, "uuid": "a1778e04-8aac-4189-b67f-6012ec5a4e2c", "value": "12288:CtAYtv/h/UUOPvt/dfUS4xh0wQcQFGn8u90PzHrWxY+TYzmwmx+:GBdhT8nr4xWvcByzJ+T8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650616358, "uuid": "ecdc16af-75df-4174-bff0-ad837229f981", "value": 565248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650616358, "uuid": "4d51b8b8-59f3-4ba5-9789-b7826844ff47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650616358, "uuid": "2179088d-41b7-423c-a84e-becb63b928c8", "value": "PO32427.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "536fc361-c25a-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1650645374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650645374, "uuid": "47dc5906-8d17-4f94-bcaa-d5fd5dcff112", "comment": "Malware payload (RedLineStealer)", "value": "3875f4b869e6594347f3f4cfe85280c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650645374, "uuid": "b8c8b706-16d8-4c0b-803a-db3b49add4f1", "comment": "Malware payload (RedLineStealer)", "value": "a950b41d10445e9e6c165da49cef439da7295cf36a8e7bf0e151c51d99cc4897", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650645374, "uuid": "b945ef9e-58c5-4286-b6d1-301528c41d40", "comment": "Malware payload (RedLineStealer)", "value": "a1a26d46e4461ef1a05d1fe66b85e9db3ae1b161", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650645374, "uuid": "27f0d385-761e-414b-8178-2f4127acebf1", "comment": "Malware payload (RedLineStealer)", "value": "323489aeca6308debcdcde3813aeddab4dc69397bc67d42b345a432caf2d18acf3849290e510a57cbd93ae60df99f1d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650645374, "uuid": "ede7c25c-cacc-4971-a302-03433293cc1c", "value": "T140549E407BA0D03DE1B712F4797993AD742A7DA19B2151CB22D63AEF56346E0ECB4307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650645374, "uuid": "91f5c0cb-be37-4141-8ae5-219315a44ae1", "value": "3adf71d778205c50d9efa7010af4b923", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650645374, "uuid": "4f41ac51-f178-4ade-ba75-dd5790ca64b9", "value": "6144:oAkQPymCH1mliEIbTBsA6sDpQ8hb6bzJoliF:LVymCVmlVIbTB60px", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650645374, "uuid": "bc2cfd69-2968-4ab6-9adf-1f936b7b9a84", "value": 298496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650645374, "uuid": "03714228-9a72-43eb-970c-49c9d8f54254", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650645374, "uuid": "20339eb5-6cd5-4232-aecc-5c52c6b7604f", "value": "3875f4b869e6594347f3f4cfe85280c7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa30ba1e-c221-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650621038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621038, "uuid": "7db2fea0-991e-4750-94d6-106d4e66a8ca", "comment": "Malware payload", "value": "bf06dc3b7e784c8c06f22a43efe6737f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621038, "uuid": "38e2454d-0ac0-4d98-b142-94203284a226", "comment": "Malware payload", "value": "a9fb5d57ba105f5a9c4853a05b31469d8ba9e770de9f7fb25466c6a5050ccc84", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621038, "uuid": "82a8ad4e-1b42-4ab4-a4f6-d4e0242c3918", "comment": "Malware payload", "value": "f9625c5f79ab787e7b182f9348160ffd3a609618", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621038, "uuid": "dba360cb-e790-4f1d-997b-1ae078b3e498", "comment": "Malware payload", "value": "41bde2b82d26172a127f4df40cf8b492cb1ba11b68598fc322a57f420313c355d297a4add2fc09ef6a05cb535310d4ae", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621038, "uuid": "764a5b9e-7fe6-426b-b723-6697f7dd1f37", "value": "T167565C13B384753ED46F1A3A5A77E654A93F7BB13912CC5B67F0088C8F358816A3A607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621038, "uuid": "db9651f3-2486-4ad3-9fcf-508a46b10d39", "value": "7d0b3b4b3ad6e9c730c97c285f4f23cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621038, "uuid": "c10c484a-d872-4fe3-9247-6a676aac4150", "value": "98304:FS3gdtuydiQEurXgpJRHvzqRFeUNdbf8:YgdBrbRFemFf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650621038, "uuid": "8fa6f419-addb-449d-bcbc-1b67f3f34870", "value": 5966336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650621038, "uuid": "29a774c8-6a30-45bc-b91c-16be5b9729f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621038, "uuid": "31e48276-154c-46ac-b3c9-4b08f46b83c0", "value": "SecuriteInfo.com.Trojan.DownLoader44.48340.4748.6517", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48be47ab-c221-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1650620875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620875, "uuid": "86b19042-2c32-4405-b05a-025c61915b0b", "comment": "Malware payload (SilentBuilder)", "value": "cf65fc1c769ef55055c3c8d8ea014973", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620875, "uuid": "112f6459-662e-4d0e-b56c-75ecd12495f6", "comment": "Malware payload (SilentBuilder)", "value": "ab2acd1cf1deb951ff8cf8b59a9593609e59ca4604f1a41e11c2fae5044a48b4", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620875, "uuid": "a4149125-6f8c-456c-b3b0-51185b302382", "comment": "Malware payload (SilentBuilder)", "value": "32cb93462e0d63c7535177ff3303e7b451c5a3e3", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620875, "uuid": "4bd26c86-f997-4d50-90d9-986bee997361", "comment": "Malware payload (SilentBuilder)", "value": "34cda03dd1920b4534ab6014e2ee1fa3e2659fb7aabfc4b0c9a15c9b96938fe241527b9f5432e09a15bc6105010ff84a", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620875, "uuid": "b298f858-1d16-421d-909c-1a7010b5fc11", "value": "T1C223B646BA5D9859E9258B7548E743E9B333FC201F6B0B833616B3257FF49E05A03207", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620875, "uuid": "6fc327cf-4716-4d40-8dc4-58b82a03df1b", "value": "768:4DM52tfQXi8vgLZkTOHkQT51Vp6AwPdM8gQ6JT5X6DGwUdh+pqjeSLjcvLtzrxFa:462tfQXi8vgLZkTOHkQT51Vp6AwPe8gf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650620875, "uuid": "fe934718-c879-4f9d-aa72-8c2f3a69a220", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650620875, "uuid": "f7d9440b-3b25-4eb6-8f6c-cf5ddf68104d", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620875, "uuid": "32779c0b-6601-4d37-af87-46bdd9f2ac01", "value": "RechnungsDetails 2022.22.04_1039.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bf738f0-c221-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650621014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621014, "uuid": "89d76dd4-1b28-43de-8502-e82b30febb27", "comment": "Malware payload", "value": "d01ed1f99791f1b455c75627447cb30a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621014, "uuid": "98c0b53b-6c5b-4ccf-ab3c-84e9e27d75ca", "comment": "Malware payload", "value": "ab3f8182bca8c7f9a887bdd482b0c99cc95cf30f797d04b498b2f4cd2f5fd1e8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621014, "uuid": "90f1de09-5a78-4ec8-b961-dc1c8c115467", "comment": "Malware payload", "value": "7ccb95b57e317d709f968571a15462e1b61972ea", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621014, "uuid": "8716ab79-0d0e-413f-b774-bae10c491ff3", "comment": "Malware payload", "value": "93425557894abb2b5e306b15d54e2a71b8dc55e137f4ea1c89dd25751fcfb9de8550fe2246f3d0b01cbd5ee0cc9f816c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621014, "uuid": "5ad60390-7d80-41f6-bf7a-6b4aac09cc77", "value": "T132E55C23B244753ED46F1A7A9637926C993F7B7265268C1B67F0888CCF365402B3E607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621014, "uuid": "995e1096-8983-4fd9-9b3d-6bbde814bf92", "value": "077662acebb7ec6919e85affda448e47", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621014, "uuid": "afec0b5e-2d38-4478-812e-bc1d7430b477", "value": "49152:pEaK8wSqHmnSKY3zSOHGU66AWO9Uxe7LzUTmugst:pEa5fZl7Lzhugst", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650621014, "uuid": "8920315e-0ff7-452c-bd5b-8ef8e1f9a71e", "value": 3037696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650621014, "uuid": "88704c64-c98a-4727-a3a5-ca2dec1f37b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621014, "uuid": "56723d4d-fba7-4524-9d86-e2d99a1da115", "value": "SecuriteInfo.com.Trojan.DownLoader44.47433.1765.30212", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "603d26df-c24f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1650640671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640671, "uuid": "910ddf2e-4dc3-431a-abf7-d818c99954e9", "comment": "Malware payload (Formbook)", "value": "8dcde1bbcd88be91ce5013dc0d878c2a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640671, "uuid": "93550441-a213-4e7a-a383-a0f542610e87", "comment": "Malware payload (Formbook)", "value": "ab90b17b8c542a2e4039a585b7dab4f308126fc7efb0d0a373e4023113ae49d2", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640671, "uuid": "67f64251-e54a-4e1a-81a2-a04ddc554b8d", "comment": "Malware payload (Formbook)", "value": "04635f31bd212bc6db26e4b9ca6d60ba25f90aad", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640671, "uuid": "3de2031d-530c-44a4-8659-d9bd3676a00f", "comment": "Malware payload (Formbook)", "value": "68d5443be98be702020458b907b762830b3075ad70bd9a5a85e124f327aadb5bdbe350696a7e231454abb50b776ec194", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650640671, "uuid": "012a183a-98ff-4d7a-bd3e-22d773d7c0a7", "value": "T131B301C52526B992D6EE6F3A0BBF8DD205580D3F202EBE5688867D5E0DF4B120D34DC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650640671, "uuid": "28b2ed35-e957-4921-b01a-0a633a9d5c23", "value": "3072:8sheA0LHJTyV/yLDuRoJ6qaz/CbEgzWqmt/Mi:5hrAGopkCbEgzLmtki", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650640671, "uuid": "409b276f-6e30-452d-abed-ccb4b94d9570", "value": 115016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650640671, "uuid": "c9bf8739-d79c-4d55-914c-442f0712b966", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650640671, "uuid": "25d6dc42-f373-4258-b0a3-1708838f1313", "value": "belge 22.4.2022.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ff80bf9-c239-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650631222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631222, "uuid": "c572e5ff-6d31-4c80-9ca5-167b52bc31c7", "comment": "Malware payload (Mirai)", "value": "2c388fdf241e8baa8c65b55227ec7e5f", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631222, "uuid": "34bc0def-6be3-446a-8ae9-3c329e35a68f", "comment": "Malware payload (Mirai)", "value": "abf20731cc45f00e41b92e4469391866b01ba2d8986ede6481d3722f40438c56", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631222, "uuid": "26cdad6d-cd31-422a-a42d-ebdff719575c", "comment": "Malware payload (Mirai)", "value": "83101e1a33fd5105a098621f23f65631ca031009", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631222, "uuid": "0371a127-6b33-40d7-b5ce-a62dc6758030", "comment": "Malware payload (Mirai)", "value": "dec31a13cf2bf3a31e509151a1fe84dd0a05f130d77a7fa3336f6c8c5a5dc8ba75aecca281a483f52ccb3f9e953e466e", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650631222, "uuid": "48f795a3-205a-4483-a675-2cef895190e9", "value": "T12DA35C27B552C6BBC08792B027DBA6519933F4BD0B32724B73D43DA42F219C91E69F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650631222, "uuid": "51a96e59-19c2-4ade-b322-fbb1076b2e12", "value": "3072:BmAVvSVgl+hIwZAUh2ypha+Gem/KWOXF7aZYxe:n5l+aXOpha+Jm/KWOXF7aZYxe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650631222, "uuid": "b621ba57-e17a-45d3-900b-fd9fc36e5bc5", "value": 100432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650631222, "uuid": "5de5c9dc-d834-4069-bf9f-f9514f329e7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650631222, "uuid": "0db9ebff-5925-4c0d-bf3d-f57dc404b9da", "value": "2c388fdf241e8baa8c65b55227ec7e5f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0596d414-c231-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650627634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650627634, "uuid": "ca930e28-ff1c-484c-9f02-7ad5c8cf17fc", "comment": "Malware payload", "value": "3678adecf685b51d84f6e32ce3293e26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650627634, "uuid": "13226e5b-c4d4-406b-8044-5846dc695c61", "comment": "Malware payload", "value": "acf2943bd9c21775335ebea37c540e08e4827886274b6551b1d802e197ffabb6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650627634, "uuid": "bd651f9a-193d-4219-abf2-d3c2353db87d", "comment": "Malware payload", "value": "c37572baab72cee3bd02e18d89975b9189a6a0dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650627634, "uuid": "c634cf32-4b45-48d6-9b0a-2310cba7fc8b", "comment": "Malware payload", "value": "1f71d63dd7f2f051b5bd10ab3f46aae281f2f71c93a819aa3076a18714dea7d4cc516a7a3c0902afba989b0e1c2a6665", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650627634, "uuid": "fe26c719-4f66-45ef-b179-62d29f623b1d", "value": "T18C059D2D73709449D918F87487469CE37B790ECE29B6EA3D4C70DB812F476068DC3A66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650627634, "uuid": "f9e9e8c0-1612-493c-a93b-f3cc3c05a5b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650627634, "uuid": "3ec01440-6004-4721-9e4e-d0a1ed3ad282", "value": "12288:PwFR9bpucuNqtpxliX1kOBn+G48oA4lL57BqD3i3Ug0o33lgYAQRYN:IN4NKpxABURFA4z7BqDsUZoHWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650627634, "uuid": "a9246e5d-db88-4689-ae6c-b23a16cfeefc", "value": 796672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650627634, "uuid": "0b4315ed-9227-407f-a7fc-3274f75e1be0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650627634, "uuid": "6854e06a-5acf-497a-80bf-bed80f150c83", "value": "quotation.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3cc5d8f-c21a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1650618048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650618048, "uuid": "2f824d34-fcfe-4a80-acf7-c5d74116755d", "comment": "Malware payload (Loki)", "value": "5d6390d4902a49ed2e68f925c40386f0", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650618048, "uuid": "7d3de4d4-db3c-403e-9724-94369c32f864", "comment": "Malware payload (Loki)", "value": "adc785668be73edb6d28a24ad3bf4cd303818aca8462d41f44b171fbfaf8200a", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650618048, "uuid": "d827b024-66d5-4a77-9651-da0101ec7c2d", "comment": "Malware payload (Loki)", "value": "32e0f30c9c3466782a1e717ea7e6308a7d6574e7", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650618048, "uuid": "bcaa95db-e80a-4be0-b651-58ecfac3f1b5", "comment": "Malware payload (Loki)", "value": "ff371314f855b6be6af20b2984bc36916f068116df2c42491a48de5bd681369e210c33cc804778519af156d4619468a1", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650618048, "uuid": "0a875932-c52b-4b38-af2f-87006af32765", "value": "T1B1D30293338843C2E1666EB26CB0980AC733ED204CD75A972D1AB16DAF396F0D5DF521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650618048, "uuid": "3b0ad152-fa47-4f8e-a01e-d23877a77ef2", "value": "3072:QRBGk4Ina3nWgGTEX2qlXW7tH7dgWsCRTJckZ/eOW9xqO0ZEo:iBGkLWW5/qlW7tH65Oe/f0ZEo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650618048, "uuid": "3ba27e9d-8381-437d-b1de-fb0b164fbe69", "value": 132968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650618048, "uuid": "243a90af-55c2-4c4f-916b-daaa0d9aaa5d", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650618048, "uuid": "24fcb8f3-78ad-426f-9b31-0bd17496921b", "value": "Arrival Notice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feea6a86-c24e-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1650640508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640508, "uuid": "17ff286a-cf5a-41e7-b5ec-4474d3bfbdd4", "comment": "Malware payload (SilentBuilder)", "value": "b444492928c79557b21700e2f8c70110", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640508, "uuid": "d93391b7-2fc3-4e86-a77a-397ca5251518", "comment": "Malware payload (SilentBuilder)", "value": "adea96e307435ef9c8447510b997d7974199e7ec8857dd5b94b2158d4d7f3955", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640508, "uuid": "61252b4c-e947-4c5b-8dab-7ed0b7bbf100", "comment": "Malware payload (SilentBuilder)", "value": "1f4b0c0e4aba73e1202ab70416603d081c07fcae", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640508, "uuid": "12a84a15-b2d0-4d2d-9d50-d202fc7cf8ac", "comment": "Malware payload (SilentBuilder)", "value": "a34fbab910cfc26a4028d8cb95cc198f8801bd8fd1118d67e7cce16deeaae7cd6ea4b0dec0a175dc61155d3909b6be00", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650640508, "uuid": "cc116974-cf9d-477b-82b5-fd09939c80c8", "value": "T14F633B477549B86AE916CB3D4C974B99B613EC104B960B83BB09B3597FBA9B04E0310F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650640508, "uuid": "e728cb46-78bf-47ed-832e-c2c0736ace4c", "value": "1536:tOKpb8rGYrMPe3q7Q0XV5xtezE8vG8UM+1YW/ESKQHS1yXJFa5etSv:AKpb8rGYrMPe3q7Q0XV5xtezE8vG8UM5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650640508, "uuid": "02933a0e-63a4-4e11-89ac-67860c2d59d7", "value": 71680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650640508, "uuid": "97158f08-b611-4c43-be27-6778ada56b84", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650640508, "uuid": "5c5aff3d-6a8c-49fe-b68a-ce5382699576", "value": "Report - 2022-04-22_1055.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f9ac290-c239-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650631167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631167, "uuid": "df28eb56-5c23-4470-8998-fc32359ec615", "comment": "Malware payload", "value": "27368b13d3596d3d8f48db6c463bd10d", "object_relation": "md5", "Tag": [ { "name": "83-41-130-122", "colour": "#41A215", "exportable": true, "hide_tag": false }, { "name": "83.41.130.122", "colour": "#E273AD", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631167, "uuid": "28abdaa3-30b4-4795-996e-16cd3f5e6869", "comment": "Malware payload", "value": "af469070fb16d7cefd7f19240629483575764a59049f6cca4180d2518f4bf969", "object_relation": "sha256", "Tag": [ { "name": "83-41-130-122", "colour": "#41A215", "exportable": true, "hide_tag": false }, { "name": "83.41.130.122", "colour": "#E273AD", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631167, "uuid": "bd7e1205-a258-4f19-a5e4-d04d148ee21d", "comment": "Malware payload", "value": "f72dfc36d9d4ed6b7746d3da16fb5ec982931684", "object_relation": "sha1", "Tag": [ { "name": "83-41-130-122", "colour": "#41A215", "exportable": true, "hide_tag": false }, { "name": "83.41.130.122", "colour": "#E273AD", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631167, "uuid": "a8a7183e-886f-4b29-9559-37019ba17033", "comment": "Malware payload", "value": "3342e938ef9f09b1dc1c1d23f5cd249ecfb19b2a513aed2eb3fa04bdcfa913e25835cff4c9f7bd86ea20ebe5277d964d", "object_relation": "sha3-384", "Tag": [ { "name": "83-41-130-122", "colour": "#41A215", "exportable": true, "hide_tag": false }, { "name": "83.41.130.122", "colour": "#E273AD", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650631167, "uuid": "410bb900-a1c5-4b8b-b9d9-c5dc7ff4545d", "value": "T17127334AF5C44D93D3E23F342256C1344E7EBD4513D1829BBA960A443A9BAF33B3949E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650631167, "uuid": "5c717c04-651a-4089-88bc-ecf5eb30731b", "value": "56e6eab1651c914e5d13d6a7129af622", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650631167, "uuid": "83a639c8-7ac5-4510-a2af-4a90aef7d558", "value": "393216:5P13dgpb/IFx70T4pAM7+pWDa8PyZ8ma3YR8JC7rjNPj52L5DdhStSg:J1tN3+gAujQUCHjNIFDd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650631167, "uuid": "6e5e9973-783c-4dd1-8e11-911f0f374438", "value": 20947078, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650631167, "uuid": "3e02e7da-18b3-47bd-bc3c-8db1941c1fb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650631167, "uuid": "c1e1a55c-7892-41da-82ce-8b03b417d586", "value": "af469070fb16d7cefd7f19240629483575764a59049f6cca4180d2518f4bf969", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dc42b20-c225-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650622735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650622735, "uuid": "9302af0c-65eb-472f-b9ec-caf0b8fece80", "comment": "Malware payload (Mirai)", "value": "ad8f126bae1c6c4cfd38ad8174663727", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650622735, "uuid": "34438bc7-3e3a-44a7-9dff-17a8421f71bc", "comment": "Malware payload (Mirai)", "value": "b0079c2d7c372b7149949dd7a584dd72458c3929bf2ce6351048dd1a04aaae84", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650622735, "uuid": "dc8fba15-3e64-47e5-8cc6-0a3472158941", "comment": "Malware payload (Mirai)", "value": "675f86cdca7d2de9d1e9f409f3347e2a7ab15b20", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650622735, "uuid": "4356e537-6f5f-4a27-a44a-3d9593928167", "comment": "Malware payload (Mirai)", "value": "863bedef74f6314edeff122a84c675a144ed16a67fb866d1b557d81bb92d9609b93a3ea1ed563e49fc6f26b1eac46ec9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650622735, "uuid": "514efc58-dc9c-4cd2-b530-43667d155c5a", "value": "T110B2D08FE9547CD6C6BD1D79A29D03F51F94B181B75D5BC88710DC60B921A03ECCA4E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650622735, "uuid": "ef6f7467-7494-4d01-8167-afc83763a300", "value": "384:nevSM14YsqkEJ6B4jVwbjsvqwBSp9lxYzdV2H8RC08lRWGVCz0NvnP:nevl14Bqk8wbjsvqlYzdV2HJ08TWK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650622735, "uuid": "25c8f3d9-3a02-4d37-be33-d5ba0d6b0495", "value": 24524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650622735, "uuid": "f4e53080-4961-4a6a-bca8-573a8828fdcd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650622735, "uuid": "22a24702-355b-4b68-82c8-0f5c0e8d55d1", "value": "ad8f126bae1c6c4cfd38ad8174663727", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "876dd40a-c221-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650620980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620980, "uuid": "d0864bc4-969a-415d-b811-284f4fec3ee7", "comment": "Malware payload", "value": "c44a7b0b15b5c984439c8abd6b878f14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620980, "uuid": "a2deaf50-d5d5-4e0d-b7ea-15ec01565f0a", "comment": "Malware payload", "value": "b025e1e300641b73106704bb262ed6ba0dcbd0922cd7ab33035ade5ca9609292", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620980, "uuid": "79fb7d2f-b15d-4e16-b021-b8439b0de56b", "comment": "Malware payload", "value": "8fe9dd11bf23438fd97c9186f15948da4029e784", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620980, "uuid": "48002cb3-3edf-4b67-b08c-4f8871b4f4d2", "comment": "Malware payload", "value": "689c77e51ed4d5cc2f490933fdcd40e51acff5941f8542f6b0a28b6a75896a926ba2437ebf14b0ff62b953ddc02e641c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620980, "uuid": "7e72d5e3-ca60-4c9e-8af5-3bb746aeeed1", "value": "T107C3280BB7851736C9974332A30FA3A29BB1D87883624739148DD25C3EE66A477FB5C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620980, "uuid": "a069d9a4-e733-4cb2-be9b-361c1345ee5f", "value": "846cdb6fe788aaf02332fa5d82a810c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620980, "uuid": "be4b3f6a-d449-4edc-b978-ab7a9f9fe915", "value": "3072:Nt74ARnMcB3RUN46ILJ9+ZB5yOanJrXc:NCAmryr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650620980, "uuid": "e791a061-5bb2-4c46-8307-2b469aea5b39", "value": 127488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650620980, "uuid": "0b252ed2-467b-4b59-a3fc-bd8d8cf0a358", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620980, "uuid": "98aca160-71d0-4002-873f-ff5880197805", "value": "SecuriteInfo.com.W32.AIDetect.malware2.32700.29582", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a13862a6-c236-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1650630043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630043, "uuid": "769b8b9d-5718-40d7-82e0-6f476ba0b1b8", "comment": "Malware payload (SilentBuilder)", "value": "8afa9e9db3cc9c99e8fae411264581e5", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630043, "uuid": "2e4568fb-15ca-43e5-b2df-b51c26bcbc46", "comment": "Malware payload (SilentBuilder)", "value": "b0c152e34f686ff766415fb00bcf0a12e1ee7b16bbe22c03a270631ebc7ed54b", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630043, "uuid": "6d896345-79d3-417b-a4b3-30bd6ee3c754", "comment": "Malware payload (SilentBuilder)", "value": "3a3c8c81cc7aee7ed88f452823ea9e7fe506153f", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630043, "uuid": "ad8c6d1e-e60a-4dd1-a447-97c1d6a536c3", "comment": "Malware payload (SilentBuilder)", "value": "d8f641861c447a0ca898a1a10b9053aded5d06590a5ba2dea01d351aa2252b9d88645a5ccc98bed6a1a83bac871c02e6", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630043, "uuid": "ee3310c5-601c-48d9-b859-4112bbfd2b66", "value": "T14823B646BA5D9859E9258B7548E743E9B333FC201F6B0B833616B3257FF49E05A03207", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630043, "uuid": "5a2dddba-f9e0-4566-b966-9a3871a086cc", "value": "768:4DM52tfQXi8vgLZkTOHkQT51Vp6AwPdM8gQ6JT5X6DGwUdh+pqjeSLjcvLtzrxFm:462tfQXi8vgLZkTOHkQT51Vp6AwPe8gz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650630043, "uuid": "fcec1a3e-7bb5-47e6-9974-f0dd9078ce77", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650630043, "uuid": "40017b20-9de4-4997-aed0-d2a71e1a9002", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630043, "uuid": "2b581c60-c434-461e-829e-b94779c43d12", "value": "2022-04-22_0732.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f004b06-c23d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1650632884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650632884, "uuid": "97ce4b6b-a500-4756-9804-72aed7f2514f", "comment": "Malware payload (Formbook)", "value": "3b9d66afa0cd36b2d5d7605bd53e8083", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650632884, "uuid": "367a7a24-8141-4733-8898-44418eb3d235", "comment": "Malware payload (Formbook)", "value": "b1864b93f536f9f345949786b9d7229a56745506750c886abd462f07cb92a93b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650632884, "uuid": "df28c7b8-43b0-473e-93b9-612ee97020c0", "comment": "Malware payload (Formbook)", "value": "586bdc23aa61c80679f36226daa5a4fbd6a59ab2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650632884, "uuid": "32773b44-1982-4f23-bc8e-3849ac3b11ec", "comment": "Malware payload (Formbook)", "value": "05a87df14b9eff9e8ff43205ad136e79f5e5a37551f73742ac415e5f3a43fbce2e6739168eba92bfea533c6136ed3fe8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650632884, "uuid": "eded9bf6-b85f-4c89-bcf1-6bb181f22e8a", "value": "T138C4F103B26FD70DC96847B2B0BA05304374EF179451EA8AB9D9EDBF463639E0A413D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650632884, "uuid": "f356c5e1-5fec-44aa-8921-531236f820c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650632884, "uuid": "ce2d5846-b141-49b5-a41c-bd248a202cb1", "value": "12288:qWc/3DqGp4ouI2tfenY1aC8ECIINTilR38HDRTi9TPR:cqWWRfeYiEbf381i9TZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650632884, "uuid": "920f9695-1e1d-44ee-9ca8-e518baf91921", "value": 561152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650632884, "uuid": "967a9fb0-edce-4546-8cf9-a3380bda5746", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650632884, "uuid": "d90504ce-5430-46ad-8166-6706c09588e2", "value": "CMA-CGM CMZ03567882 SHIPPING DOCUMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac0ec786-c290-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650668715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650668715, "uuid": "870e4f95-00ea-4479-9697-32c4aabc8b9e", "comment": "Malware payload", "value": "ac565a868ef2bb9fc124e1477fe4e0f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650668715, "uuid": "ba15afae-5bd1-4ceb-bc0e-cd55f53f9057", "comment": "Malware payload", "value": "b2d0e00482a11343ddfd7e99c531ad93e290228cb3a2467ce2872cb05f8dde47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650668715, "uuid": "d8dd4309-f38d-4ddf-b4ac-d43a9a1c33a5", "comment": "Malware payload", "value": "d0e3d24f2f7f20ecab838a780b1474cce6a0c31d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650668715, "uuid": "e8d2cbdb-b77c-4328-98f5-a56e96cef4df", "comment": "Malware payload", "value": "b9189be5f20fbf3a4360555b4a70fb7572a54fc94757bb0be56fe79c831014e308cbc2e10fa4078e570eecb0f630382a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650668715, "uuid": "9440b1cb-ee54-4fe5-8a03-71dde20a8949", "value": "T190D49D11F6AC80B5E07BD13DC9A3875AE6713C9847B943C79255EB2A2E736E05D3E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650668715, "uuid": "31b49019-dc47-4eb2-bb6e-a5cf0a47758b", "value": "6ba79cbed2acbe9b8ecc8e14a572f100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650668715, "uuid": "af2ca30a-4f5b-4df4-994d-c2fb09c6ded6", "value": "12288:C1FIcocJwMTHzXO7N29BHiyzskF1CubVnmn:tco9MTHzXO7NI/115mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650668715, "uuid": "183a71fe-d71d-44d3-bc07-4a9e6cf449ee", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650668715, "uuid": "2db0b24f-60b7-4ad0-a6f9-0b2462a9d57c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650668715, "uuid": "20d65b4a-be87-470d-95bf-1c06e5c31e97", "value": "ac565a868ef2bb9fc124e1477fe4e0f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c60d446c-c213-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650615072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650615072, "uuid": "32988930-0542-4aa0-87e8-9b7bf5cbe507", "comment": "Malware payload", "value": "1f9f037a2543be7346389c6f93e26ebd", "object_relation": "md5", "Tag": [ { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650615072, "uuid": "a69c76b0-8a5d-4dd3-910c-a777a7f0db89", "comment": "Malware payload", "value": "b3627a477cf891fdcd72b207521c18f30370aa9529557d1e709c6ea4b54de40f", "object_relation": "sha256", "Tag": [ { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650615072, "uuid": "89f8b59e-7c58-428f-bf36-4bab94f31ba4", "comment": "Malware payload", "value": "7c257ca449c7be13c822f8b6e7c2342c60049d61", "object_relation": "sha1", "Tag": [ { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650615072, "uuid": "43790abb-ad36-4278-8d95-fcddaeecce96", "comment": "Malware payload", "value": "f9f3d715e19e590269a84909caa0ab949f991de8815584339bec839d4e4eb8451174c91af67d2908d7e2042c22bb0bd7", "object_relation": "sha3-384", "Tag": [ { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650615072, "uuid": "54b59168-f253-496c-9770-cf37562da67e", "value": "T191A302685C9E38BEE8715F093F5DFD8D9458F3B1E8CB9444053A9A8310F0D06D26FA2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650615072, "uuid": "c533b703-ddd6-4c8f-b3e7-9a88ede0ca97", "value": "3072:dQUZg+d6eKHC/JZKMW3nCtlMOpQvyKmQKWBXxMgCaIdY1:dQUZg4fIc4MvzPpAyKLbBh7hIu1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650615072, "uuid": "ed5db386-d8a6-4fda-90fb-1fc361dd1ed2", "value": 100444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650615072, "uuid": "b5881ade-5a52-4649-b386-7b36fb30d648", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650615072, "uuid": "452602a5-57db-4d0f-b35a-5f9324fc1236", "value": "NEW PURCHASE ORDER.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9193ed19-c21a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1650617990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650617990, "uuid": "c918a1f9-753c-49d7-b7ee-ba52d745984f", "comment": "Malware payload (Loki)", "value": "1447d26d3b381d2c5dbf0b8b200642f5", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650617990, "uuid": "2f0206a5-6fcf-4f6b-bf3d-1a5f93c8d479", "comment": "Malware payload (Loki)", "value": "b399a3a5e57bc4d743f62d80cbbae352e35461e5ae4fc157f8f395ee825be60a", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650617990, "uuid": "78784cb7-7800-4611-a6af-8c1d34760b1b", "comment": "Malware payload (Loki)", "value": "f0d07e43941fbcac90d9b289f3df57c5a48b27e7", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650617990, "uuid": "4983bf75-d54c-4597-ba93-ad6b04dfd5d3", "comment": "Malware payload (Loki)", "value": "7fc9af3748fdbfd62ada5033f16ce98b9db26ffa3809658b89648270efb353f8829cb6d56cea236d4c59c346ff484566", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650617990, "uuid": "8af4892d-a794-492c-be68-1f5a28982237", "value": "T1BBA3F17D1B696810F45B0F344F3334EAF96E0F2B2909B1D8D5C276284EB56C959A382B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650617990, "uuid": "17f524d5-830e-401d-83ab-ad9607ababe0", "value": "1536:n22Rw+YBWdJQEQN3ZnssnfxsOWYEbjO3/BoA2LTuS8SrOjFkBZPkVDAQw+0oErTN:n1RbxibPbfOOfoy3/muoXZPKVE3qXnJq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650617990, "uuid": "d276a6d1-0847-4b75-a4b3-f3cf4e75bc3c", "value": 105368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650617990, "uuid": "45001533-7e7d-4003-aaa5-f012f654a8a5", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650617990, "uuid": "7f6d9503-3ca3-48fa-93ca-28ebc56edccf", "value": "shipping docsETDBL8091.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5951b2f6-c23c-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650632499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650632499, "uuid": "2e7a8acf-f053-4be2-8633-07f631df22ec", "comment": "Malware payload", "value": "114785ad91a63e3be8f01d8342e49006", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650632499, "uuid": "7d647e94-d623-4854-9061-1ff3cebf46a9", "comment": "Malware payload", "value": "b3abdbbffa1f856eaa37282296039d8434265a9941b6f0ff936c2fa2d0ed003a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650632499, "uuid": "8c4d50f3-318a-44df-984a-ce54c475b1b4", "comment": "Malware payload", "value": "ba269b845989ef5713641b4079db421d19989b5c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650632499, "uuid": "d4bee958-7501-4e97-a8cf-c1035c30660c", "comment": "Malware payload", "value": "f61521137815b5fb57b8589ab7afa5d18c2c2c1d1c078c0d70e0df0244af87f0528c62673f3e550ff464dc267c092220", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650632499, "uuid": "0074ede3-7fe7-4746-9898-c4b4e5c224ca", "value": "T14FD49D11F6AC80B5E07BD13DC9A3875AE6713C9847B943C79255EB2A2E736E05D3E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650632499, "uuid": "8ac008af-75af-42b2-805b-03948e6cfbed", "value": "6ba79cbed2acbe9b8ecc8e14a572f100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650632499, "uuid": "b6e2795c-3975-4a10-95b0-6fa367e11002", "value": "12288:C1FIcocJwMTHzXO7N2ZBHiyzskF1CubVnmn:tco9MTHzXO7Ns/115mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650632499, "uuid": "1431dc91-79f1-4d9e-bbef-2f2a1483a73a", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650632499, "uuid": "645b873b-b546-4a2f-9640-676dbc261761", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650632499, "uuid": "2e5ee59d-0a42-4f72-9f05-1ad4b2953e6f", "value": "emotet_exe_e4_b3abdbbffa1f856eaa37282296039d8434265a9941b6f0ff936c2fa2d0ed003a_2022-04-22__130133.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f7f567e-c21c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1650618792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650618792, "uuid": "088c7277-7848-42e9-a22c-8eb5ec199004", "comment": "Malware payload (Formbook)", "value": "d175eae34796a5140bb0fe5f88dfecca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650618792, "uuid": "d986b186-ff38-46f4-a34a-098751154487", "comment": "Malware payload (Formbook)", "value": "b495958dc74cf24c5462e52a9a9f00664f00ce0f8b72c3afc58b9752281f19ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650618792, "uuid": "449deac8-b13d-400f-bf1f-340b31c2800a", "comment": "Malware payload (Formbook)", "value": "c570f502747db7c118853dbf0fb41bcc64940610", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650618792, "uuid": "174d3dd0-06ae-4eff-a8b9-774b30ac6576", "comment": "Malware payload (Formbook)", "value": "e75b12d66c60b7ff55967a30e6e7fb0ad3a92ebefae03453705d91ff5e60c554daed5fcd992b977c49dc73f2a44a1641", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650618792, "uuid": "4ce7b93e-1fa7-428a-8d27-7ed9489d5914", "value": "T13DC4225F2AAC6F32C4FD57F4AAA08194537CD41DF912E7588CC112CA29F3B449A72B87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650618792, "uuid": "8a0a75fd-64d3-4d29-b932-610d4911978b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650618792, "uuid": "893d53af-fc8b-4978-85c3-ac1f01e97c56", "value": "12288:yz5pDox18ielotI/D1h+B0y6bGI4v9gAlHQf3x0T9FOlqNB:yFxoxCrlz1YB76bS2AlHA3K7Oy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650618792, "uuid": "adee4e42-30a9-4932-8532-b1210423319b", "value": 558592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650618792, "uuid": "6e7423f4-6fff-4aac-af56-104b00367de4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650618792, "uuid": "61bf90c9-ea87-48bc-b0a8-fe6b048d0986", "value": "d175eae34796a5140bb0fe5f88dfecca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03352c78-c1da-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1650590264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650590264, "uuid": "da336f0d-782a-46ae-9a2e-0328accbd06c", "comment": "Malware payload (AgentTesla)", "value": "305a4824f3123e72014ebe2d7370e866", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650590264, "uuid": "f147db82-89d2-4b5c-b506-c88d2eca32d9", "comment": "Malware payload (AgentTesla)", "value": "b549e8a31eda42d162c7f60d9ba4b8e0b740994f69bd62d6cca8ac2b18faf166", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650590264, "uuid": "bda054cc-a22e-4f32-8455-a4c40386d795", "comment": "Malware payload (AgentTesla)", "value": "ef79fb2bdc3f6889f9f56775bdf70401c684962b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650590264, "uuid": "bda307b2-3e11-437a-8ab5-c14b1a719d11", "comment": "Malware payload (AgentTesla)", "value": "141ad5bb2650d09b9951b200e936d33049e93d080156584def70ee3d9d6c247f92f30534bf68e8cc85297523cd588167", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650590264, "uuid": "6feb38d7-94a1-4bf2-bc45-84318ce87980", "value": "T133B47D98755171CFC487C972C995DCB0BAA4B4BB470BF387B4934BAC6E8D496CE002B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650590264, "uuid": "9144d6ab-b8cc-47a5-827a-39c3a0167a88", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650590264, "uuid": "582231e9-96c0-41bb-91b8-449dc76d6d7f", "value": "12288:G6GSVGCONIC2Q3qTs6zoyAdLdSS0K0noFXIXLcv8m6wbQtJrx:sPB6yy0p0nB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650590264, "uuid": "53abf2ba-6265-4447-8a22-bc26061daab5", "value": 542720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650590264, "uuid": "d3182634-11a8-4912-b2c1-35e9d1c60e2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650590264, "uuid": "dc1970ec-ab8e-4b25-be00-80c92872a08e", "value": "Enquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8301857b-c254-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650642877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650642877, "uuid": "f4ce227e-421e-4e91-83d0-38041f79d0a2", "comment": "Malware payload", "value": "1703d06684c0c7bb1e785f2a434a137b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650642877, "uuid": "6ebe9bd9-1cf7-41e5-83ed-260361bb35aa", "comment": "Malware payload", "value": "b63af8852e719d6f55bce0bcd53553a2da3302a38c256b739b063f2ef3a3463e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650642877, "uuid": "a9ac16d9-f34b-41d8-9b07-e9329af2ab83", "comment": "Malware payload", "value": "dc2d5a39db0f1ead024777af0667711bc54b29ce", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650642877, "uuid": "d39e6855-34c3-4762-8ac2-cbfeff4c0ffd", "comment": "Malware payload", "value": "848933b82a619a0bfa9a813db41bf67d8b7eab72b838e45e49e6eaf3c93070ac5d4d32f305aa10f23d7bbc961287d567", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650642877, "uuid": "179f31b2-06a7-4acf-a39a-3ef9fb298cc8", "value": "T125F48D4BF77C84A6D16AC979C5639A8AE6717C454B71C34B4360FB3E6F337A05A2A300", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650642877, "uuid": "3bb4891d-0376-408f-8cc3-c176333f04d5", "value": "57b460f7cd0fab28b120cd121cfb7f9f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650642877, "uuid": "21a36e0b-2a90-422c-8c69-d0f1b8b97b79", "value": "12288:aIabL1+x29hs+bDBLKhKmCKzTrjvi0I8PxiGhWzx+o8/NQfN7IT5p:XabLXhs7AZKzvjKT0hWzP8/yfRIT3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650642877, "uuid": "3891f052-725d-46d1-b18c-b820cad0a7c8", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650642877, "uuid": "b083be96-554a-47ab-b0f4-4981c6a51cb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650642877, "uuid": "7d310f41-ab6e-45fd-9478-bc8fd5e9af1f", "value": "emotet_exe_e5_b63af8852e719d6f55bce0bcd53553a2da3302a38c256b739b063f2ef3a3463e_2022-04-22__155431.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7131e8b3-c23d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1650632968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650632968, "uuid": "e48fcdfb-ab90-4c72-8813-84a32845bf3e", "comment": "Malware payload (Loki)", "value": "889d885b2b34493f6decc0bb87fa63cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650632968, "uuid": "b9d700bb-b96b-4d52-8de9-52a005ab06a0", "comment": "Malware payload (Loki)", "value": "b77dcdd6855534da28a7da3c198a3f92589b44e8c71afdbe4f6ada679d9163e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650632968, "uuid": "3834fd94-a787-42bb-91cf-f6f0d10fe71f", "comment": "Malware payload (Loki)", "value": "209b79b697ec0481ae95b0201f2b08960253838c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650632968, "uuid": "cc5c7c5e-e91c-4eef-bd69-37b3ffc99184", "comment": "Malware payload (Loki)", "value": "cdd50a9dde11fe0d2696f38968ed4d27459c576a7412e57f35d4d3bba46ec87eddb8ade05525bd29c92cde54fb7bbe8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650632968, "uuid": "91976f4e-e0c9-442d-9c04-64dbf560adc5", "value": "T1BAC4D01176FC8519D9FD17FDA038018047F6B61B6816E3BC6E05A0DA2D633D0DA46BBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650632968, "uuid": "6bd68ae6-aeae-4d66-9509-11eff195e553", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650632968, "uuid": "b64089bf-8791-4786-8d1f-d87a13148596", "value": "12288:mkKUk6jgc4q+xls2HnXQRi/053UmOp1U1wEwDXwAgVgz:mkKX6jgnqSXeQQ3pOPSvcIm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650632968, "uuid": "16c8a14c-1bda-4dc1-a99d-f4d8f91cec5d", "value": 563200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650632968, "uuid": "32156484-2b12-44c9-a9cd-8ed5c1f974dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650632968, "uuid": "b10efedd-4e1c-4752-bd7e-fd04f817a237", "value": "MV GEOSAND_FINAL DRAFT MR_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8578c8e3-c247-11ec-8e58-42010a9c0032", "comment": "Malware payload (CobaltStrike)", "timestamp": 1650637297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650637297, "uuid": "3ab8372d-fbd1-4037-9f02-8c1b92764065", "comment": "Malware payload (CobaltStrike)", "value": "10eb0ddccd834bd1b519f2fb2603ad7a", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Karakurt", "colour": "#CEA7AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650637297, "uuid": "f139fcd0-a438-488f-b7b8-fcf316e94a44", "comment": "Malware payload (CobaltStrike)", "value": "b7ae3b6f2c04a8d05478509b5047bf50bd880d32125923f093b2ea65fe48fac1", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Karakurt", "colour": "#CEA7AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650637297, "uuid": "a4b72571-2a01-4486-918d-303c5b9f43a3", "comment": "Malware payload (CobaltStrike)", "value": "75c4d82775fdf9190a733a3cbbc2545755403f9b", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Karakurt", "colour": "#CEA7AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650637297, "uuid": "8d4cf999-5724-4c74-9624-642b1ac74be9", "comment": "Malware payload (CobaltStrike)", "value": "f5f75cdcdbdc662cf5a1f7654e60cb992221ba5642f037b0f7516b698e285bc9e8333c6c57da64e01bb7259175aaaac3", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Karakurt", "colour": "#CEA7AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650637297, "uuid": "4d470903-6089-405d-8d2a-06fae5ac7b03", "value": "T17D936D43DA9E9442E0F651BC21F67A03FC60351A9C38AB9A5F23C9471730B89D9EFB15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650637297, "uuid": "94f55986-0dc0-4f6f-b08c-32064e3bfa28", "value": "08de6fa5ac7e1d7d7253ce465cf88f72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650637297, "uuid": "caa908fa-7460-4cd1-8b9d-516279512f08", "value": "1536:qccqsof/OudmaYz2z9upfOhDZMl4ViDOtH9MpWsmdUlEwLc4JKYZzodG:7s22udzYCzKfCCl4ViDOp9M8s6U3LnJv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650637297, "uuid": "d266f98c-c235-4c5f-8d2e-11a895588fe8", "value": 93696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650637297, "uuid": "517d5012-bfed-49e8-9b8a-16bafa72a775", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650637297, "uuid": "94e7afb4-655c-44b8-8dd3-8e5d3bb4140c", "value": "p_crypt01.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45d9eec1-c239-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650631178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631178, "uuid": "0c42bf26-fb3d-4ad6-aad4-cf968c6459f2", "comment": "Malware payload", "value": "8516ebc9b473b239e0c3413abf1b8c20", "object_relation": "md5", "Tag": [ { "name": "83-41-130-122", "colour": "#41A215", "exportable": true, "hide_tag": false }, { "name": "83.41.130.122", "colour": "#E273AD", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631178, "uuid": "782ecaf4-0883-42a4-8770-f30ab97c5a0a", "comment": "Malware payload", "value": "b7bcb5ec0b229b7547f9b24524b1964b997025db1437a14c27ef6b698e14c6bb", "object_relation": "sha256", "Tag": [ { "name": "83-41-130-122", "colour": "#41A215", "exportable": true, "hide_tag": false }, { "name": "83.41.130.122", "colour": "#E273AD", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631178, "uuid": "425410d1-4ef2-4263-a66e-67f075d806b3", "comment": "Malware payload", "value": "6797a66f0b5218f3842b6c5aa3fc9f9545ccfd3e", "object_relation": "sha1", "Tag": [ { "name": "83-41-130-122", "colour": "#41A215", "exportable": true, "hide_tag": false }, { "name": "83.41.130.122", "colour": "#E273AD", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631178, "uuid": "dba76e2a-c9c7-44dd-919d-996df07a3597", "comment": "Malware payload", "value": "fcbc705ad4170a1204a6576206629cd6646cc9db7153b4879fd833db91e3c35d157285183054a15a000ca1520c60b101", "object_relation": "sha3-384", "Tag": [ { "name": "83-41-130-122", "colour": "#41A215", "exportable": true, "hide_tag": false }, { "name": "83.41.130.122", "colour": "#E273AD", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650631178, "uuid": "f3e9e727-f5d1-4abf-a403-a05696fe2fcf", "value": "T172273346F5844DA3D3E23F306166D5344E7FBD0413D182AB7A960A443A9BAF33B3949E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650631178, "uuid": "e77913b7-3d51-46a7-8163-5a4358a5a4cd", "value": "56e6eab1651c914e5d13d6a7129af622", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650631178, "uuid": "275e18c4-19a6-4ade-806b-4b60f71a5aa8", "value": "393216:GP13dgpb/IFx70T4pAM7+pWDa8PyZ8ma3YR8JC7rjNPj52Lklzc+tSU:O1tN3+gAujQUCHjNIAlz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650631178, "uuid": "39b58bd0-a826-4d3b-bf4a-824c7163fdbf", "value": 20944009, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650631178, "uuid": "987d40bb-f099-4969-be15-735310d5b405", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650631178, "uuid": "0f742ac2-bb68-42ed-aeb0-fd2d96bd8bbc", "value": "b7bcb5ec0b229b7547f9b24524b1964b997025db1437a14c27ef6b698e14c6bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea9ba46b-c1e6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650595806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650595806, "uuid": "626b3a2c-9773-4270-9c64-2e7982559b80", "comment": "Malware payload (Mirai)", "value": "008a876f018889ec8af0ae1ef3a8551b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650595806, "uuid": "40beb563-342c-4f95-a99f-a03af8986655", "comment": "Malware payload (Mirai)", "value": "b853168a1f1ef477733aefcfe5bea559f1cc8d9a4b569fcc0450c69504c0caa0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650595806, "uuid": "da0247cc-c0cb-4aac-8ba2-8871fb168f1b", "comment": "Malware payload (Mirai)", "value": "198e03f691cd10919c156290329db9dac975dcc6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650595806, "uuid": "fb7ffb3d-8a34-4084-80ec-08156f46351a", "comment": "Malware payload (Mirai)", "value": "7555e6fb7a6be1f5b706e1bef662c217fdb793c0d499880c0df11bfebbe72c7b4b978c62133a44c097d9de68d3f5274d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650595806, "uuid": "c23613b3-9c77-4100-92a8-ae7c17b275e0", "value": "T181430752BC818A16C6E0527AF92E85CE3B2123E8E2DF73079D211F6176CB41F0D67D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650595806, "uuid": "1d0389f5-a15f-4396-98c0-73307674dc42", "value": "1536:Q64i29YzaK1r5mTPAzHcEe7Z1suV27cFhMDHs:Q6ia7de1b27ahq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650595806, "uuid": "89b6f8ca-37d0-4e82-bf17-1d78a931a38d", "value": 60444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650595806, "uuid": "219d9d48-67f4-4bfe-9a40-b1e35c8b196c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650595806, "uuid": "b1391233-50c5-4992-9165-c255db8af2a3", "value": "mirai.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adb4deea-c257-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650644237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650644237, "uuid": "40888e80-c842-4774-b0ef-645e3d284ce5", "comment": "Malware payload (Mirai)", "value": "aab2841cdf8249df4be6982438b9af12", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650644237, "uuid": "bf64ecdf-6aed-42c9-98fb-383997a1cb0a", "comment": "Malware payload (Mirai)", "value": "b870315f64f661bdb3ebfc74d92c11214d13c962882dd3fabb33f9c04afa2f3b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650644237, "uuid": "5accde1f-5ce2-481e-89a0-9f91c07e0b0f", "comment": "Malware payload (Mirai)", "value": "a28af7c4dfde3f790e74a9b30da45ec2ece02ec3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650644237, "uuid": "15ac4105-4f43-4c1d-8c88-354111400b1b", "comment": "Malware payload (Mirai)", "value": "804b494739fafe46bd9fb1753b634f4331b1fdc7938986cb725605463bc79a0e20ca1902799f200a1f2ff1e52a5766f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650644237, "uuid": "5620691c-2b47-495c-8e6a-c2e44f9ff67c", "value": "T141C3842E7E12BFBEE668863107F35F70879521D227A19382F26CD6181E7128D1C5FB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650644237, "uuid": "a3c00da1-0d81-4840-9d85-a58bd1054811", "value": "1536:M7je1TMGq+f+AQ2rK7zeXeReXe8V2rK7Ie+u60GAzQj1l72HBeTEdWfRZrmW+IFj:Ted0W0MZQHbd6RZrmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650644237, "uuid": "6713bd32-ee45-44b7-a1a5-3b67ec6c718a", "value": 125962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650644237, "uuid": "efd996fa-76af-4f65-93a5-184f550375dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650644237, "uuid": "11d6a9d9-f1e8-4168-8d0d-35f6c485484e", "value": "MIPS-1.o", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90ea5fc3-c257-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650644189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650644189, "uuid": "a7594b7d-20f9-4696-becf-2d4fbb379706", "comment": "Malware payload (Mirai)", "value": "4719290653a2f98d728cbef22b7f04ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650644189, "uuid": "eade95ef-2801-4c39-94e7-8a1cdf12d493", "comment": "Malware payload (Mirai)", "value": "b871a868bd2b62e656a716b8b83d42845d3f1731a398bb2c08a87088e3d1049e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650644189, "uuid": "aeef473d-2d1c-4a4c-8539-c7e2452f8bff", "comment": "Malware payload (Mirai)", "value": "79f5fd0df92f2533fca79c07fd4106c522b7fd00", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650644189, "uuid": "f6199476-45e4-4bb3-84f6-ffaeb5d8af64", "comment": "Malware payload (Mirai)", "value": "0cac7f167bdb0881e67cb5d257a9d991806fe092d66298cd8c9c4400f2642cef36879a04b0acf67869bfd5e98c4f90d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650644189, "uuid": "4245b540-03ef-47a2-9f67-d00bb99c26ba", "value": "T125F2E1C6C969E4B7E3B30B36DCBF0DC29B23E6AD9AFD51422728095453D784246E5F02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650644189, "uuid": "f9d1e124-27b8-4c66-85bb-8b70a218611e", "value": "768:TarjeCSi9ZoHN3Hv1rdjJN3R1ZqHLUMT7ZSvlv/84K9q3UELfA:Ta3eYu/RdbR1gHT7ZSNkaLI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650644189, "uuid": "b4d83c6d-27bf-4bde-b328-91646442ae36", "value": 34496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650644189, "uuid": "22cee159-5719-4dc2-a46d-6e01c2b9eefc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650644189, "uuid": "db25ed28-cea8-4291-be68-1a6030617875", "value": "plate.o", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0c44a87-c257-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650644269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650644269, "uuid": "0a1411c9-e3db-4681-8039-bb40d3a21fc0", "comment": "Malware payload (Mirai)", "value": "51b0605c0f16dbcb1f0a2013a6366205", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "superh", "colour": "#ED86EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650644269, "uuid": "ef944c3d-7c7e-4271-aa91-ebfca1c31c31", "comment": "Malware payload (Mirai)", "value": "b871e7d8857070b338e54b8c8ef75b7f1519982fab9a870e43079ac0c3c31223", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "superh", "colour": "#ED86EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650644269, "uuid": "f6f699bd-e4d7-41d0-a690-cf363ce05489", "comment": "Malware payload (Mirai)", "value": "f94504cf0c6e8529b4500012bbcdaecdbd9b60af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "superh", "colour": "#ED86EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650644269, "uuid": "a19096d1-ed5b-47a6-bfdd-171e8792b99a", "comment": "Malware payload (Mirai)", "value": "f2675e19c69c3ec7b8a173f41e50233ee490413dad48aabf3de0c76bbd34a0ec977d39b0482e0d761c2448a52e9b71cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "superh", "colour": "#ED86EE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650644269, "uuid": "ca773082-0c02-4592-8b17-fd5f256918eb", "value": "T155337CB5C579EDE8D1144A78BE248E749723E100C6932EFADA44C6A99083EFCF5583F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650644269, "uuid": "f19daf1f-71e8-4ab0-b009-0cd1d913e241", "value": "768:jaixFwtLSYAagMo0ebfEL3v0X3pyWfs3I9ICJUU/qMCqKomQRCvs:jaQFwtOGHv0XJfs3kICJt/qMF/RCvs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650644269, "uuid": "5e2fda5e-1e19-42c2-97d1-85c5024be3db", "value": 51584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650644269, "uuid": "990c1078-dc67-469d-aa99-b9d93bfac731", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650644269, "uuid": "bfd87470-13a4-4e84-a377-695d3aa7e94f", "value": "SuperH-1.o", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b9f44dd-c221-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650620933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620933, "uuid": "cb73a198-ca41-49c3-bd21-dd4b406b9834", "comment": "Malware payload", "value": "950bf651f878cf2fad7450968350524c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620933, "uuid": "9a186629-daf3-4a7d-8518-c5980d905b21", "comment": "Malware payload", "value": "b8f379d9b00c068280d6640fb0f57147686b4e0aeb9757e5f87e65199cc23d6c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620933, "uuid": "9cff8c3d-1f21-4cb7-bae2-49c2941fe574", "comment": "Malware payload", "value": "64506058acc61d3fdb886c91bdf88f67e28128bd", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620933, "uuid": "7d7e4086-4a98-4212-8d02-b397e4abf97c", "comment": "Malware payload", "value": "f479ac59a1b707fdb458c759e9997575fd24ec0048d52c5cb44c5582c954bc057bce97f11e3577c0d7d64e26c41ab0e0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620933, "uuid": "269a8aa7-2ed6-4a3b-b042-3db901321dfc", "value": "T1B4F56D26B24C613EC56A0A364937AA5C993B7B717A32CCDB17FC094C8F355416B3E60B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620933, "uuid": "ae13d50a-a111-4e10-8bc0-bf0ae830af6d", "value": "bbb4ff2b1112d6f7352f534fbfbd54c3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620933, "uuid": "ace18a4f-34b0-443a-9a7a-cbecbe9fce64", "value": "49152:iGZzDVFEWC0yduvIYSF49UCWEMJM1igy0iPmTUMew9INt:iGZztT6EmM1igy0i3w9St", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650620933, "uuid": "9db50318-cfc6-4018-877d-d0a18805d759", "value": 3542016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650620933, "uuid": "3997d214-72e0-4076-ba81-a285fcc9390c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620933, "uuid": "862a8209-62bc-44c9-8d63-30907b1eca4d", "value": "SecuriteInfo.com.Trojan.DownLoader44.46011.3063.30076", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a10ee9d1-c221-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650621023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621023, "uuid": "ad74d30a-7a33-4c34-8e7c-187660b92053", "comment": "Malware payload", "value": "456c5b9e50cc0178237adb0395022c4f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621023, "uuid": "bec12b47-26dc-40d9-b4cd-0255e035ebb3", "comment": "Malware payload", "value": "b92fd7d6457eb9c3e1e1604fcf9b6d739ff768eb970bbd3ca9521230c7937fa8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621023, "uuid": "b2ed7776-9e76-4c6a-9bd6-5691ff4a028c", "comment": "Malware payload", "value": "6cfde9c776c79d099408dc56a484b79363339f70", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621023, "uuid": "aada5ffe-9cec-4152-86c9-5a6a268471d9", "comment": "Malware payload", "value": "02cda001c993f1202d097cd5c38bc4b75d285b63c160269dd1c9bb81c1004cb0cf882574dcf65fc886525f5ce209aaa1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621023, "uuid": "4409cc2e-8555-41c3-a370-3336c020f62e", "value": "T107264A22B244663ED49F0E7A5533A25C993F67722A26CC9F5BF4098CCF364406B7E607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621023, "uuid": "7171e711-ee5d-403c-9639-595040d4d9f4", "value": "31f3fb1b3398a8420d31059bc5924151", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621023, "uuid": "03c127ea-018d-42ac-aaad-2bdf3da60056", "value": "49152:NJejdJq6nTE2cYQZeS0a1RQfu5/1IXvmEqtqnKnrTFSoraqFt:Ngjj54FYs/10vmEq4nKUet", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650621023, "uuid": "cf79e905-b1e2-47f5-8ad8-db4317e24251", "value": 4836352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650621023, "uuid": "e9dfbc9f-3e53-4eb2-95d0-f16bb80d2a2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621023, "uuid": "a9719af7-cc1b-4170-b38b-c19bf694a7a7", "value": "SecuriteInfo.com.Trojan.DownLoader44.47427.14447.15175", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7859461-c216-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1650616309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650616309, "uuid": "920694e2-ee7c-4f0b-b914-81285ae81ce7", "comment": "Malware payload (SnakeKeylogger)", "value": "6661c4d7bf6457b8a717ffd729c6d78f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650616309, "uuid": "01a367ff-087c-4b57-866c-0b20489e7673", "comment": "Malware payload (SnakeKeylogger)", "value": "b9304c7a91cfcfe8d8fec8e19b41615ca83d47c0badfbd411f5f540d6a75dd73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650616309, "uuid": "a99ee142-d2b7-45ad-951e-97279bc8c088", "comment": "Malware payload (SnakeKeylogger)", "value": "14a980f1e7c69849b1f48c1d4ebfe71d2c632b1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650616309, "uuid": "26837da4-dbf8-4a9b-a048-0ad1b27edcf9", "comment": "Malware payload (SnakeKeylogger)", "value": "26c2dafe94fa665a14fad43ff6e49ae48b169a447108a1fe0327d8fff13474110f5b5c35585a51e117f44abf6cef12c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650616309, "uuid": "ed526417-fab6-4d2e-9718-823fab3a6596", "value": "T1B0931811DFBCC92BF730B675F882D259283D91815D68B5C69C7218381F60ACB643F97A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650616309, "uuid": "cfcc3205-afde-4c31-a88b-7ea93192aff0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650616309, "uuid": "e685f3b0-e8e9-4096-b11d-bdd5bd7f6706", "value": "1536:8w9LEymSF8THX6G4Y00L9tVmRsmx72CkQ5Zm+W6OhFlFNaw48JO:jRxmO8THX6G4Y00+6J2PkFsw48JO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650616309, "uuid": "06f6fc00-e1d4-46db-840d-49569e2000ff", "value": 95744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650616309, "uuid": "d1a3cad3-fbe4-45b0-ae5b-f48843655590", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650616309, "uuid": "9aca27d2-d5eb-4870-9c79-2b1c75f6249d", "value": "Halkbank_Ekstre_20220327_073712_983787.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b8ff4a8-c290-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650668688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650668688, "uuid": "058f649c-adf4-47ed-b848-4bbd0e768f35", "comment": "Malware payload", "value": "81521ee2b8bacfb325ec554594330304", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650668688, "uuid": "ea6bbc97-f261-4034-bceb-e86a88e7e634", "comment": "Malware payload", "value": "ba0839de4cf012cda37f643430c3f217a7bb923ef90a7681167c353ee7267935", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650668688, "uuid": "c236d733-933e-4a0d-8138-e27fbd2319d9", "comment": "Malware payload", "value": "8cbc16a9015d262e5cf110e17b73b04a0e7a2bc9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650668688, "uuid": "ccee3942-8c95-4568-8d6f-49f4680764d3", "comment": "Malware payload", "value": "a2a010b2f27c11f821ad6945e8fbc3aed51dc9714d639889fbcdc6f591e5b93aa0ab8709e21e2892afe000b58cf6780a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650668688, "uuid": "c6811129-20c2-4133-8862-c1f4ab8cd634", "value": "T177C46C11F6AC80B5E07BD13DC9A3865AE6713C984B7943C79251EB3A2E736E15D3E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650668688, "uuid": "1a10a651-c41a-4deb-8774-e310b3ccbff4", "value": "6ba79cbed2acbe9b8ecc8e14a572f100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650668688, "uuid": "4d2d49fd-0aed-45ae-81f0-36a83410b780", "value": "6144:1oJyHSfFIDAqBcJ6EkVgNazgHH6mXZOs4z7N9nAsieHiL7iinzGCvCsP5OtZ:C1FIcocJwMTHzXO7N2sBHiyzskZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650668688, "uuid": "34a3cd65-447e-4f38-9d7b-5227ecc9152f", "value": 547125, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650668688, "uuid": "a42b7579-92f8-4378-b335-46a4d4c4f54a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650668688, "uuid": "d4144328-26c3-4eb8-9e76-1420d47105be", "value": "81521ee2b8bacfb325ec554594330304", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d88541b-c248-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650637767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650637767, "uuid": "04f93ad1-c671-4d85-a030-7000c55db0e1", "comment": "Malware payload (Mirai)", "value": "3cbcfac2e2718bb4158b09fdd7720068", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650637767, "uuid": "90f59459-9b2e-4127-bef8-35c8ac03f0a2", "comment": "Malware payload (Mirai)", "value": "bb852aa99574a2ee4ab847a61ddbd231a356fb1f6d6c09ac65bbb6c9b8444e45", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650637767, "uuid": "8de9fa26-9113-445e-9798-6acc45422248", "comment": "Malware payload (Mirai)", "value": "fb522b670e2438931e1078cbc3250fc468c18580", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650637767, "uuid": "aca03921-2f3e-4022-bc9a-6b53aca1668c", "comment": "Malware payload (Mirai)", "value": "1f6042476e562b6ff8943f2d8c4072325a1dd6d5224200a00e51994ab9103153a32e9b798abab27d5faa7317f57fae2a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650637767, "uuid": "79b54d81-b486-4254-b9dc-bd4d16c9651b", "value": "T101A3F896F800DFB7F40AE67604D34B24B670BBE14E532622731739A6AE762D53823F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650637767, "uuid": "02bc55cc-21a4-4a3a-b204-a8ba1adcd76c", "value": "3072:Vgdr2vIBAxMyAOLRcftchOemuxVqDr78fz1e:Vgdr2vIRyAYcOhOemuxVqDr78fz1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650637767, "uuid": "b9d85be7-33ad-4811-a66c-b6c3ba5db790", "value": 98919, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650637767, "uuid": "ff69d12e-a13d-4dab-94e2-1890ac0633ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650637767, "uuid": "d3c752bd-8343-4142-9d70-a33413ef44d3", "value": "3cbcfac2e2718bb4158b09fdd7720068", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b0f3cde-c25c-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1650646111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650646111, "uuid": "790a0880-dc53-4d7b-b490-42ff001fdd61", "comment": "Malware payload (AgentTesla)", "value": "aa4c8aaf2a90c94bcf684fcf56a5d6ca", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650646111, "uuid": "5203a574-8494-48f4-874e-2cd492421fe7", "comment": "Malware payload (AgentTesla)", "value": "bc43be5068b67c7cc3c27c943ae7cf4b912112d57358b699584b5053a4684ebe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650646111, "uuid": "50b7608c-0a68-474b-926f-a89a49c3e7f8", "comment": "Malware payload (AgentTesla)", "value": "d86df4361ac4885dc7f5018e8a855a6b98f168c5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650646111, "uuid": "1b7af150-6392-4772-afb1-c44aea2f0fde", "comment": "Malware payload (AgentTesla)", "value": "5ef54c64eec67fa139421acd8f087bb2e9e7366f95438244e7d349a9d31b3ab9b54a92a0b504f1a6f2f3d3c01748571e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650646111, "uuid": "3cc3c390-44b1-487c-83db-4b44bb192cd1", "value": "T19454122477A4C837E5A22F704EB167261E93CE123070E60F2B515B19BDB63827D1BB75", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650646111, "uuid": "d2dc5c89-c6b4-4f79-86ca-8dab17ec2481", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650646111, "uuid": "ed44955b-f50d-41ce-adb9-d01dcc091658", "value": "6144:HNeZm4SJnpznORfqNj4a0If8KrMCaMnPv2P1z4wtfF:HNl4GJ+qNj4i8A9aZOyF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650646111, "uuid": "6e0c728c-afee-40ac-87c8-515a6018d373", "value": 302136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650646111, "uuid": "c6824f21-33c4-4763-a114-02863edd15d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650646111, "uuid": "db58e114-d137-4d11-9aac-c6ebd1129ac7", "value": "aa4c8aaf2a90c94bcf684fcf56a5d6ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adc8be4d-c21a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1650618038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650618038, "uuid": "5a88fec4-3031-4ed8-9388-c249dcceba44", "comment": "Malware payload (Formbook)", "value": "4ca1ef1c67c0d58257831e2bfcf1616b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650618038, "uuid": "30e9cac0-2c84-4360-a95c-27aaf231128e", "comment": "Malware payload (Formbook)", "value": "bc767e2f69ca58e64b6b08b6b0e76613bd19d61cf2682443cd5a78ae4e67572a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650618038, "uuid": "bb8da639-5b52-4b2d-a45d-75bc0a952491", "comment": "Malware payload (Formbook)", "value": "c3e39b4b0b414c67d943e3e204f006ab4f274be6", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650618038, "uuid": "5d5cd9b6-c753-4492-ab50-0def5d680df0", "comment": "Malware payload (Formbook)", "value": "aa696df22d500355a6fa5c72d2c05f457e80522a58c56ef716851e8d237ad468004d9b1f6ca8d9f9c1d65628a4a48761", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650618038, "uuid": "39bcf0d4-8818-4906-924f-549e09b4281d", "value": "T10AD3F10C46E9D59CFD62A5F8D69808301AB9FC52E3FA20450638B50DFD76FE2B8D5432", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650618038, "uuid": "5d5d79a4-2ec6-4d0b-b9a5-12560fc35cc4", "value": "3072:0/wTalEpbOdbVdObCtOQ+mDGHM3vt9hM3vt9lNX:ywulebGGCgQMHWtDWtTd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650618038, "uuid": "a5382a15-96ce-44cd-b93e-afe6737ec767", "value": 135168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650618038, "uuid": "2c616be8-c41a-42a5-8cc4-86bf86d82307", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650618038, "uuid": "ea778b15-6926-41b2-b470-163dac2f25dd", "value": "order I 018629.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00717126-c286-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650664133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650664133, "uuid": "876548b1-787c-494a-91d1-7e193256f4e1", "comment": "Malware payload", "value": "e759c57fef989e9230cf121b31e077ec", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650664133, "uuid": "b4648f2f-cabe-4d77-b596-89442d73e361", "comment": "Malware payload", "value": "bc84d7201f37b0c02ff742f4b8c5d78412796676724fc0af530975dac2fff063", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650664133, "uuid": "a3d216c3-9bd3-47d2-84a3-96593f078e5d", "comment": "Malware payload", "value": "434f3d7d49a06606c0fb73e1a2378836f2018338", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650664133, "uuid": "9c2b8d90-ce19-47af-b59a-2fba385ab342", "comment": "Malware payload", "value": "88d87ea24881c74f2f01040c8835b0a051e5ce23b11acf33cfbc2b1d2b540b5ef9399dadc7e55d3f3dfa620fe2ef1aff", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650664133, "uuid": "821f3c8d-73c6-4f18-9798-f8e6a061e628", "value": "T13D51BBDA640176D4F90B149DD833F10C932A66F018F4F53AB87DE79703296D835C257A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650664133, "uuid": "39d29684-ad26-4961-bbc3-e777d52400d3", "value": "48:MfVt7cfvWOOLbbfFrcMPGJv3yxhsqTNkTBMF4EEPC6FqfJrwy0H:u4uLfhzGNuhs6N22F7ACXfaTH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650664133, "uuid": "be7a8ae9-232b-41ed-a478-f17afd31420f", "value": 2847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650664133, "uuid": "ff4c1f4f-f861-428e-9ee6-c8050f75fe44", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650664133, "uuid": "fe4665b0-c507-4171-857f-7080e0276b11", "value": "VEuIqlISMa.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45a50363-c211-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650613998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650613998, "uuid": "4d1d7cc2-625a-4189-917f-7cb1ae72e32e", "comment": "Malware payload (Mirai)", "value": "41367af58f3f290f2a002c408f01671a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650613998, "uuid": "1d59ca3d-799b-4333-bc7d-d6a18c369f0f", "comment": "Malware payload (Mirai)", "value": "bcf1671cfc51f7c640d41a5d1ebcd1c220fae759b665a40de140c969568eeec5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650613998, "uuid": "9f2d77fe-0489-4241-bb73-1e56411e7c6d", "comment": "Malware payload (Mirai)", "value": "68633a48cc7980cb3275cf5321f8b456fbc804d2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650613998, "uuid": "19556556-a376-4151-b509-7b27adb04083", "comment": "Malware payload (Mirai)", "value": "04af4d5028e5276c856db5acab9c65d99ed11ffa2508d4f827880ede1b290b6d9d46f36dea77a8609b4b8684755862fe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650613998, "uuid": "be9bf168-004f-46e4-aa10-ca61d8bdfcfc", "value": "T11843C81F2E219FBCFBAC863447B79F219658339626E1D585E15CEA011E7030E345FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650613998, "uuid": "b69bf373-3b46-4399-b816-7900d9dd1563", "value": "1536:GoriiYzqCJPKjYMZ2vnQevH4ToLWOnQ+nl2CG/h:GoriiYzqCJPKjYM0vQeNWj+nl2CWh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650613998, "uuid": "7ae58ea5-0326-4482-a943-ae5a5196a166", "value": 59948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650613998, "uuid": "e80bc945-e982-4bea-a383-cd6e980654b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650613998, "uuid": "a419d451-4da1-4ce3-a0b7-df0ac04ad132", "value": "41367af58f3f290f2a002c408f01671a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3f36e3a-c24f-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1650640811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640811, "uuid": "39dd7d02-0fba-4e68-8f94-7e7fa534deef", "comment": "Malware payload (NanoCore)", "value": "575567c82019aed7c25f206c8abf6eb9", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640811, "uuid": "d819e6c8-7382-4b4a-865f-49aeeb1880c0", "comment": "Malware payload (NanoCore)", "value": "bd89b13a305444bd9d4a771824cada6cb1d195dac93e8b5b708f3e223d6821be", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640811, "uuid": "8b5e07ce-9a99-449e-b0d9-1c51e040dc44", "comment": "Malware payload (NanoCore)", "value": "1755d1e9ce94980d34682d5b63e44599b650c3e0", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640811, "uuid": "e09a79fe-f6f9-4e0a-88a8-8075547d5c24", "comment": "Malware payload (NanoCore)", "value": "b0175c08eccc0212600515bdfb8d5ecfac8cbd759cf1563920949e4cb56b1f37a0307e405f60ab4af9051c9aa682776a", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650640811, "uuid": "38294953-c056-42e2-9f03-525c2a7d9b39", "value": "T1D6C4121277E2E190C8ACAB3614D2408B83F5DA474318EB9D186B52FB6B71791635FB0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650640811, "uuid": "488c2aec-8b05-4169-822d-d92d338927aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650640811, "uuid": "6c526727-04b5-4993-a8e2-69041426fa84", "value": "12288:PwLf/aHtwwI/DO+Y8Z6w/TBvNnRhgtGzBJaAhQ0SUtFeatZAYtv/h:kiNwwIa+3NnR32Y7ZBdh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650640811, "uuid": "18734a0d-e42c-4859-9e78-d7c234f610f5", "value": 586752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650640811, "uuid": "ab4b75ac-7357-435f-b94c-f7cd5ee608f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650640811, "uuid": "2292c80e-bd3a-445a-9002-052fb6daa9ad", "value": "DHL\u90ae\u653f0008493118480000008790098.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "629fd2e3-c253-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1650642393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650642393, "uuid": "f05b6dea-0180-46e1-92f5-18c8a657f52d", "comment": "Malware payload (AgentTesla)", "value": "9c1fc2729bc6f97c3ec15ad05befba07", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650642393, "uuid": "50f9bbd5-216e-46ba-919a-1b7b634665bf", "comment": "Malware payload (AgentTesla)", "value": "be004d212c8eb5d42d4756b83403c4420c3c68aec665d39beef9caa7bd28d7c4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650642393, "uuid": "33809b0b-c365-4dbb-b975-a7354dfb0eb5", "comment": "Malware payload (AgentTesla)", "value": "46d7318f825ac2580912730c1e41523c5d6c87ca", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650642393, "uuid": "e7120dc3-3105-49ad-bde2-1622a7be2460", "comment": "Malware payload (AgentTesla)", "value": "37d25f2c2d841a6c308edd0f7486f176d6ae0d6722c38954f759d0aa2269eb015b8c869b222ab7f2efab7b1a26b163a9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650642393, "uuid": "36141f33-3339-4e34-8a1c-ff290aa62ee0", "value": "T1504307A20204EC59EC2206334475560F53A65C0A5B7F9ACF3C7FB695DF3D2A3672B24A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650642393, "uuid": "c1a4253a-ba81-465c-a7a7-bf91d9d40df5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650642393, "uuid": "7f87496e-4e71-4c51-8057-1e4f559f3e1d", "value": "768:vIJD/mtMVLXAC7I0XwoVaO+BKyb90ZcZzmnH68yX541Ni7mSpg0rHStYcFmVc6K:vIJZxwuLXYOmava8y5aNi7mSp5+mVcl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650642393, "uuid": "2e7c219e-cfd8-459b-ace1-4aad45434bdc", "value": 55808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650642393, "uuid": "695bd544-9dbe-494d-aae1-342511a9e5ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650642393, "uuid": "c9062660-9eed-4654-84c4-a8d2c1f81223", "value": "SecuriteInfo.com.Variant.Strictor.271095.20507.20015", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa403d0a-c22b-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1650625333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650625333, "uuid": "7b042c66-e6e4-4045-9ce3-61b3da48c508", "comment": "Malware payload (SilentBuilder)", "value": "0516cac2dfe378e3a88fb018e92ef053", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "pw Z0zh762", "colour": "#1E0B4C", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650625333, "uuid": "bcf1d8a2-35a2-48a0-9918-f5d2f5b41fea", "comment": "Malware payload (SilentBuilder)", "value": "be342cef8ef3b77c71b5245792a927700824fe78ef1a20e168e30c50346bc7af", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "pw Z0zh762", "colour": "#1E0B4C", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650625333, "uuid": "5da7a75e-f56a-4c60-bfcd-1d0f5908b2a0", "comment": "Malware payload (SilentBuilder)", "value": "69be33ab6d41c5a421f600b1abedb0b31cd8f745", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "pw Z0zh762", "colour": "#1E0B4C", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650625333, "uuid": "8bfeefd7-7bb9-4e21-b9df-62233adf30f0", "comment": "Malware payload (SilentBuilder)", "value": "ea2a95325843ee782ba35c7ff28ee1bac72428285bdcc8ae164e68b89be6614462fd467c4f913939c95e23c7719dcfa4", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "pw Z0zh762", "colour": "#1E0B4C", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650625333, "uuid": "f95215ed-7fdb-4feb-a885-fde230d60cd9", "value": "T10D23B646BA5D9859E9258B7548E743E9B333FC201F6B0B833616B3257FF49E05A03207", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650625333, "uuid": "6ad256af-5132-4b24-8efd-a0dc47e8538d", "value": "768:4DM52tfQXi8vgLZkTOHkQT51Vp6AwPdM8gQ6JT5X6DGwUdh+pqjeSLjcvLtzrxFK:462tfQXi8vgLZkTOHkQT51Vp6AwPe8gv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650625333, "uuid": "03d64746-4ac0-4804-9055-ad8424576eb4", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650625333, "uuid": "5d4d87dc-cd73-4791-85a3-faee863c1238", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650625333, "uuid": "e02d632c-63a4-4aa8-8496-3e283730e9dd", "value": "SCAN7161_0002.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a474a1ed-c236-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1650630048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630048, "uuid": "8b56a7cf-62c3-4827-b531-788574dbb5d4", "comment": "Malware payload (SilentBuilder)", "value": "dae2d077fbbd6e6f6e1f169a00794dbb", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630048, "uuid": "eb1bb752-e2dd-444e-ade5-79008f6d423d", "comment": "Malware payload (SilentBuilder)", "value": "be91af9565fb0a9031e3ac654188ec258bfec32c82815cf27be34055245c9285", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630048, "uuid": "5e408676-3f8d-4172-97bb-dea29c153e75", "comment": "Malware payload (SilentBuilder)", "value": "0a88a95ec197da39ad3a53f0c3a7e63c4185de30", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630048, "uuid": "0c98cbfc-5d95-440b-9101-ad40eab7ac85", "comment": "Malware payload (SilentBuilder)", "value": "9602795b772a71f0e83672852b5b57241f6f8c3728ff5a98c3cad9127b93fcf98d751f20d9064cead0d8241ecb1b94bb", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630048, "uuid": "0981fa93-9efe-44f2-920c-7e715f2bd8af", "value": "T16723B646BA5D9859E9258B7548E743E9B333FC201F6B0B833616B3257FF49E05A03207", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630048, "uuid": "8c044b66-f466-4a28-9138-bbc6db9bce0d", "value": "768:4DM52tfQXi8vgLZkTOHkQT51Vp6AwPdM8gQ6JT5X6DGwUdh+pqjeSLjcvLtzrxF6:462tfQXi8vgLZkTOHkQT51Vp6AwPe8g/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650630048, "uuid": "2fd9dca3-aa32-4937-888f-9d3af938d893", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650630048, "uuid": "6fdfdfc7-41d7-4cd7-9d69-8bc3a7579da2", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630048, "uuid": "38cc0450-4dd0-492c-bf48-7fd9dc4e70b0", "value": "BACS Payment info, UK.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b7e6fb2-c22e-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1650626463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650626463, "uuid": "75f75345-d655-4230-ad6d-d6c9f8da1c29", "comment": "Malware payload (SilentBuilder)", "value": "36b0f3d5e31df279ae732bfc2e754e2b", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650626463, "uuid": "eb6dda3c-76e2-489b-8962-3621fdcf18f0", "comment": "Malware payload (SilentBuilder)", "value": "bfc04f3644ea1ce23559f600068f0b0fde35fbc6936e23e4b9431ac3782beff3", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650626463, "uuid": "caf8e51f-84aa-4d20-9a79-70844fe821ca", "comment": "Malware payload (SilentBuilder)", "value": "5cdbaecc65daea905283bfd5b020d1d54c5b197e", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650626463, "uuid": "91ae8c1f-b703-4252-93f0-304a8f1c7889", "comment": "Malware payload (SilentBuilder)", "value": "182ba433c30aaad5684991ddb8057f7bc23867876fa8aababd880219a2492693c53f4b397cc6817b846c8f47014910da", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650626463, "uuid": "fe367e26-e1c5-4b9a-94c3-ba4811f3a7b3", "value": "T19023B646BA5D9859E9258B7548E743E9B333FC201F6B0B833616B3257FF49E05A03207", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650626463, "uuid": "d75f515f-af96-4e99-8960-081a43b77cb2", "value": "768:4DM52tfQXi8vgLZkTOHkQT51Vp6AwPdM8gQ6JT5X6DGwUdh+pqjeSLjcvLtzrxFa:462tfQXi8vgLZkTOHkQT51Vp6AwPe8gf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650626463, "uuid": "ff008b84-a4fb-4cdc-b33f-89b5e860bdf1", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650626463, "uuid": "95899230-6d40-4045-b212-cf92aa331c3f", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650626463, "uuid": "94e93144-560a-41e5-b73a-551d581c7914", "value": "Lastschrift.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "791f27e8-c257-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650644149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650644149, "uuid": "01beac81-3ebc-4f5b-a8f5-c969b2e96fb2", "comment": "Malware payload (Mirai)", "value": "947a9d4cb09c40c7fab97b1a2c5421e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650644149, "uuid": "2c9a97e2-77d1-417d-bbd2-66102d1a66a1", "comment": "Malware payload (Mirai)", "value": "c17348bd3d09e2bc28f92de1bf8ebda4fed4673e9354b50b99e2959848e529b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650644149, "uuid": "55b5496d-a046-434b-beac-600f922c97b9", "comment": "Malware payload (Mirai)", "value": "670c3ca023a51923a4f57d5e8e8d5a84c0a4766d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650644149, "uuid": "5c04167f-5b95-4a7a-9801-a4f4fab4e333", "comment": "Malware payload (Mirai)", "value": "7ce05016a53d369f5fa4cfebd5dc0d9ac71f327ad7e63f40369c2cb9ae963f59f2609288e72fa2e59de25e7f93489c65", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650644149, "uuid": "a4e93f10-45d8-44a7-a898-7d5b23da7550", "value": "T12EF3F705E85653ABC3E327F5EA99438C773A166457CB33216D342EB83BC0BD82A79570", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650644149, "uuid": "45fa20ac-4e3f-434b-83e2-d4daec039ae9", "value": "3072:ymJ3ijFeRLAkup5hhdHQbjnWWiCvNqLmLN8QxvD8RvKr/:9UFeekup5hhdOjnWWqmLN8QxvD8RvKr/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650644149, "uuid": "68110148-b59c-4444-9b72-cb9a02e0e3a4", "value": 171308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650644149, "uuid": "687164dd-1851-4b7e-8ca0-92b51c61fb37", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650644149, "uuid": "142a5744-22a3-4a19-9779-170300841908", "value": "gnat.o", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84e00c85-c221-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650620976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620976, "uuid": "a3cece7e-3cff-475f-be56-57b42974eabc", "comment": "Malware payload", "value": "8c8a800320ac0bc0c22f652d88c5d312", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620976, "uuid": "c14f7925-bb55-4636-8268-36d154a34944", "comment": "Malware payload", "value": "c1923300ea75eee8cd4d734262287b8bed6e3f45bc6ea33f0d89730154c9d3aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620976, "uuid": "4fd3d989-81d8-458f-b38d-bfbc31d7c6a1", "comment": "Malware payload", "value": "0e89961151c2fa9e0bec033aa95ab9e2ece36c8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620976, "uuid": "46625f8a-81ea-45e0-a1c3-dd507b9fe991", "comment": "Malware payload", "value": "c2ccccd4e05b509ac943adcd1b03417ae9882669f56cfd138bb5f2edf535328b44839c7f2e73ed0e9c3ab08d6665096c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620976, "uuid": "7145c4ca-a08f-4b80-a85a-c3b33432b6ae", "value": "T1EBC55B23F384693FC06F073A05A7D6589D3FA6616B528E575BF1184C8E363813A3BA47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620976, "uuid": "f1a0621a-c23c-4fcf-b4dd-dbb4b5ad8cd4", "value": "36bc2f18c5155dbc981052c93e36f054", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620976, "uuid": "ae42a38f-cff9-4e1d-b29e-96fd4be2c895", "value": "49152:4FEFJdx8qVw9Ak2u1sSpD79xsG1/v19Tu9rlE0x+gA:4LPAtSHli3PA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650620976, "uuid": "bef5703e-8735-4526-8a11-cbb56b7b085f", "value": 2703872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650620976, "uuid": "5761651c-ca48-43a0-b6de-6af6ab8a778e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620976, "uuid": "8b402905-9ee5-475f-97e3-2ecbeeafe9ce", "value": "SecuriteInfo.com.Trojan.DownLoader30.7093.14663.13503", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8c77a66-c24b-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1650639209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650639209, "uuid": "635e2da1-c665-484a-8223-0847e2d2a884", "comment": "Malware payload (AgentTesla)", "value": "408bfea84abc193d8ab0648133146370", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650639209, "uuid": "f6c3fafd-6bef-4bad-81a5-2267cf5f8b3c", "comment": "Malware payload (AgentTesla)", "value": "c21d98b14bd6be43d4ecc4cdaed93b309043c07a9d4653e05bd952006f8b6597", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650639209, "uuid": "31be15d9-90da-44c2-a122-9832fa831f14", "comment": "Malware payload (AgentTesla)", "value": "157642332241c9272f5a11e32525ef9b8fd9de13", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650639209, "uuid": "2cb1c8be-b4da-4eb6-9143-ed86df10c455", "comment": "Malware payload (AgentTesla)", "value": "ae7d37783e8f909ff121f683ccd0f4b94e024503317fff4bfde3057d2054fa92064f0a27c3c616d0667879b4f012f948", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650639209, "uuid": "0ec68f73-5bbf-45f8-9eae-f0da148926af", "value": "T1B3D49EE2CDA0254ED9649B38E0C3CCF0E5DDE148656E778874704B172E9D3C0DADA7AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650639209, "uuid": "9c6910e1-3185-4595-a734-a174e18fbc4e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650639209, "uuid": "ce29996b-dd05-42df-9b2b-a595cc95c784", "value": "6144:m97D3UiXZrPZ0zR1StGb4uoS523fjocSiDkHono0vPJhrbEyMtqXknb1k/5mjHq9:mrJrxmSp+070N2oKP3HExsy7gj5Hhx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650639209, "uuid": "b2446859-efd6-47d3-a1ae-0a98bfd38323", "value": 629760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650639209, "uuid": "7b72dbbf-556e-49ca-8b4a-cb96c007c0ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650639209, "uuid": "14345dd3-fcb3-428a-bf46-1320eee3bacc", "value": "SHIPPING ADVICE#ASEAN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d0d8014-c21f-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1650620157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620157, "uuid": "e4c5b033-d47c-4afc-bf0e-b7689e0730ee", "comment": "Malware payload (NanoCore)", "value": "b899b5ba6debf493d9179095fb4cb171", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620157, "uuid": "b63dbb43-e1a8-4145-96ab-61ae19b27d5e", "comment": "Malware payload (NanoCore)", "value": "c23671e743f8c4029ec2fdce97b4784fe32de87f6125a5c7999486fbac1286f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620157, "uuid": "890b4754-6e7d-4a0a-9a9d-6d93a2326354", "comment": "Malware payload (NanoCore)", "value": "d148073a0f61c1a1af5f80c594d494b691ec2e7f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620157, "uuid": "dc7d531b-dd29-4442-a923-30e10e96f4fd", "comment": "Malware payload (NanoCore)", "value": "d2ec9ff5f707689eba880db223ea05fc9ca3b710cb94c19d1773d8b215e38214efae3d56a591ab293eaaee97bf2ba08b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620157, "uuid": "99540550-c7d1-4469-ac0c-b3c660d6b085", "value": "T1D2B4822CFAC136BAEF1DDDB069210B07BB2E0BB3D24069A1978F25D7979F0551C14C8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620157, "uuid": "bf4e7814-7223-4495-91dd-f7a829a621c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620157, "uuid": "aa75ab26-1e9d-4df1-a79c-94e39ffa7cf2", "value": "6144:l+Yt3fvqMDlnrRD1ET/+MaCdoWJsLaO6OWccZeIHED/NZb5iJsKOxIG:0QrReaqsnebHSziHOS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650620157, "uuid": "30fc86d5-5a5d-4a12-afb4-3db95f3a6a73", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650620157, "uuid": "059f4f87-6960-4527-84f9-e96014889779", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620157, "uuid": "ab971cbb-a8a3-46fd-9a21-f7c93b74cf0d", "value": "Process Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc4cc24e-c23c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1650632692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650632692, "uuid": "5b178624-a28e-41d5-bde7-e2de927b7ae2", "comment": "Malware payload (Formbook)", "value": "89f6bd7649ea09623d24d839239813d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650632692, "uuid": "b0b4becb-8f71-4391-942e-ddbb395cc747", "comment": "Malware payload (Formbook)", "value": "c2b1ec7b7936aa6af8f0c260cbde7b0b53b4cf6159887937ffbb69416fe17f7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650632692, "uuid": "9ab82a87-e3b7-4753-852d-08e4d671b943", "comment": "Malware payload (Formbook)", "value": "81f817ae9e06380b0a678f34b2dcc7af21ac360d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650632692, "uuid": "b2bdb39b-83a1-4b97-a56f-1d6fe2c15178", "comment": "Malware payload (Formbook)", "value": "fe4c08f85fda86adb25afef46fe01b48a62c5594d7a643db8f9115f2748be1856baa08bba9548a0e49c0ea6b68df5a27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650632692, "uuid": "8d6c2ab4-f0a9-419c-b5d3-65ee1622c943", "value": "T13A25A59DB2F072DFD467C9729AA81C64FAA07877971BC207902301AD9A1D997CF143B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650632692, "uuid": "ae215001-b049-4e3d-b680-7eb12c61fb8d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650632692, "uuid": "a88a8ebc-7f9b-436b-899a-b02850c51e64", "value": "12288:YGi5pE0NKG43qqPh80hOo/jIY+c4FJ/iSSOyKcp7+syW1/q/tSs/XFgS19LMKZ0E:JsGnlJ7dBKESXydp7+W8F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650632692, "uuid": "5011daa9-50c4-464f-9bb5-c2bb8e35f2bb", "value": 972800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650632692, "uuid": "385383f0-b5b5-41c9-a5e8-9a308f18378c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650632692, "uuid": "6c4adc09-1be3-4ac3-9b41-75762e38a66a", "value": "BL - GDLR01DMDJ3 - GADS - OLN - MT. GOLDEN LAVENDER V.01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f5d0534-c258-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1650644535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650644535, "uuid": "7510bcde-6584-4e5d-ada7-66c47199987d", "comment": "Malware payload (Heodo)", "value": "67afdc9e7e7878e6a016b3eea017a2a2", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650644535, "uuid": "213fe659-7842-41a7-a1ab-dc318d883946", "comment": "Malware payload (Heodo)", "value": "c2b7ed1c0775d0295c4b66b5ea89cd52549b6472c64219c3669ec13c5b4f2cd5", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650644535, "uuid": "e8eee340-c6e0-4544-a201-08d7b35557fc", "comment": "Malware payload (Heodo)", "value": "927ad89aaa3395c899b6fd077f237cfadd9cb6d8", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650644535, "uuid": "49506699-3b2e-4b32-a162-e0a0e7c6aaba", "comment": "Malware payload (Heodo)", "value": "5bcaee78d7f8d9caa04c1b69c30eec49da3d7d4d9fcbdfa9a81ac40cae54b802999238560c60dddeb1affab46fbefe57", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650644535, "uuid": "68f95a92-d36d-4e57-9bd2-4bc24bb80470", "value": "T18E23E116C9346C2EC73E8C75420839A171596511A8CBFB5932947F0D3B86FCB67AE19C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650644535, "uuid": "bce382d5-c3b3-4e55-b0a8-6b1c7d6dc469", "value": "768:j5WHFKfQzXTmbfRzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+UP6UCIHcX:jwF+OXabfFtT5fTR4Lh1NisFYBc3cr+z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650644535, "uuid": "3ee872c3-2e86-43e0-b9a3-2e460ee09ebf", "value": 47898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650644535, "uuid": "5c704d7a-9095-422b-af50-c75f8e00f975", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650644535, "uuid": "e30ae359-c355-47aa-b9dd-efa1200340d7", "value": "Recent money transfer details.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d6a7b94-c239-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650631190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631190, "uuid": "3bceb0e1-952f-48a8-902e-eca74e82fe29", "comment": "Malware payload (Mirai)", "value": "1f5659c50dd8301da7a0a12c2baaaffd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631190, "uuid": "a29dbdbb-c554-47a5-8c27-902dbb092d1b", "comment": "Malware payload (Mirai)", "value": "c3610430ded6938049912fcdd97ef1e570905260fcfbd7a959cb6cf613bcee7b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631190, "uuid": "b624718d-18e4-432a-9a90-90298a471a0f", "comment": "Malware payload (Mirai)", "value": "5bf4ed64aa29af5162de74d4609a603d808cce04", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631190, "uuid": "3aab324f-0711-45a7-8a99-c818b35bf49f", "comment": "Malware payload (Mirai)", "value": "8e7af1539a09875397e3bb31dcbcf32c05bfd8595befe9dc81e65d6f7bb559f33eeb2f1c0ad7b534687a7741659930e9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650631190, "uuid": "3aef8421-d36c-4baa-99c6-672ac7d67cb4", "value": "T1AFA34B45F8408717C3D327B6E78F438D3B3657A467DB3311AA386EB42BC17992A39960", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650631190, "uuid": "14ae33fc-5c05-4a2f-a9e0-3c05a7948fbc", "value": "3072:FSg+a6mRSO70Nq5hE/P5uNTmZuqQ4DPwXXtse:z6m8O70q5hE/PcmZuqQ4DPwXXtse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650631190, "uuid": "e2c88297-d8d4-4a33-8a49-95cc6d54abb8", "value": 106024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650631190, "uuid": "24105803-7c00-4aa0-99c4-6e6b82f464b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650631190, "uuid": "4557266e-5845-457e-b567-e20d66545d77", "value": "1f5659c50dd8301da7a0a12c2baaaffd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3d799fb-c205-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650609136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650609136, "uuid": "3626819e-0a37-4a8d-80c7-56873e24d8be", "comment": "Malware payload", "value": "2d8cd7b18af83aea2cbfa4ea9a81c1e1", "object_relation": "md5", "Tag": [ { "name": "136-144-41-237", "colour": "#FAB5CC", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650609136, "uuid": "e8a9a5d0-857d-4565-8fcc-e4a7cd50972a", "comment": "Malware payload", "value": "c4831cc5f4f345f1b4facc9641e4dcb672ec85eb01ddb9cfba7749972d627e99", "object_relation": "sha256", "Tag": [ { "name": "136-144-41-237", "colour": "#FAB5CC", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650609136, "uuid": "3dc2c821-b707-4ea7-abdf-d6e035cdf311", "comment": "Malware payload", "value": "1ed4db6cb8d4216f902584ba62314c016f2d4f6a", "object_relation": "sha1", "Tag": [ { "name": "136-144-41-237", "colour": "#FAB5CC", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650609136, "uuid": "46bab4ab-9a98-4d9a-ad1d-d467a3d43e65", "comment": "Malware payload", "value": "2b0322ef8537f7b45010c035d43d21bd52fe92602cfc5da8c9845cd517fae8baeac12275e8f48aa6388be92e38d1dcbc", "object_relation": "sha3-384", "Tag": [ { "name": "136-144-41-237", "colour": "#FAB5CC", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650609136, "uuid": "81ef0b34-3180-49d8-bac1-c8111622f601", "value": "T13F51EF182BDA9A35E3F5CE3A98BAA35650277C42ECB29B1D00A4175C6853610A924F2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650609136, "uuid": "7a3b97ba-349e-4112-b6b1-5bad8453e6b4", "value": "24:8vJokIQrAeuyAh5J+/B5aislfNiSZs05QAdiB8aNVRf68oFyDRD1fab/23ZOltv7:8zIQQRvOnzSZsQV45Vx+yDh1fab2p9f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650609136, "uuid": "25760c57-d040-4aa4-8772-42a5bcf9a780", "value": 2567, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650609136, "uuid": "15a1d602-787e-4797-b417-fd0460b89627", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650609136, "uuid": "91750e6e-cb6c-4af9-b867-a42edc17f79b", "value": "video2022-04-15.mp4lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce044943-c20b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650611649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650611649, "uuid": "bba20eba-324a-43db-806c-00a10b1fe0dc", "comment": "Malware payload (Mirai)", "value": "a9063bee3ac493900fcabbc1158f7566", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650611649, "uuid": "f3ee67f6-fbb9-4b88-9d02-111eea83a02a", "comment": "Malware payload (Mirai)", "value": "c48d2d589049666bfbdb3905c04d8cb53559f0ef41ef921ab6c057ece07a50f1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650611649, "uuid": "68173f6a-09d1-4b47-a829-f2d2d258de72", "comment": "Malware payload (Mirai)", "value": "97edf0c3b0ff8edf6c7ab02e0f6347d1c5dcb00c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650611649, "uuid": "45d24c01-968f-4d8d-bae6-2f487f4c2385", "comment": "Malware payload (Mirai)", "value": "c7727a902ffd45bbb088adb7fdfc4620f4c91698494a649a8bf474121631ad4d9ab20c6bfe424ea8d3bdedbf60e06e77", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650611649, "uuid": "bafee6c9-58cc-4d0d-9f27-ce072f667d20", "value": "T11EE2F1B36C9F72B2D2F16D3DD02B0207528E693CF2A7408352D84A5E6ED1581F0BD19B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650611649, "uuid": "654fb1d2-72d1-4e7c-a548-3cf81675f1cd", "value": "768:60m5fUVCqX+DlOKGndHL0C47sKkWg4imv5BRJoq3UIFv:Q5fUYqX+xZ6re5kEnvt5V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650611649, "uuid": "6b750cd2-f03b-46a1-9996-6238d97c7a4f", "value": 32192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650611649, "uuid": "974fe35a-566c-42c2-9d20-c175d8027336", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650611649, "uuid": "96858d85-0143-40ac-81f2-1dfdb4f8621f", "value": "a9063bee3ac493900fcabbc1158f7566", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab0a05ae-c23d-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1650633065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650633065, "uuid": "8258517c-2f0d-497b-b1d7-6401453b4b3e", "comment": "Malware payload (RemcosRAT)", "value": "ee838d70fdfc28554c2a9ca54ea2b65b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650633065, "uuid": "ef83117f-05a2-415c-b3c5-435299b9d614", "comment": "Malware payload (RemcosRAT)", "value": "c49b7364946be75b36065b96b2b0d65753d6a443a89579f48c0e99aa4b9baddc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650633065, "uuid": "1788fd9a-bc33-4e41-85ae-4bc03a127631", "comment": "Malware payload (RemcosRAT)", "value": "d0ed25ec3e038a41b5d6d2f524753dac7fda4374", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650633065, "uuid": "30261a8f-64bc-47bb-81ea-52d1266d2269", "comment": "Malware payload (RemcosRAT)", "value": "a76e888f75df66163aeb003dda92c657ebe718a53e0e91d544746abe151b2f480697e764b58224b5ba4f497b64ca7c25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650633065, "uuid": "24eacd75-5f23-4dcd-a794-a59516ef14d5", "value": "T1A765AED02636564AEBF50B3550759BF22DA03F6503AFBFFE78D47B242AB4540E6002AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650633065, "uuid": "16129f0a-a75d-4f66-a369-cd7b0511c959", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650633065, "uuid": "6e94398c-1931-42fe-ab59-a4d5d5b6f46d", "value": "24576:Q6dBqCebfeuXVgOnZTg7aE4l+zov9heGj8RxtxBWtbHLW2xpFzDxqh:Q6dBqCafeEVVZTgjn8VheGAjtWFLtpF2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650633065, "uuid": "001ace80-d270-4638-98aa-c517fd391890", "value": 1499136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650633065, "uuid": "bf1c2241-f948-4203-8e61-fbd98c4d65a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650633065, "uuid": "61c850e6-b0fb-4868-8a1f-1ee28e3d8715", "value": "MV Tasmanic Winter.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed3474c0-c204-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1650608695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650608695, "uuid": "a7908371-f6b9-4019-ae69-1f2ce668cc40", "comment": "Malware payload (AgentTesla)", "value": "033077a0524109ac2c659c13a2241a05", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650608695, "uuid": "d07ac5e6-447d-4693-83f1-aa874c3af908", "comment": "Malware payload (AgentTesla)", "value": "c56b29bf89bb20786e552f160cb6495926c71ba441824f585af96c480f0b85ee", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650608695, "uuid": "5306a2e6-639e-4acf-856f-2a0270d95cf8", "comment": "Malware payload (AgentTesla)", "value": "e4a41dcde7b300be9d658fcaf77a0fe858949246", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650608695, "uuid": "13a59399-739e-4f4b-8695-14312331a978", "comment": "Malware payload (AgentTesla)", "value": "ef4881288ecb1a727dedaf64d6ad09077cf47ce900cc3ebf0d600f8a8b95b679b6165c2b0df9e2e6bf8f7594003d080c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650608695, "uuid": "8bd4a2f1-0d43-46d7-bcd9-7968f5529921", "value": "T160D4126022F48713C0FF83BE6C44850807F5A667A703FB0E6DA53D9DAADB7858D58267", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650608695, "uuid": "e9b3ccf5-e722-4465-b241-548d5a7c9b84", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650608695, "uuid": "8c7741bf-755a-44eb-abae-c02c9d86dba9", "value": "12288:r/56PXKrtkNPitqef9jv76rTus1z5OxRmriJTkFbu1lOY5:r/5AXS0PiZZ76+6QjmrOlSY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650608695, "uuid": "ec9e95b8-d4e7-47d2-8e04-e2e77b7b1dd9", "value": 620544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650608695, "uuid": "c0938b55-6f87-4262-9e60-b07c873aad4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650608695, "uuid": "cb09dc12-b672-418f-b085-0f7476649ec1", "value": "Payment Proof.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cc96e4b-c1fd-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650605366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650605366, "uuid": "97d9080c-5e20-41cf-acfe-a3a6893c7924", "comment": "Malware payload", "value": "f7e1572fd58c7ee8fab38da6c2e9ac1f", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650605366, "uuid": "e53f2176-4ab9-4763-987c-16b64a0d1474", "comment": "Malware payload", "value": "c58088246888e0225b777dec11202c639a0f77f4e18b940b86bf2a26adaaff0d", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650605366, "uuid": "f3b37396-d8fb-439f-9490-501f1ab82396", "comment": "Malware payload", "value": "362988763b5856c10d885c66a226b5dae2b1d11e", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650605366, "uuid": "a68c662a-94d9-4bb8-bea1-1100df1d25a4", "comment": "Malware payload", "value": "19c0583d34b728529ce97559845082e1c9360b36a7d90daf79e14af4a6dad0585075ea17ae6fa38d0f8f3b6379e0cdb7", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650605366, "uuid": "f016e32c-5d4c-4dc0-8084-4e95ee6e3ff3", "value": "T1829205243BB7864BE07656370DE2B094C5A6ED07284982FD3CA637EA0B319C37865773", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650605366, "uuid": "8d06f3bb-7b44-46ed-ad6c-cf1247fe5139", "value": "384:LSH6f3TXuT1nwLwg1eRMkL7UPav6K3CP8I8FAlUI:LyauT1wj1eRMkL7UCCK3tVM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650605366, "uuid": "95200b99-fc5b-407e-83a0-0b6f514ac5f6", "value": 19784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650605366, "uuid": "0f5e376b-9754-47b2-8b1c-04dbf7addbe0", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650605366, "uuid": "6163f3ab-ebfb-4d87-a00e-4ffdec91f4d7", "value": "Solicitud de propuesta EUI894BU46335.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e931c19-c208-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1650610254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650610254, "uuid": "6c0b0e05-4beb-4837-a303-d838dbbc0b32", "comment": "Malware payload (Formbook)", "value": "1a30e2b5c959cc9db8407752c534222f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650610254, "uuid": "59dbbd1b-629e-430d-8577-6b02b3cff509", "comment": "Malware payload (Formbook)", "value": "c5c8180f00302bea214a09a4913701a9fd3a1858b8a309e378a29ef1f46b69b8", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650610254, "uuid": "31d777d7-4324-4ede-9a27-1d65c5732d59", "comment": "Malware payload (Formbook)", "value": "aeb1939e97c24f380f839a566b900b8be411510d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650610254, "uuid": "237ae344-e33a-4526-8135-fa076f82ae92", "comment": "Malware payload (Formbook)", "value": "eb1bcbba626eab217925b1bbd725437ba40517a50311ea6f149812d9f2ad6b08a762f566a4d4bd1f59290e5d0b9564ad", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650610254, "uuid": "30bb0aff-f2fe-4ee9-b32e-bf3ef573a75e", "value": "T1BC52C05FE0D013A4DA66F4786B35ED7C84338DE1767B30879E2694C2B26629707C902B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650610254, "uuid": "8b00ee19-e1c8-4740-9697-853e619eb4a4", "value": "192:P2MjiiyxMjZ9l6zQkG7fkBzrI0sLIHFPSdou3Rd9wV7Utq+dtYGTvZ:B2iFeRTBzr7Du3f9wV7l6YGl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650610254, "uuid": "5f089300-0738-41d4-be4a-dd6536a07490", "value": 14372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650610254, "uuid": "5dc8be13-383e-4f87-8d24-b86f195d8931", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650610254, "uuid": "7c8983af-6f39-40d3-83cd-75e3e1474c16", "value": "PO-AO XIANG FZCO.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e9de95c-c239-11ec-8e58-42010a9c0032", "comment": "Malware payload (DCRat)", "timestamp": 1650631246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631246, "uuid": "4acea7ee-911b-4e86-b2b7-a73ec006a911", "comment": "Malware payload (DCRat)", "value": "0f84dc869642e62d425cc2d3df505553", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631246, "uuid": "cc40e282-f7c5-43a6-8dd2-7c0efccb7b5c", "comment": "Malware payload (DCRat)", "value": "c616793260c58751e4c47d5eec20cdf62c4b68971676d0325ca07b83b129cc25", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631246, "uuid": "0ddb820a-e710-4f71-b11c-8865474f8d9d", "comment": "Malware payload (DCRat)", "value": "f9cf1525cdc546aa06ec871ec662e307806f7691", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631246, "uuid": "abd4d0d6-694c-4ab6-be7d-e6312f006e4f", "comment": "Malware payload (DCRat)", "value": "a8d66e3db54d4bf73556a748927334d7fe5e22351c7e6f0db3b3a236e4476e7abe92ac961d07d44f1cdb7fc2ffd8e68a", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650631246, "uuid": "23245d4c-b743-4676-b8e5-2622fab6a0fa", "value": "T12B254A067A56CE23D0690733C6DFC01843ECBD42AA66D75A7E4A339E62013E79E4D5CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650631246, "uuid": "10bc86de-30db-4ba8-a03a-3065044bc61e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650631246, "uuid": "e210878c-b248-4f69-ac1a-677ee59fbd26", "value": "12288:G6eKPvuGeDVa5Zwzb+8U4cMcGQ3RIsHMvJs+FFUfZJt/BgycSiAyQrCr:G6PsIZK+H4XxQhIsHMvJ1Q/ZBgyjilF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650631246, "uuid": "d7ce9658-520f-4215-b4b1-a1e7158c58e8", "value": 1049088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650631246, "uuid": "70d13888-171a-4bc1-a644-7d216218befe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650631246, "uuid": "bbac6c6a-4111-4392-ad31-a38d62b90a4f", "value": "0f84dc869642e62d425cc2d3df505553.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fa0a1f1-c270-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650654736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650654736, "uuid": "1cc0dfc5-3ae6-4abc-adb5-3fbecf0df0dd", "comment": "Malware payload", "value": "8e7115ea580f39c152e4d4bc4472c402", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650654736, "uuid": "3a889af7-7976-4443-a3cc-ecb89da81f16", "comment": "Malware payload", "value": "c65c51ed60f91a92789c4b056821ef51252baa2a1679a6513ab008acf0464ccb", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650654736, "uuid": "2653f053-97a4-4b56-8622-b9e3aa9b0f52", "comment": "Malware payload", "value": "4ea1f1d8a01f251fa5db350f72b04a1d11028fb0", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650654736, "uuid": "d51f8b0d-9d07-412b-9afb-244e31068196", "comment": "Malware payload", "value": "9002d83ebcdfb06f5dc96d91cdd29fbbc598988628186770f65eb1e5b6e72846d579e5c0e7422bc49b396ef6868f96c5", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650654736, "uuid": "ffaec83a-94c9-4a24-a425-5e7602c3d57d", "value": "T1DD066CF69CC8A15BBC54ECCDF736C570409BAD09F9DFC80789A4162B5888139E79F688", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650654736, "uuid": "43e17083-1dc1-4282-b40a-25d13d780237", "value": "a5d156f0c03955fd5c90a10345646746", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650654736, "uuid": "65a8d9b4-877b-466c-8497-8f534e6aad40", "value": "98304:XZo5q0spyUTJkqVnIY0z7ceiVNhPvpx3:XZwqlp51krrz4vp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650654736, "uuid": "752f4081-167e-42d5-ad48-f54baee52d7c", "value": 3846656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650654736, "uuid": "1dd1ec96-4042-432a-b22d-d739bdc8834f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650654736, "uuid": "a9c29c6d-8847-4d72-9964-d5b28b9308b8", "value": "mount.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a764609f-c236-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1650630053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630053, "uuid": "aaad3d9d-0552-4a57-802b-3ec3d0f2c0f5", "comment": "Malware payload (SilentBuilder)", "value": "9981c87fc0ac17d3e352e7cb7883fe6d", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630053, "uuid": "ac744f07-bdb7-478b-9516-d3ff4d7412d2", "comment": "Malware payload (SilentBuilder)", "value": "c665dcc3da4fdaa955841c58ce64f1a1ce6cc0cd413e4bae028cb43213e14f9f", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630053, "uuid": "5541cad5-5196-4458-9184-a3e53967123e", "comment": "Malware payload (SilentBuilder)", "value": "abad03d6a5d9629e9dfa76b423834ed47930c2d4", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630053, "uuid": "8ff5cf70-70a0-4469-b9ce-07b3b74e89b2", "comment": "Malware payload (SilentBuilder)", "value": "b3734fad408a251fce599494e1dd83c696a4b54647cccfc43c7a21c7e79c0256d5fc1aaba4b154c51e335f4a8c35a65b", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630053, "uuid": "969ea09a-208e-4dcb-9fa8-0946c589d443", "value": "T1BA23B646BA5D9859E9258B7548E743E9B333FC201F6B0B833616B3257FF49E05A03207", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630053, "uuid": "cdb5d053-2ea2-44ac-92a1-bf37f17ae8c5", "value": "768:4DM52tfQXi8vgLZkTOHkQT51Vp6AwPdM8gQ6JT5X6DGwUdh+pqjeSLjcvLtzrxF2:462tfQXi8vgLZkTOHkQT51Vp6AwPe8gj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650630053, "uuid": "64f094a6-7749-457f-95a0-75b7585c6745", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650630053, "uuid": "7f200027-aba5-45bf-a49a-2ad46600d349", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630053, "uuid": "34ee135f-8339-42a1-8dde-fb8ae4bbf357", "value": "form.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ab5fc10-c221-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650621012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621012, "uuid": "5dcdeb55-0e3c-493c-aef4-bbfaf3b36738", "comment": "Malware payload", "value": "83fc59254b40cf97a719991d890e0869", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621012, "uuid": "cbb39aaf-42b0-4682-b506-0feb735f716d", "comment": "Malware payload", "value": "c6a0dcab51b81a3a221b81a7b931a46afcbd3905008b4b81d1c2b7f1be0094d0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621012, "uuid": "22279a8b-3f82-4c34-b201-e674a615a0fb", "comment": "Malware payload", "value": "2bffaf830e81a55a148454781e0926dd59dbfa32", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621012, "uuid": "ffa505bd-b05d-448d-87cd-dcdff380eb9e", "comment": "Malware payload", "value": "12c640988bd8e55c7a7d6142eb82c5164ab2f532b194c8137ffc4855f31b3938b6cdb7c0be3c1f5e51bb50b7638a353a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621012, "uuid": "43ca18b9-d5ba-4311-b2d6-3da715c0c800", "value": "T183467E16B644943EC02B1A39682B9678587FFB253A198D5F7FF00D8C4EB5A407A3B347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621012, "uuid": "1ffcba81-bfea-4b84-9919-6a063a0a938c", "value": "8c168447d0786a14100d566538b8c1ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621012, "uuid": "b27664c4-f699-464d-bad8-e0882ace24cc", "value": "49152:yE9xfwArGTGSztVPHjOWXTbP60qWFYbHfQ9ZHomPDD4D5H+f7WTrvUOm/iRBxN4T:y3AWXTbPVJYrQ/PDD4D5HWj4r4tWA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650621012, "uuid": "1be03c32-5f76-4079-b6ad-e257872e142d", "value": 5586944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650621012, "uuid": "5cbeeed3-3b25-4383-98f3-f1ba28cc1658", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621012, "uuid": "7c390228-8697-47e8-a795-e93f59229e9b", "value": "SecuriteInfo.com.Trojan.PWS.Spy.21535.28809.351", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba722f5f-c236-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1650630085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630085, "uuid": "6fe75b3c-cf56-4aaa-b2ee-905156378bbe", "comment": "Malware payload (SilentBuilder)", "value": "412b9f1f42a8071a879c68aef6f6b568", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630085, "uuid": "ece3e52b-8c7e-4fb3-b543-d77e642d298b", "comment": "Malware payload (SilentBuilder)", "value": "c6c2d224be50b8fa0a7ee58edd1556d9466d5e8f2e84cced1db92293857dc13f", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630085, "uuid": "50571c7e-def3-4fa6-a3e3-51e3ae97cda6", "comment": "Malware payload (SilentBuilder)", "value": "8a3a222b48c9369222f489c6de8283fb844934b7", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630085, "uuid": "b4c242b7-7009-4ed8-b220-5275e12a1fee", "comment": "Malware payload (SilentBuilder)", "value": "8b0ad0f4e9fce18b9f9c5b503265695518f44619beaa574e338c568b6db93be16749121d3b149569ea5fee1c28e9025f", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630085, "uuid": "c78e26fd-2469-4b14-a3c4-b5a8fbfbcfbb", "value": "T11523B646BA5D9859E9258B7548E743E9B333FC201F6B0B833616B3257FF49E05A03207", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630085, "uuid": "7edf21d1-bfc6-4ddd-83fc-5cd630620d04", "value": "768:4DM52tfQXi8vgLZkTOHkQT51Vp6AwPdM8gQ6JT5X6DGwUdh+pqjeSLjcvLtzrxFm:462tfQXi8vgLZkTOHkQT51Vp6AwPe8gz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650630085, "uuid": "e063b7c2-5a0c-4532-8c5d-4d2b13168ba1", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650630085, "uuid": "2407a57f-711c-4d19-ae7e-a0b3ff1f3081", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630085, "uuid": "7da64f96-8a24-40b1-8afb-ee9058df43dd", "value": "OMICS Group.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "432255d4-c241-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1650634609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650634609, "uuid": "0147010a-ef44-40d3-971a-847375cf8518", "comment": "Malware payload (Loki)", "value": "f0121b6da19bf09fa63cc54c82755e0a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650634609, "uuid": "56eb84ba-0dbc-4c1c-9faa-9f7e9dd5ad5e", "comment": "Malware payload (Loki)", "value": "c81a2fd387dc6469fce5a84e629054efbe7735e59b4013677521908b58efc889", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650634609, "uuid": "c3803a49-3612-442a-9cb9-dbd65e1bac98", "comment": "Malware payload (Loki)", "value": "2692db81dba3feb4bc16c0749e8ae8f5204a01ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650634609, "uuid": "4c49fdd5-36bd-423f-9b3d-b0a5ff87c240", "comment": "Malware payload (Loki)", "value": "c29962332020ebe28b202375a3b4416a0d89f6ee4e86e677822a1eb2a652e6a24c605a4e7ab5ac7bb4470628b103bff2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650634609, "uuid": "08d65770-1256-4cb1-9f38-38d0b8deb268", "value": "T15CE4E7ADB2F0769FC45BC87289641C64FA60BC67530BC207A01726AD9D6D997CF243F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650634609, "uuid": "e7cbeae0-3ee0-4d87-9d14-5bc42038cf70", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650634609, "uuid": "5dc38ac9-ad4d-4c48-8ecb-e42745233cf1", "value": "12288:2hwOQqs/G+7qNc6m0KyJltiE2CfWQzUkqg1Ge0VbbJzveGKomtQxkIs761kQWwmF:qRM/qXm0tKX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650634609, "uuid": "dff9a0ec-1d0d-4e23-9181-4049400f15d9", "value": 689664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650634609, "uuid": "3970e332-2508-4164-8d67-188deaae8950", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650634609, "uuid": "334db4a3-2544-4a39-ae82-2e8e75d7906d", "value": "Port agency appointment for MV OCEANIA_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "908bae30-c221-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650620995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620995, "uuid": "4a0ccc8f-9e96-43a7-856c-d995dc6b78af", "comment": "Malware payload", "value": "6e2a97c028d0fd919c0a1efa7892f069", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620995, "uuid": "807f1885-cd93-4394-92ee-c0deeefed8fa", "comment": "Malware payload", "value": "c8b8773c21dde03b658a997f52aaaa6f589184bf79c9bace40295de62794b78f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620995, "uuid": "f2a87c1f-b47a-44a3-822f-4aba996850c3", "comment": "Malware payload", "value": "9db97dea2ab459b68b3b0ba461772f3b680e6e32", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620995, "uuid": "2089f741-4af0-4332-9b29-6da681a81edb", "comment": "Malware payload", "value": "fcc3b5936e0f3fcaad82cba6155c57f0a847001840c3d2e566f31f308e4e9ea888252659392caa9e104361ef39bcc27a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620995, "uuid": "c37d35d2-49b9-468c-82a9-d6faf6dd1434", "value": "T11D365B23B244763ED46F0A3E8637EA14993F7BA279128C5667F04C8C8F39481767B647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620995, "uuid": "4799a424-f4a1-482b-9c88-cc3cbef0ae9a", "value": "7446cb8876221c8b32f6418f8d246a9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620995, "uuid": "cacb0948-f34c-43cf-bf8f-b91a31cd4b1e", "value": "49152:UTBT1ptv3ycUZISFzBPhGYBF5hhMYU4uMlGpVneXgEMdY3MG9TqVwjaqbi3:UTBTPb85hhMpTVeXOGmcaq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650620995, "uuid": "620e72bb-9362-409f-822f-d80da155d928", "value": 5060096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650620995, "uuid": "68e5869c-94ea-4897-9d41-a25dd01ec7f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620995, "uuid": "ca5cfca7-255f-4a0a-a245-58f3efc35cc6", "value": "SecuriteInfo.com.Trojan.DownLoader44.48008.8643.11111", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2723c538-c240-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650634133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650634133, "uuid": "685deb32-ce58-4fbb-aa85-f10e5bf619cf", "comment": "Malware payload", "value": "fc6d55444facba90278708aad061e68b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650634133, "uuid": "aa2d6f2b-2ead-4a18-89bd-419227ceace5", "comment": "Malware payload", "value": "c8e3013549745ed40ee43e282037916d2e6365d8e79e94970677b25d167057e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650634133, "uuid": "f5fe34cf-5bd7-402c-8816-5fd6e7b9f678", "comment": "Malware payload", "value": "66ad0b0125f381b4e5d12b2eb7f20f95b3f38370", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650634133, "uuid": "9d82f8da-5160-45fc-965d-f06756913824", "comment": "Malware payload", "value": "cd1b284e8f41b1941ca6e2dcab1a0771f536572ab9939a4fb80513ae81377109bb745f476f49ed71561fb3a77f0d74f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650634133, "uuid": "1a401f89-16a6-4ffe-9ad2-c59cee3243d2", "value": "T143955B4EA2461D5AFD40E3B0CA773B252B9C9E7B084D635793A4713FA43F3A85E40792", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650634133, "uuid": "9eab1289-0754-4018-95f9-28e300adfcde", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650634133, "uuid": "91a0f1c8-f1b3-4780-9512-afa7b8cc1aff", "value": "24576:EX09KVfGoxBufKPSxLa3qIHZz/WImrjC+F7d:N4V1ufWSxWqYqW+F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650634133, "uuid": "3cb97e53-469c-4e4e-9a6d-ee8416fc5057", "value": 2056704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650634133, "uuid": "f6a22b8c-aad4-42f8-86d0-1f33638b81a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650634133, "uuid": "627bb958-faa5-4efa-9b0e-23eb2a4ce4e8", "value": "ORDER - 22242 KARAKTER - CAP-516212 SAV 1-40HQ container 6331832230.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6381b2b0-c289-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1650665587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650665587, "uuid": "e438d5f0-f9e7-4377-af26-4be0d0a4721e", "comment": "Malware payload (Gafgyt)", "value": "a4fc1ff968289338ec0ffeee7c4ab6c6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650665587, "uuid": "d23bdc78-c27b-4236-b5e2-158a36efbf51", "comment": "Malware payload (Gafgyt)", "value": "c94043651906a7181d1ce717333961ca665586570ed90fe54678de191db19790", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650665587, "uuid": "878bd48c-4ee0-435b-ae29-76f57769d68b", "comment": "Malware payload (Gafgyt)", "value": "6bfcbe961790ff71e6151eeb3a79c469764e19c2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650665587, "uuid": "58e33fb7-1a0f-48d2-84dd-2ebfdfe8d50f", "comment": "Malware payload (Gafgyt)", "value": "da601cc8c73d2cc141fad16c07de2c38aa5e66d597153d5cc01321686a913df9728099cd0d0855a74c3d9cb4083e4f1b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650665587, "uuid": "6e7e389c-5591-4358-89f2-c6f845bd5e84", "value": "T142733CCBB681CB73C0430AB502AB5B110632F9BB1E57AF46F3686DF49E121467267F94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650665587, "uuid": "9a540bb0-c24d-460c-841b-79f6b47f9492", "value": "1536:6vbpnlUcUeUudgvmP8hVRZIkJbHe4VZvp65hnDEMWO2NI5Vma6jtafbek:6vFlUcUeUEUmP2RZ31HtVq5hQA2+5Vm2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650665587, "uuid": "7de01375-1779-4439-a850-b6c1c601fbc0", "value": 80651, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650665587, "uuid": "26858ffa-43e7-493e-8fd8-c1eed2d92954", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650665587, "uuid": "0255fe7e-a22a-48d2-859e-0cec8183bd69", "value": "a4fc1ff968289338ec0ffeee7c4ab6c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b7e7300-c202-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1650607538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650607538, "uuid": "ddd1348f-d2b0-4685-a43b-9ddeedba2cac", "comment": "Malware payload (Formbook)", "value": "72946d33fc75c0a3fe3b56b8bb5ce746", "object_relation": "md5", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650607538, "uuid": "d5f41068-d579-4943-8ec5-700c321837ac", "comment": "Malware payload (Formbook)", "value": "c9432d72ff4477b9dfe32d464ebf873563abdaa5737db5f95864c38a7cc84919", "object_relation": "sha256", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650607538, "uuid": "286837fb-3e5c-4e76-82e5-2c1bed37a3df", "comment": "Malware payload (Formbook)", "value": "36da36fbcf3cff20bbd87cefeaf604aa815ab2d3", "object_relation": "sha1", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650607538, "uuid": "48c8e1cf-7681-454d-b6c0-57abc4fcf22f", "comment": "Malware payload (Formbook)", "value": "b72120bd9962ae6b1494e5246b752d2ef6b63c25ec901c4c39595f1b928f42b2e3d7f1ac6e7e9d66056d69fc33ec06b9", "object_relation": "sha3-384", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650607538, "uuid": "91d20c65-0fef-4d09-a8e3-69f549320baf", "value": "T156A4238675DB981289E62FF2493398FC461314C466E12EBE1FD04CC48367779B9D2BAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650607538, "uuid": "14c4f80c-219d-43d4-af7c-4887d4aff9e5", "value": "12288:YLG7xuDUbWJpR372ROfmSXQMgzotwKVYKHdiGZRAyOnBd:oG7APF2sfmvz0h9iiKyon", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650607538, "uuid": "327fae86-4d06-4120-a5ae-9d7a7b6b140b", "value": 481089, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650607538, "uuid": "b2be0988-2918-4b30-a000-3b7f16eaa29c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650607538, "uuid": "297dbb25-9a88-48d6-8e1c-040b69fb6c00", "value": "cotizaci\ufffdn_Latco1782902.doc.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5ab612d-c273-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650656303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650656303, "uuid": "7f9e81cf-7552-49a0-8cff-937de0927e3c", "comment": "Malware payload", "value": "7a0f916450155da6f1f268906456304e", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650656303, "uuid": "63db7c54-c6d5-4550-b385-d4e01afcc76c", "comment": "Malware payload", "value": "cace86ee993b5c715ef06c575289b7da7d8666741d578ccc0fb6a33742712146", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650656303, "uuid": "371aaa1f-f754-4757-be42-b2f1fca724f7", "comment": "Malware payload", "value": "668b1106b8fb6b2f6fa6239026c5cff9ee6b9956", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650656303, "uuid": "017e132f-657e-4cb9-b020-6ce3dc3f0b2f", "comment": "Malware payload", "value": "0c62f37b766f48b0384d33c39b1b493574430c962281430ecd6c1f83319eae89ddc2156f562b0cedf4fad1365d97e83b", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650656303, "uuid": "8ae2ecbe-1081-4f90-9597-7e806803778a", "value": "T124D49D11F6AC80B5E07BD13DC9A3875AE6713C9847B943C79255EB2A2E736E05D3E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650656303, "uuid": "3edff931-1096-4a15-863f-e6a7f6fd32ad", "value": "6ba79cbed2acbe9b8ecc8e14a572f100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650656303, "uuid": "bcaf396a-f81e-404c-8462-20788d4f1c28", "value": "12288:C1FIcocJwMTHzXO7N2VBHiyzskF1CubVnmn:tco9MTHzXO7Nw/115mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650656303, "uuid": "28111200-e7de-4148-a1e0-625d9e6897a5", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650656303, "uuid": "a1aad73f-0a54-465c-85a8-75210e1a294a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650656303, "uuid": "b191fdc2-b1ac-4360-a802-5ef56757802b", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ece0fce6-c207-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1650609983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650609983, "uuid": "b11854c0-57a8-4955-971e-d6ae099ca8ee", "comment": "Malware payload (AgentTesla)", "value": "f14295060cd9bc5cd0ddc19f7125c6f7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650609983, "uuid": "10c7e7af-2523-4d57-8ea1-31ce4091ee1b", "comment": "Malware payload (AgentTesla)", "value": "cbc1a87cf822070c64227c1f2b2485692bc75a4ba7d0f141e6d25e9f264336c2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650609983, "uuid": "3623a682-c154-4b74-9fe1-eb236f9bbebe", "comment": "Malware payload (AgentTesla)", "value": "1929d760b88f36004ee5a086a00365160e895a77", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650609983, "uuid": "c1759d29-cae1-4d60-b3d4-cbfc09031332", "comment": "Malware payload (AgentTesla)", "value": "4168bb6923451b07202425111caa397b827e8e1df54572e5deda1d82a75e849f7c1980d731ac1337d23cf2ee9a030abb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650609983, "uuid": "e8f3553b-7580-4ed8-a931-35460f81bba2", "value": "T19BC4236C1BC61CD8562D28EC73941B95DC5181C8AAEEA48977E5E88FBE7F02D708033D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650609983, "uuid": "a6ad0391-0662-4ffa-908f-a5979fa6dbb4", "value": "12288:HKXIaW30QeaggLaNIdB4IZxNpMHUTyHYHV/G3C7CGTYUe/h0E3:H8Wkj6MQnPWHU6YV/e9RZ0Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650609983, "uuid": "c5b46779-1cf9-4daf-b9fe-17123236fb84", "value": 563312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650609983, "uuid": "2b28f51c-f889-40fd-8676-f041fee47820", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650609983, "uuid": "401336f5-5c52-4e19-925f-24941456c79f", "value": "APRIL NEW ORDER 2022.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13c1c9bc-c23e-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1650633241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650633241, "uuid": "de990474-84a6-42e1-bc56-831de1dc18ab", "comment": "Malware payload (AgentTesla)", "value": "1b101d80a14f9c4698079669de13519d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650633241, "uuid": "0fb42183-50c0-4121-a01b-d6ea78266c72", "comment": "Malware payload (AgentTesla)", "value": "cc0abcfd95df43c5dc33c4f6b8c9bc04c1449f5326f5080daa4802c60bf246a1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650633241, "uuid": "74ee92fd-36cd-48fa-be9f-5c402dfc3b80", "comment": "Malware payload (AgentTesla)", "value": "be1265977204f2a82b40b1f7fba29bd7205177cd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650633241, "uuid": "52660349-afc3-4307-b020-212be34b892d", "comment": "Malware payload (AgentTesla)", "value": "b035f3801ff82550056c16bfa6a7808b0a9f59b395dc73473b0acba9dae0b4a3fef5d8fe75440cf38e7b0efa4d8b79d6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650633241, "uuid": "f6921cd6-f7de-46db-9be9-17e0b1982116", "value": "T1D9D4122D12E40767E4BF83BDA856940ED7F9FC243E03E70B5FC914CA7AA73424906666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650633241, "uuid": "d6a545e2-39f0-4365-8760-130c13706726", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650633241, "uuid": "e8c34c1a-e99e-4d92-8303-23b0765bf6f0", "value": "12288:agak3NmrNm2yzGWd/e0zXltA4T1EW6nOdNcTZPt79z7jBBFWljrEp4jfLY1OgNm:nok5SK/e0zXltHV6O78Pj/ebLY1Op", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650633241, "uuid": "70b1b2d1-94bd-413c-8e09-fca5f0aaf209", "value": 600064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650633241, "uuid": "dea32b15-66c9-446a-a231-c26e367bbb7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650633241, "uuid": "f8ccfe0f-e6b3-49aa-9b79-539e8a16a5ab", "value": "mv TBN Inquiry pda Due to DischrgnPort Call.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cb178a7-c21c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1650618788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650618788, "uuid": "fc9f3100-8509-452b-bace-30c9c048daab", "comment": "Malware payload (Formbook)", "value": "6a2a77999812951caa5ee5c736fcdbaa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650618788, "uuid": "572103f4-95d3-4ff2-b1c2-810037271e16", "comment": "Malware payload (Formbook)", "value": "cc18ef37f68197ab09de02444d898725430e56b0eaa3eaadaef50de946a974d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650618788, "uuid": "50e689b5-403c-4bed-b634-2b6f1b1a63d2", "comment": "Malware payload (Formbook)", "value": "5367ff934347cbe7b1d1fcb461820373afcbf554", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650618788, "uuid": "c8d6b8c0-dfcf-433e-969c-f11bc1da570c", "comment": "Malware payload (Formbook)", "value": "5e23980bb27826e8bb3c16a08110df85467e3d933960e92df7e051b866e01e254e09a0e195a1c96a53701ee741e8df0d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650618788, "uuid": "3ac12424-2df7-4428-b474-2733fbbd9bd8", "value": "T13A058E3266D55D5BD03B73B553154D948BF2FABAC032CA8D7D9811CA1AE2EA30713B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650618788, "uuid": "476d51af-42ee-4516-bdef-b3a017e3d7a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650618788, "uuid": "1a8a800c-82d9-4abc-9630-17a2de8d0c00", "value": "12288:rVuBjLcKhHzz7hEB4xzMAXWvpAZrvXE/h9EFRY:85FHf7hEWxz2pAJOuFW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650618788, "uuid": "457f0cb6-d230-4b5d-8e23-c86e1feeab26", "value": 799128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650618788, "uuid": "afe2be20-c4a5-4cce-b603-7d7524a138e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650618788, "uuid": "99707821-2d79-4e69-a7af-a867d2538909", "value": "6a2a77999812951caa5ee5c736fcdbaa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8fc62b6-c1e6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650595803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650595803, "uuid": "59aaea73-3261-4c5b-a72d-eed19ee8babf", "comment": "Malware payload (Mirai)", "value": "d6e3e9f0d8bf3f16d7fa1c8782062335", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650595803, "uuid": "298129ea-271a-4dfe-be26-dc9b2f46b90d", "comment": "Malware payload (Mirai)", "value": "cc474f795c945bed1f261a71a0e5fab6e8b4b32ce0e2098af61af8f70e961ef4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650595803, "uuid": "a89207c6-fb8d-49f0-939c-165acc87480b", "comment": "Malware payload (Mirai)", "value": "d87a024db3e7f4958f9724486fe5e1a83c7d8f13", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650595803, "uuid": "d8ea8e36-33fa-4867-988a-a30984116037", "comment": "Malware payload (Mirai)", "value": "b42c4b93d943f3f302af98d302bb1d63afcff24ec6d79e3b5d1236ec701a95f3ddc8bc8194c7ab8b9312d549baa919d4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650595803, "uuid": "7720c7a1-7cbe-4296-b1eb-7d808e17b0a2", "value": "T1E0530747B44180FDC149D03447AB6A76C8237EBD1B3AF39637D8EE3A2C6AD221E59C45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650595803, "uuid": "3db0e662-cd36-41ab-abb0-c3b674734280", "value": "1536:anF9U0FferGtOW4/RWo4cz8kkRqwMhJOlQ5M7WR:0FK0UrUO3JWvxRqwMOlr7WR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650595803, "uuid": "daff1c99-de88-4b03-9076-7ee2391cb4fb", "value": 62720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650595803, "uuid": "65019d81-8c45-41fe-9e2a-6d67a2038a63", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650595803, "uuid": "6729108c-0152-4548-95ee-5a9d3a238718", "value": "mirai.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92909116-c221-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650620999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620999, "uuid": "8567c1d7-e7ab-45a1-a4ed-60f63cc7a90e", "comment": "Malware payload", "value": "3a98a4ce9d5961ba0f92fa072c88a3ae", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620999, "uuid": "a421aa25-0bdc-4343-8623-7ad6124fa258", "comment": "Malware payload", "value": "cc4fba5cc4c062c2de0e2775acba4977b097fcfbd13f0ad63193633737a6f261", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620999, "uuid": "df130e18-a23e-4496-b20e-b06694124eac", "comment": "Malware payload", "value": "dca3f35147c85e6790ec419d94734c2161781198", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620999, "uuid": "9a9cad90-9ced-448f-ae4d-f75c83f8ad7e", "comment": "Malware payload", "value": "e2efcf777fcf2e1e73624887b2f8e378a73bd2942ce3188bc354968ce58b418bc6de2b821e142afe9365daf437c1a510", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620999, "uuid": "e162f882-e944-422a-93b3-115726744ac0", "value": "T1DA063C13B34CA539D27B0ABA4927AA50993F7A617911CC176FF0098CCF359806A3E5F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620999, "uuid": "f23a2bd4-1a0f-41ec-8473-0fb19a6fe0e5", "value": "497e9bb845293f9da2b1821735da8468", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620999, "uuid": "18ccff21-2d11-4f61-80ac-7e5db6a49899", "value": "49152:1MVvVyjR6xeShMl3zWfGMZvf1koF5UEyf3OQLTBVJg7u:1MMnzWfJ1XUEyWQJU7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650620999, "uuid": "ef5cbaf0-a806-4118-94d4-92b2d62f6d1c", "value": 3971584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650620999, "uuid": "8fde20a6-9602-44fb-a7f6-9fbb10faa708", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620999, "uuid": "00dc3067-62fa-41e0-a9c1-2ca3981e893c", "value": "SecuriteInfo.com.Trojan.DownLoader44.46289.22718.1521", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3693db14-c25e-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1650647044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650647044, "uuid": "77cd2c59-b3fa-48fb-9f09-861b79d3f149", "comment": "Malware payload (SilentBuilder)", "value": "189e911527d1012679c9963fc623b5d4", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650647044, "uuid": "d7deada6-e62e-4e29-a06f-a20c06711d44", "comment": "Malware payload (SilentBuilder)", "value": "cced507334d1a4c9cdfd88cdbb0feb7e72a895bb181b649f6c500afdef6b78f5", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650647044, "uuid": "e00c7d7b-af49-4187-a321-0a78bc468407", "comment": "Malware payload (SilentBuilder)", "value": "a305024db4f16e13adc1e1bc46873ff98438f2d2", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650647044, "uuid": "5c9046be-1d6a-4c68-b657-63e4d80f61ca", "comment": "Malware payload (SilentBuilder)", "value": "4649a5bbc7a84460e140de87d783cab029b2ffca492aa9e0c45c4ab201159f46af7f18ee5fc8c1c29b50b2fc7a3fb444", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650647044, "uuid": "c59822dc-0369-41b0-ac18-0a60b96cabce", "value": "T12023B646BA5D9859E9258B7548E743E9B333FC201F6B0B833616B3257FF49E05A03207", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650647044, "uuid": "fb95a096-26c1-4894-9bcc-89fa935e5823", "value": "768:4DM52tfQXi8vgLZkTOHkQT51Vp6AwPdM8gQ6JT5X6DGwUdh+pqjeSLjcvLtzrxF6:462tfQXi8vgLZkTOHkQT51Vp6AwPe8g/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650647044, "uuid": "9610c30c-fb4a-4d71-acb3-57ec8ad8584e", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650647044, "uuid": "19df3f82-d3c8-4159-8adb-0bbcdc74808e", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650647044, "uuid": "00342f5a-f7d3-486e-a5cc-7f25836e9817", "value": "XC-9142Xreport.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "226589cd-c24c-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1650639279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650639279, "uuid": "216c8b69-8555-467b-9b27-441be4a437df", "comment": "Malware payload (RedLineStealer)", "value": "ab828fda3547e23c2c29049d2f0ee7b4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650639279, "uuid": "aad2f0e0-a182-4ac5-ae94-18fa9e1303ca", "comment": "Malware payload (RedLineStealer)", "value": "cd4e23ff3b0f258addb9aa2a2e369b85ec7ea398c5e3a590136a8576e2676c1a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650639279, "uuid": "b81854d1-b774-49ae-af18-885bc628b29e", "comment": "Malware payload (RedLineStealer)", "value": "45b5e7b6812e52d8849d3cb4f3968000bd2bd994", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650639279, "uuid": "5026015c-2215-4f4e-8203-ba3626847ad1", "comment": "Malware payload (RedLineStealer)", "value": "573e959ce5e49d3d850acf1417b2ebf2f3bb9633b8b9c870f4185f476bc0624f2a6ba190170cfb7a80ebe9af27fc4b40", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650639279, "uuid": "7addaca3-ed9a-4daa-9962-a4fd2af30e8e", "value": "T14794CF50BBA0D03CE1B716F47979D2A8653A7EB26B2051CB32D63ADE52356D0DCB430B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650639279, "uuid": "feaabd1d-7d56-4653-99b0-f8fe8eb010aa", "value": "3adf71d778205c50d9efa7010af4b923", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650639279, "uuid": "6a3663ec-1e7d-47cb-b85f-369ff0dd372c", "value": "12288:njxj1lYVTU7vOtvTgXJ30z5OrIaY/t0OS899:NwVTB+XmzT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650639279, "uuid": "ca00eef6-d258-4e13-ba90-f6a6f0896038", "value": 412672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650639279, "uuid": "4446bd22-8380-4113-9afb-31472388936a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650639279, "uuid": "60c1aa59-80f1-436d-b845-98387c1d9263", "value": "ab828fda3547e23c2c29049d2f0ee7b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a40c8088-c248-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650637778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650637778, "uuid": "261b7e7f-f141-4d65-b70b-7aeb1d880f55", "comment": "Malware payload (Mirai)", "value": "0a7e23202b002dd31cdf99d549f9c29f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650637778, "uuid": "41d81975-84fd-4b8e-aedf-aac62cdebcf8", "comment": "Malware payload (Mirai)", "value": "ce3bf7ae4356cd087280c1e56319ca2adfc8edf6ad855b382f19523d76f72387", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650637778, "uuid": "dadda3c2-a28f-43b9-9dac-4393ca609bac", "comment": "Malware payload (Mirai)", "value": "c1fe5314dceaa27be1d5bc32d398a727efe7d3d2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650637778, "uuid": "6a280531-3625-400e-b000-812735adc3d6", "comment": "Malware payload (Mirai)", "value": "15196e2d2d4a9567ba84637d69ffcb09d8c91768ba2406e6dab8376f8442f581ed329e5e3ef9b2c91619c012e9b25220", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650637778, "uuid": "e6ee1a4c-7e27-4314-a303-aa65202782e4", "value": "T112F34905E6408B57C1E2277AE6CF824D33338B94A3EB33155938ABF43FC27995E26915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650637778, "uuid": "c6cec5dd-0bf7-436e-ac0d-b25627cc5be1", "value": "3072:T1g2/eINNlzx2kkQCMOaQcvBNYnyLRM/9q3tmFwfBxKQodn:hg2hNNlzIkk/MOa/rYnydM/9MmFwfBxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650637778, "uuid": "24a102f0-0932-4e1f-8920-27b2bd4d5d9f", "value": 159888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650637778, "uuid": "c4f2ca91-a046-4fa5-96c5-dc62677f68e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650637778, "uuid": "a2e8aec7-3092-4c75-99c2-1539dccbce15", "value": "0a7e23202b002dd31cdf99d549f9c29f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c21d40b-c20a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650611002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650611002, "uuid": "6c1e7365-7946-47a0-967d-35151ec12001", "comment": "Malware payload (Mirai)", "value": "b0dbf9586c3d1bba15886a10f4d90274", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650611002, "uuid": "4148d36c-3a72-4e47-8fcc-e0159de5d84f", "comment": "Malware payload (Mirai)", "value": "ce7935a303952a4381fcce980ef29f6a685f291c6e0fd641fc67f49584f1c252", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650611002, "uuid": "9fd38d93-754b-4284-8d53-fda65c568076", "comment": "Malware payload (Mirai)", "value": "1fe7c95f4ab4bef9ac0ce14976d2472a30d8611d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650611002, "uuid": "0040049f-51f2-4574-880a-198cbbb27d46", "comment": "Malware payload (Mirai)", "value": "9a419c9cae54315db62031cf0e47386a17dc553d8129a26c475707ed1a96ec10e96f8c733329e0c9313c5a340124a8ef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650611002, "uuid": "1aa025f8-7884-4c41-92ac-82bb30a098f6", "value": "T1AD33021F365573DAE6610DB07A3EA0A3F92D3C6C72F0975283E4927946446821735FB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650611002, "uuid": "67bace1a-b326-4862-9a53-472d7b54876d", "value": "768:+1ScJCGRhldva/96jLxs0ZQV/jBLti4B45nmAq3UIJnKJ1Ho37UDciZ6rT+uP0ba:Pcs6y98x3ZQpjRti4JXsw3cFYGa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650611002, "uuid": "707e5f3f-17e9-4c6e-a7b5-007fc0311602", "value": 52936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650611002, "uuid": "805d098a-7c4a-49ce-b5a0-50756c947139", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650611002, "uuid": "8f008b85-13f8-4829-afd4-86f70c923cf3", "value": "b0dbf9586c3d1bba15886a10f4d90274", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7644af0c-c1cf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650585732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650585732, "uuid": "03e20e30-1587-4572-8c2f-28bb7837cce6", "comment": "Malware payload (Mirai)", "value": "0a602160060ffac2c9d7c1f4d55a7d3c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650585732, "uuid": "8e5599d9-805f-4459-b32f-6a0db83f4cb7", "comment": "Malware payload (Mirai)", "value": "cf2856a7b559c51797730452e9cd8e7152b52407e51a114ed354b331400a0425", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650585732, "uuid": "bf9fe2dc-522b-472c-9c87-ff67fff1a9e8", "comment": "Malware payload (Mirai)", "value": "6c5048ccadd98bfc2bc31238312c81d970f6d860", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650585732, "uuid": "4d8650cb-8c08-472e-906c-f77e8ca60d83", "comment": "Malware payload (Mirai)", "value": "32ab2125f6ffd4b3a6e6d302696ab4d6e4d3fcbfdc04b0bd0d9d5ca7fec2c6fc531ce5d1acf0011a1df7dd912ed1eae7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650585732, "uuid": "3f209125-4aba-46d8-b7f2-707f675a3fe7", "value": "T129A356697A31ABEEF76C82704BF72B70D349529236F58282E56CD2087E7071D14CE7A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650585732, "uuid": "f5d3a1f7-d678-4628-b8e6-6e1c5fcfeb84", "value": "1536:3MdtNLrAKfUTjbTZhzC+Y+YnA7pfUkk7T/gu7FLkTKum4913LQ1KrK/67Cnahe8H:T9ikFLsWNTB3NOqeQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650585732, "uuid": "3eca62bf-3085-4729-a0a1-e108beadd762", "value": 99408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650585732, "uuid": "e2b7d753-efb8-4e8c-9dfb-826326df6104", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650585732, "uuid": "e4301465-1900-4c1e-b679-95532da9eb3a", "value": "0a602160060ffac2c9d7c1f4d55a7d3c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98ff0c70-c22b-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650625304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650625304, "uuid": "9062c41c-463f-4d78-97e3-c396b037f31c", "comment": "Malware payload", "value": "40760271aa489d4ea3a47af09ea56182", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "pw Z0zh762", "colour": "#1E0B4C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650625304, "uuid": "5dc95811-2f71-4a9c-bb91-915eb8d68438", "comment": "Malware payload", "value": "cfd7d3bd274fb0b36339a32b6815b4ead5ff72155cfc58fdcd6cb8812611f675", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "pw Z0zh762", "colour": "#1E0B4C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650625304, "uuid": "6f7c66cb-db29-4c68-b41e-a265cac95ab4", "comment": "Malware payload", "value": "85453fecf6f3e302df80f6473bc0fa4132d005aa", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "pw Z0zh762", "colour": "#1E0B4C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650625304, "uuid": "252e0986-7bdd-49fb-af85-06e931a53155", "comment": "Malware payload", "value": "4d68da7917ce7b6e2d95086115faf09653e393e438763ebd01643edcfb6720c4c604f5404e66ce9c0d8d486c3e946569", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "pw Z0zh762", "colour": "#1E0B4C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650625304, "uuid": "3c534a3c-d32d-40dd-9193-71b0ef36a032", "value": "T1D262CF37BD8DF923538ACC7D114DBA8A2C356C98D7470B5AA073DB54EAAC582C0E0772", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650625304, "uuid": "33cb2098-8dae-47c7-b784-fb7a699c8da0", "value": "384:4eK1qN2KuAa/idi9lq39VsfCRC4ecUs36v9Xpkrcrsq:i1qQKNaCAlq3MfCNBUsq15t5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650625304, "uuid": "5f1ee74d-f307-43a5-a7ff-cf6e6f7d5200", "value": 15696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650625304, "uuid": "c7f3ebba-528e-4cea-9241-fb5efdea4cca", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650625304, "uuid": "9bab5d80-8e7b-4b95-aab1-744c7bd97cb8", "value": "SCAN7161_0002.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "061eb425-c258-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650644385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650644385, "uuid": "e06cee29-ad19-4188-b468-d15466a7b7dc", "comment": "Malware payload", "value": "9ae3c23f1f9f7752bf02ada151fa3cdb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650644385, "uuid": "319209fc-525c-4007-9544-2d4f1adb55fd", "comment": "Malware payload", "value": "d04ef7e1e56dc35ef0cb9764e3f1de48e13529112cb80c8a21162df7bab84100", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650644385, "uuid": "9790cdbf-4aa6-41e1-b17b-affe522a0de7", "comment": "Malware payload", "value": "86209305bda92dbd4b22f01c359cd41cdad227f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650644385, "uuid": "3c394a1a-15bf-49d5-abf4-b001dbf24b90", "comment": "Malware payload", "value": "f82752d7271a45359788a5c63c5dbd2ca37406d4e1a91482aa82cedb7e501f82f4a7d66f37e0ed8f447d5848b6fc77d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650644385, "uuid": "4ce5c585-841a-47eb-a11f-413159ac66ca", "value": "T1B1A3024903EC74D9C220EB3D108A434DBE5DB88A4457C3E67C51B6CEEE18646E6A4E9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650644385, "uuid": "74100b44-df35-42fe-9d94-57dbefea5db1", "value": "8679c8c71268858668c3b616f436e78f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650644385, "uuid": "efbaf027-adca-4a1d-92e5-218ba3ac39b1", "value": "3072:MdmuDcNZFruR8Kbq1qulNCDAmkPKmggjdo:gaidbgjvmkPKmddo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650644385, "uuid": "c267885a-ab1e-400e-bf83-46ce90961131", "value": 107256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650644385, "uuid": "9bce5933-bae7-4543-9978-97c3fae68f63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650644385, "uuid": "bdaf19a1-c57d-4e14-a0e5-870841aaa1e6", "value": "rainyday.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f16a4a43-c258-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650644780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650644780, "uuid": "9c1137ae-4d3f-48cb-9944-4add027c649e", "comment": "Malware payload", "value": "2f1a547f9324e8124b0edf2679214397", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650644780, "uuid": "a242368d-77bc-49ba-960e-a3f8bcb1c5a9", "comment": "Malware payload", "value": "d066ecfd941bdc31f228a2ae249af27c005525847cf21ad6e48098ec2e23efc6", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650644780, "uuid": "0d99674d-2eb4-4312-afad-6fc89792c25b", "comment": "Malware payload", "value": "c8ca2b7007fe42cc8ef8625e4eb860e5de38362f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650644780, "uuid": "4a83d01b-85b9-44aa-ab65-8d64da39996b", "comment": "Malware payload", "value": "ee8652ff6067231fcfba36a5f078ae3b87088c48bd4077dad76b77f65034402a64c590733d869c6d9dea98d10b26dad3", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650644780, "uuid": "b31f95b3-f34c-4a6e-a3e9-a45176519b7a", "value": "T15FD49D11F6AC80B5E07BD13DC9A3875AE6713C9847B943C79255EB2A2E736E05D3E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650644780, "uuid": "d55d373e-6e8f-4eaa-9c9c-a569453c2a30", "value": "6ba79cbed2acbe9b8ecc8e14a572f100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650644780, "uuid": "955edab0-80e7-45d3-b7a9-d359943c90b8", "value": "12288:C1FIcocJwMTHzXO7N2YBHiyzskF1CubVnmn:tco9MTHzXO7Nx/115mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650644780, "uuid": "049312f2-d7dc-42b4-8666-c0a828ffaba0", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650644780, "uuid": "ecd4433f-44f1-4399-aee7-5cf6dff5f0d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650644780, "uuid": "ee0bfe81-c6e3-4c39-8609-e0a77e70d406", "value": "saIknXkCrBrP28BTux9fDCyoMzBof.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d675675-c21b-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650618252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650618252, "uuid": "1475a669-6c79-4323-81b9-a39238595770", "comment": "Malware payload", "value": "df823eb86b14636863d5c35b8d981dc8", "object_relation": "md5", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650618252, "uuid": "39988ecf-3605-4803-bf7c-1de105387735", "comment": "Malware payload", "value": "d0e17ed642064179d00a2ce6358e83940ae8fcc5e896c92cc84160274885276c", "object_relation": "sha256", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650618252, "uuid": "2aae1f16-da3e-4485-9d9e-9ed1965ec9b2", "comment": "Malware payload", "value": "832fc6218fc88e133e376f4fa9bd901ed733d94a", "object_relation": "sha1", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650618252, "uuid": "fc79dc9f-31ee-48b6-a7ec-7cfbd879eff6", "comment": "Malware payload", "value": "e667a5d09aa1b53abffa8a0877ea66b5738e1edc38d9534011d18c41a4e3c2e93e6924771cb4aec6b48b8805b014637c", "object_relation": "sha3-384", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650618252, "uuid": "89f9c7fd-4978-4e63-89bb-0972d5b424d1", "value": "T114D46C55BECA6EA1EFBF47BB8361D62D0226735D03A1A6CF760305993951FC2443EA03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650618252, "uuid": "087d4948-c354-4311-9720-12bf59f96642", "value": "be710ba34b048ab0098050ccf62e369c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650618252, "uuid": "4f767e8a-de70-4d2a-bfb7-1aff77673097", "value": "12288:70Ws7IMtR4yVld8bzbBSre1hgFK/UqWZK:70bdkX17cLZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650618252, "uuid": "3a65a3f2-f418-4381-a47d-2beb9b4be7ea", "value": 652288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650618252, "uuid": "a56e4097-4767-497a-8e4c-69075d8fe537", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650618252, "uuid": "46dc181a-e557-4ead-a973-6526c8e863ed", "value": "P01.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69a7b3ec-c221-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650620930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620930, "uuid": "92fb9472-241e-47df-a6cf-c714c0711c0f", "comment": "Malware payload", "value": "fa068dc3bc38c010f7d64f3c61fabd11", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620930, "uuid": "899acd72-4de0-49f7-b2d4-18a631ddcd47", "comment": "Malware payload", "value": "d133f5c7e386e8bcebf761be39fdad7d453e38adf6971de575a9ba650aa8418c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620930, "uuid": "6a5ad334-fc3a-48ac-b849-2d3202e3c386", "comment": "Malware payload", "value": "035f2e7ffd20958d41876119f36084e34a49efb1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620930, "uuid": "ffdb862a-ecf0-477e-aef2-5ff19ea0c7a7", "comment": "Malware payload", "value": "45e414f8e6cd07f2cc5102890f1bb301991a4f5a29bb265d222d363434ba4cc927ab74687b3e2df17c16e6de91186808", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620930, "uuid": "51ac877e-1fc6-4fb4-b36e-b1ef275b40a7", "value": "T17AD56C23B244753AC45F2A3A593BA628A97F7762A5128C5727F44C8CCF355803B3F61B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620930, "uuid": "9b76c1c0-0f5c-43c6-b8aa-1cdc72baab2b", "value": "a94218a9ed16b3bb7fcd9b72ba51c400", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620930, "uuid": "642ddf48-d3df-45cb-833a-52d21ead2cff", "value": "49152:iZRCD1oN+/RgS8VajOzVHd7IMXT3pIpKt:iZ/+697IKt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650620930, "uuid": "220aa527-2839-40e0-a4c3-3a41287c3be4", "value": 2810368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650620930, "uuid": "d60dfa75-bf36-4383-b429-ba99449020d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620930, "uuid": "c78c1b28-1957-4673-99ec-4b7ab0b2765b", "value": "SecuriteInfo.com.Trojan.DownLoader44.48171.15816.18356", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9979d467-c225-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650622728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650622728, "uuid": "0a759316-c6a7-4582-b96c-7c9964176396", "comment": "Malware payload (Mirai)", "value": "898db404df8af54801f82a0e3bb7457b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650622728, "uuid": "1f398c40-aabc-4ba0-8910-2fa744c20c63", "comment": "Malware payload (Mirai)", "value": "d1e0bae5fd984f8b9b120e71b7fd607bd5fa9bc902a81fabe1c88640803c36a2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650622728, "uuid": "5252fa51-f33b-4a40-9038-561148bf1af5", "comment": "Malware payload (Mirai)", "value": "22986f6f5c26d1fbfed6df26e749d3ffdf216128", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650622728, "uuid": "7d340859-a9f4-448a-b2fd-4eb6d9f53592", "comment": "Malware payload (Mirai)", "value": "b19a77f70c0707779a0fc39effa0a7761fc775fadb38f4e0ce9f3c357b6557178099d471ca678d8eb7b27ae811f34b5c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650622728, "uuid": "4c72f205-446c-4aa8-817a-aa66f9861d06", "value": "T1AEC2E004224B5273CA203CBF956E4F47AB67DBFDC13B252E435AD6A84DD24101ADBF01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650622728, "uuid": "aec11bec-cf1d-4687-af25-c51a12f05c58", "value": "768:0kIgasdQvLarNKU7okLkDFirXQD/011JN9q3UELCEL:WgLdZ57okr7QD/0BgLTL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650622728, "uuid": "e4e875f8-943b-4ae9-a27f-1425c71a9020", "value": 27468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650622728, "uuid": "d4654edd-54f2-4fa3-8b08-37d550a63e89", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650622728, "uuid": "fa5ceae7-8ae6-4c91-9968-b7f09da1b502", "value": "898db404df8af54801f82a0e3bb7457b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a1b889a-c22c-11ec-8e58-42010a9c0032", "comment": "Malware payload (CoinMiner)", "timestamp": 1650625628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650625628, "uuid": "4cc5008a-6e08-45d0-a4e5-770dfbbb6ec6", "comment": "Malware payload (CoinMiner)", "value": "a00eadb0f2e3f60cbb65a83524faf46c", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650625628, "uuid": "312455ca-1738-40d7-971c-4ee4ac7e1617", "comment": "Malware payload (CoinMiner)", "value": "d28e9540401428e9fbcfe7a34b5dd21768c1208c0a8466d06e25d3dce12da1ab", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650625628, "uuid": "d59e1714-04ce-4525-8b6e-40a4d2f74101", "comment": "Malware payload (CoinMiner)", "value": "4b05ee08ecff3dc1b8a2b82b1fa208642616a00f", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650625628, "uuid": "4bf9643d-4344-4140-9333-f0a8b5a15678", "comment": "Malware payload (CoinMiner)", "value": "ac4ee9e843dd3338ae01c0fc1a67777362715079a24b2de338d64b2964dab9d337e69d6fcca6ba6b135c0c99f75bce00", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650625628, "uuid": "6170fd25-e479-4c94-b86e-564243a15349", "value": "T1A1B5337CA9C9B349EEF2AFBD2851A4CE0EB77C22ACA80F71750D1414B39855650316ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650625628, "uuid": "ffa2bc5c-a5db-44a3-a0ad-1d5c5c932317", "value": "49152:zUlkgwLc89uuKzrnOXZZ/NtW4fE8CpHz79NO1RYib1uWk4apSQ69+6y8Av:zkwA8KzT2xtWkFm8k4xJ0Fv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650625628, "uuid": "e1e83c22-03ae-49e2-af8d-0877dab339e1", "value": 2428014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650625628, "uuid": "7393aa11-0b22-45b3-8ec1-c2218fb5e45a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650625628, "uuid": "8795a2c1-67fc-4ccf-bd1a-bc19f1cb3542", "value": "a00eadb0f2e3f60cbb65a83524faf46c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c322df9-c1cf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650585742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650585742, "uuid": "c960db6d-f6f5-42ca-97c8-ff8fabb45624", "comment": "Malware payload (Mirai)", "value": "f974ec99e93e9644fee4b3847dfc2cf0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650585742, "uuid": "cdfd40eb-d9ec-46a0-becf-4c74f621bbdd", "comment": "Malware payload (Mirai)", "value": "d3fc4ecd564da9f669f4474cee6dbede40fba31f0de0a76a8edf237fb18e5a9a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650585742, "uuid": "24d346c0-46de-4a4b-af63-9a4886f48ab2", "comment": "Malware payload (Mirai)", "value": "7163ce4bfde11fd39f7e7b4ad6f98d4de0ee77f2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650585742, "uuid": "d61dfa71-8e47-443d-a464-72449f4aa8a9", "comment": "Malware payload (Mirai)", "value": "cdff6386829806113500af246e0e7da4b5910edad51ec65af0a75878361fb7e59366b41907cd5576838b5892dd05b335", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650585742, "uuid": "4f05a855-54db-4815-948d-8522214c10c2", "value": "T1C6A31D6666B1DEBBEC0EDD7346995501208C954A62ED2B2FFAB0C128F74BD4F08D3C94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650585742, "uuid": "19d01db6-643e-4fa3-bf1f-b93a5e29a02f", "value": "1536:3eT6kSC+g59NQV2+0Iui0No8eMi/FbIf5ZqXl21A93vD6wE:DkX+ASubNoPMi/RIf5v23vD6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650585742, "uuid": "72352179-606d-465d-b7eb-c6fc34929aae", "value": 99472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650585742, "uuid": "545a7286-8098-49dd-923f-284214b75d76", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650585742, "uuid": "e9cfd384-588a-42bd-bc0f-efaac651dbca", "value": "f974ec99e93e9644fee4b3847dfc2cf0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c846108-c210-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1650613660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650613660, "uuid": "e119733a-1fd1-4ff1-b6a7-d2373222cf29", "comment": "Malware payload (Heodo)", "value": "7792e41495763e403c2111157d7355fc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650613660, "uuid": "f8ca74f6-c1ea-41a8-ae12-fcbc89d977ff", "comment": "Malware payload (Heodo)", "value": "d429de51e5a879d122fcfad6edcf7726a5081151c36a027e5cc4a5696d0a42e4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650613660, "uuid": "0d98c0ad-f31e-453e-83d1-3bc88246785f", "comment": "Malware payload (Heodo)", "value": "f33df1bfc29c6a23ed79b90088424613c873fa0f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650613660, "uuid": "8e5bab20-3758-4334-b110-50094e51fb94", "comment": "Malware payload (Heodo)", "value": "ed69cde9d11e32f860e173bf9be6ae36cfbd8a51143e0a8514e8c2866df7bac65d415a1594c8dfaac62cbb0dfe6126e2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650613660, "uuid": "576ebf18-834a-4bd5-8a61-2d7929862d81", "value": "T168057C57B7AC85A7D026D13AC9138A6AE7F27C514A30C34F42A0976F5F373615F2A322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650613660, "uuid": "459cc28c-bcbc-4d0c-8411-c8290502ac06", "value": "b1b8de15f6cec49241fb6c12a06060a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650613660, "uuid": "c552dd31-28b2-4b02-895e-3145fb6e01ec", "value": "24576:hfVC8a/EYcIfNNMlRON8AQYxFqILrEs1:FVNasnIA+N3Fc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650613660, "uuid": "abd2c043-a178-4fd6-9e12-c112424b1640", "value": 797696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650613660, "uuid": "4c698220-7e5d-4964-b4ea-0d394abea3d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650613660, "uuid": "1c47697a-3623-4208-a6fa-5bedcb40abbb", "value": "ibtoqds.aci", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07130150-c20d-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1650612175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650612175, "uuid": "ca1eccf7-4057-494f-b910-2542e6a7b685", "comment": "Malware payload (AgentTesla)", "value": "6c5ddb993c74e74f966cd778e5adbd3c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650612175, "uuid": "a2c87470-44f9-4260-882b-4a564e79ce2e", "comment": "Malware payload (AgentTesla)", "value": "d493dca078d9747550efd2f30838858ad063f2f702878cdd67e1a84a4ff25020", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650612175, "uuid": "e4f1f86d-c17d-434b-bb1a-fe05e8e12844", "comment": "Malware payload (AgentTesla)", "value": "c9425f01a00e1c0fd1471330555d58510c858683", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650612175, "uuid": "2e59fd47-9ffe-4adf-a26b-b178ad8005f5", "comment": "Malware payload (AgentTesla)", "value": "c676be7b2f55fbcebfc533c89104e32cd84ec3a2b7609b37a3763292919bd6ec31a7696af74f0d847b9b7d2a7e9a11f1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650612175, "uuid": "0ac65f37-0c3b-479e-aa27-b98e81d07d7f", "value": "T1E4C4125073A19452C47DEB7678E3808743F0D95B871DA64E15F3B2FB6AA13C0225EB8E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650612175, "uuid": "1efbb37c-19c2-4abe-bb72-2f5d84b7fd30", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650612175, "uuid": "57df5572-f4a4-4f80-910e-bf3898d0bb04", "value": "12288:R2FQ9VPZDIJdKahgk5nHyWezW2WvGCSwgAH5Piz0jhAYtv/h:0aVPZDnwgkVx2MDJgz0NBdh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650612175, "uuid": "78074cb4-a49a-41fc-89cd-e99be52b2c4f", "value": 591360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650612175, "uuid": "8ce4dde0-1f59-4a7a-9047-e8e2d90de2d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650612175, "uuid": "bd594e0a-19cf-412e-a8eb-b193f37dd3c8", "value": "DHL G\u00d6NDER\u0130 B\u0130LD\u0130R\u0130M\u0130_xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcf5a463-c211-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1650614198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650614198, "uuid": "52d09a52-ea8c-4a98-a5a3-b78bf3e129ae", "comment": "Malware payload (SnakeKeylogger)", "value": "d13bec33b5e36e0e0c2a1d1cda594428", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650614198, "uuid": "e2dd28eb-3f54-4bd5-8f33-915cf92d6fdb", "comment": "Malware payload (SnakeKeylogger)", "value": "d4a3901b8b89af3668d1b304f75afc84a01dc7817aca0a2ec5dc323fcd5e1d43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650614198, "uuid": "d19f1345-7f95-4573-aede-6605f37af12b", "comment": "Malware payload (SnakeKeylogger)", "value": "23b7aacb6e75b1141a029bf3dd94eb392decdf2f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650614198, "uuid": "2c9f1259-0b0e-408a-a826-c107c0f3f15f", "comment": "Malware payload (SnakeKeylogger)", "value": "bfb91273822d779a7eb0754572d13bc6807cbbd8b4535ce500ebcb853c6060ad3a9ce1f9e6fa824ee57b930ca9394c1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650614198, "uuid": "16e010a3-9c88-4229-83f0-ac2902b58735", "value": "T1A5A41251B7A0C2A1C4BFEF7A34E1245B83F5D5276709924C0D1396FB5AA1390228FB9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650614198, "uuid": "e97ade4a-a8f9-4d53-b5ff-8f21756e2da4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650614198, "uuid": "eb9c8215-f921-40da-94af-fba90bb05119", "value": "12288:KW7vhBoDhlTCfOtQoix710Lfd5mt49M+AYtv/h:n7v3oDhlTgmQNhQ5IkXBdh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650614198, "uuid": "c63402e6-c81d-40a3-8348-639873de19ff", "value": 491520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650614198, "uuid": "30bec913-04a2-45da-9968-97dac7013aeb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650614198, "uuid": "8587bfda-19e9-465f-b5ab-998d19a085ed", "value": "Payment Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7515895f-c248-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1650637699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650637699, "uuid": "a60712bc-2a49-43a7-b465-01db09b8b539", "comment": "Malware payload (Heodo)", "value": "00dbe343b0b4c148b2e9ea878d167f96", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650637699, "uuid": "3f80c078-04ff-4bd6-9cf7-fc9e739029f4", "comment": "Malware payload (Heodo)", "value": "d54ccb3978254c6713ad77a2e230a49a7958bba600c240ea2ad33cb80e027d4b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650637699, "uuid": "e087096d-3460-4d60-b2fe-da005b93736e", "comment": "Malware payload (Heodo)", "value": "758141d0ed3555ffbfdbf2a85281e6246409da8f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650637699, "uuid": "80054e87-b0fc-46a8-98b6-b662ad51fc7d", "comment": "Malware payload (Heodo)", "value": "d88f24e5554b09d6c922738410738e6b57a633b887dfd9bb44506415d2a296dbc65d4934fb3a1de5d261f8c0ccf573f5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650637699, "uuid": "7a1a789e-3e72-4248-a005-92166ba72952", "value": "T192948D907BC1C0BAC35E31B14556D27A62E9A6709F3896C7BBC44B3F6F741C1993832A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650637699, "uuid": "242b60ca-4c57-49c7-8ea4-8795e3bd001d", "value": "a2ad728ea5414708c4d47df0ff8c37ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650637699, "uuid": "97452c3b-d832-4e89-bf8c-336d3af0934f", "value": "6144:y+LHJs45xTU1I/m6WgLGMAPIY0hOGuy1TPQV+bVy8CuwxpOwwuDKYnKDW:y6f5tUaLG1iZuyzbVysg1wuKYKDW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650637699, "uuid": "64747a33-c798-40a8-811b-90b3cea066f3", "value": 429712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650637699, "uuid": "f1b544c0-1029-4bb5-99d8-14108ebe8613", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650637699, "uuid": "70893ee4-3b0c-4874-90b9-d8208513809a", "value": "emotet_exe_e4_d54ccb3978254c6713ad77a2e230a49a7958bba600c240ea2ad33cb80e027d4b_2022-04-22__142814.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d9b953d-c25a-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650645418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650645418, "uuid": "70c831ad-2fb0-4892-a780-c07c1f62be68", "comment": "Malware payload", "value": "c4dc5d9de44692c2af3face47bd9f61d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650645418, "uuid": "6ec73b80-0dcb-43c8-9e17-a316675a6438", "comment": "Malware payload", "value": "d5c30ad65a2f9b43234dd7bda64f3eea5c10504c62302bbd5c926229bcbd2bc6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650645418, "uuid": "ba91cd59-6897-49d6-a39d-8adad4ce273f", "comment": "Malware payload", "value": "517a9f63f91b58e83cb083e2e4d3e741aeba26fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650645418, "uuid": "3bcbdce1-fd3c-4338-bae4-fd173727e29a", "comment": "Malware payload", "value": "9a42b966950903323ccced63915ece14605885d3c3dbc82f1c92c42c7a5f0e5cea74440e096cb1afc734f3a665256103", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650645418, "uuid": "e5b71889-2df9-4b72-8bed-fff635ec5def", "value": "T1FCD49D11F6AC80B5E07BD13DC9A3875AE6713C9847B943C79255EB2A2E736E05D3E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650645418, "uuid": "290a1ba3-93bc-4082-9f04-07fe5e6653f4", "value": "6ba79cbed2acbe9b8ecc8e14a572f100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650645418, "uuid": "c9f01619-8dbe-4978-b122-c46186636232", "value": "12288:C1FIcocJwMTHzXO7N2UBHiyzskF1CubVnmn:tco9MTHzXO7Nd/115mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650645418, "uuid": "b9b53ab4-2a5f-4495-811b-71cd8f5c0f89", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650645418, "uuid": "9baecc0f-d671-4a59-bb8d-e98cdf16ba36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650645418, "uuid": "4ce61940-8bb1-4bfa-8121-65d10a1482bc", "value": "c4dc5d9de44692c2af3face47bd9f61d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "818648c9-c1cf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650585751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650585751, "uuid": "8437f581-69c2-43b5-a40f-3666eb20b809", "comment": "Malware payload (Mirai)", "value": "b5ae2f82cd3633056cd5c82d86fb3c65", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650585751, "uuid": "4d53d833-52ba-4fdf-96ba-558ac7eb32e6", "comment": "Malware payload (Mirai)", "value": "d632e889ef214838a0177bd1649ff59adce73e2972034944ab052e2a439e5861", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650585751, "uuid": "1792edbb-846d-4b79-8246-7d8736ea8f63", "comment": "Malware payload (Mirai)", "value": "61433002f1737942dfd7a21e71d5405d5fb7b53e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650585751, "uuid": "af58ce4e-4cd1-425f-9adb-e6867b4c0fd8", "comment": "Malware payload (Mirai)", "value": "fc87f12a7d5eee1521e354304a3c1e56b9be0db72be2ec81bbfa5c70b03b360d7d55b5e71e8fe4198ac2a66c80091c31", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650585751, "uuid": "63047d42-45cf-45d3-a761-2757e4e9c60f", "value": "T1D973E609F9B15756EBD532FEF909218EB32B47A8B3EE312ADD20559033C1E6F1579024", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650585751, "uuid": "5b285b0f-e951-471e-8553-60fac7bb035b", "value": "1536:EenJv2mgY1YvdajcV41Ckv/Jgat5LcKI+iQq9qI95XYa3Z:zv2XkY1gv/Jgat5KqI9F93Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650585751, "uuid": "32bddef1-576d-4322-af47-2058f7e8257b", "value": 78872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650585751, "uuid": "225198ea-33c3-497c-8711-3b49a8138715", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650585751, "uuid": "d132b49f-c4da-4dac-b9b1-98609639963f", "value": "b5ae2f82cd3633056cd5c82d86fb3c65", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78b0dec3-c221-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650620955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620955, "uuid": "c5382314-4c63-4ef0-b386-cc21a59e3602", "comment": "Malware payload", "value": "c284e9d7cf6d70954682b50825de1203", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620955, "uuid": "e19cc6af-5c8d-4585-8853-38a8030f9127", "comment": "Malware payload", "value": "d63626d1245a3ccef9a57cdd6b0e7eb03f3856c1b70fe0f650abd3bc9230449f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620955, "uuid": "00193066-bd85-4336-8c96-69ad43296f43", "comment": "Malware payload", "value": "77ff75c8283c70a388f5827079b3945a0020569f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620955, "uuid": "29e897e2-1a82-4c67-a89e-bb18553b20b8", "comment": "Malware payload", "value": "f41500bda2afaf2fd8c27f7e651d14e9dad2497916b5096c84d6a035e511459185332466f8a80604267aa78e6dbc9f18", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620955, "uuid": "abd5b832-38f5-4077-92a9-6680b7035354", "value": "T1A2064B32B24C653BC4AACA3A5537A658993F77732B128C1B57F4098C8F365432B3E647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620955, "uuid": "472b83f0-cbee-48b3-a320-eb80e03c8311", "value": "8c69aca5e7fb279d2622085c3f7374a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620955, "uuid": "bd8f88eb-719d-4986-9971-35610d2d4dd5", "value": "49152:r1ypaHt/B2SRiC/yEBs7j6tIzjKT3B1GFt:JypqDUjBzjq1Qt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650620955, "uuid": "4442a7aa-0b07-4ec5-bb06-c03f6bbd723e", "value": 3682304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650620955, "uuid": "760154f5-c872-44f9-a859-16c50cca042b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620955, "uuid": "7368ff8d-2c60-474d-a556-3dd27350a97d", "value": "SecuriteInfo.com.Trojan.DownLoader44.46870.9627.27119", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf77a5ce-c1fa-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1650604350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650604350, "uuid": "13ebdca4-e121-494e-893f-8b278e9e9dd5", "comment": "Malware payload (AgentTesla)", "value": "59d7d13944785dda76ee95675df07b31", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650604350, "uuid": "bb11511b-d0f2-4074-9284-0af37bbcade4", "comment": "Malware payload (AgentTesla)", "value": "d65fedce94b673b62dc9ad61cbc1ee1562618d159e267c7c92cdfed053c6ba33", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650604350, "uuid": "3fcd7b91-a819-4e88-a344-098636a46bfb", "comment": "Malware payload (AgentTesla)", "value": "bf993178b9c8e08594ecef45575bf30899c9f20d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650604350, "uuid": "5c637bfa-9070-4e15-8e8a-a9f4c60eb4bf", "comment": "Malware payload (AgentTesla)", "value": "9d01114cede7e8651bcef47112513798d37dee27011a0b423bbfb532c4523327234ad34146ff3551d2cd1dd0b17278bf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650604350, "uuid": "96279979-2ae5-417d-8731-3528e6664ad8", "value": "T160E4333E50ECB626ABF39274AF4DCE2E55F0C65C72F87E90449549D90CD2C619B8E3A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650604350, "uuid": "5de6f54a-7111-4ec9-a15a-ca2788270b2b", "value": "12288:1aObswB0ulhtXfjqpLLTL+0Mv4xzASQ7WpAZAsb9nMiIKSc:1bsEJhJf+9LTL+0PxzASQ7OASsbBaDc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650604350, "uuid": "868f1568-e841-414c-96d6-901cd354244f", "value": 659037, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650604350, "uuid": "7da714c1-7bdc-4ef5-b66a-b2fc49384fdc", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650604350, "uuid": "bb964965-2d5b-401f-8ba8-7cc993615a10", "value": "Preventivo-22612.r11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71c6a2fb-c24f-11ec-8e58-42010a9c0032", "comment": "Malware payload (OrcusRAT)", "timestamp": 1650640700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640700, "uuid": "957bb9a8-e41d-40d0-8544-3b62b36c5cee", "comment": "Malware payload (OrcusRAT)", "value": "af397157434f05236d462364f989b50c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640700, "uuid": "a5aa3df6-6b27-4fc5-b15b-017250c9b74d", "comment": "Malware payload (OrcusRAT)", "value": "d69dec31a9116a572f78ac8b3b0964c4f17691166284274e69da48cf679c9fd4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640700, "uuid": "5adbfe74-43ca-410c-9bc1-4f8efa1be6a3", "comment": "Malware payload (OrcusRAT)", "value": "ea2b7c1e48cabf2e020b72752578d3b16873e885", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640700, "uuid": "a0c16147-8ae0-4532-8862-1e1c22fa191e", "comment": "Malware payload (OrcusRAT)", "value": "9ef48ba3befc14a177a39011a074d25fbc6e9ca500af68595ac10d8133110d5bff1894fac0661d5105a6e27f567f38e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650640700, "uuid": "259aa583-4fb4-47e3-83f4-7e0d0bddb1c6", "value": "T197259F017A9CBE16C17D2A75EE331BC44378C5125676EB0F3884E09C5DCBF46BA1A2DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650640700, "uuid": "c77fbff4-035a-4426-a49e-9b13fa765d27", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650640700, "uuid": "53c54f27-17bd-48d3-92e5-486da0b79af9", "value": "24576:RXqLeB4Mp+xnFkFYVlnOFJIBiK71zEZfY:RaLe+M6brnOFJIN7NE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650640700, "uuid": "546bd3fd-5d72-4b8d-ae77-e2ee1b63051d", "value": 979968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650640700, "uuid": "97068311-55ca-41dd-8621-c38caa320897", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650640700, "uuid": "516a9062-8dba-42db-a5e2-8bc2d02ab071", "value": "af397157434f05236d462364f989b50c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c6248b9-c240-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1650634168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650634168, "uuid": "f834a515-473a-42d5-a789-2a94c3eb17cf", "comment": "Malware payload (AgentTesla)", "value": "8fcc7364458e8e0f4f6ca67f7a359ebb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650634168, "uuid": "200455fe-1d18-4f66-bf2e-f7ba2102dfd3", "comment": "Malware payload (AgentTesla)", "value": "d7f12f9104c564bd1e9115928aed97ef130d634759b52d1095f4b4b0c1e42f28", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650634168, "uuid": "3ab5acf4-8775-4868-86e1-a748247f190a", "comment": "Malware payload (AgentTesla)", "value": "5f852fa8f5dcde4ba924047f96ee12389d279bea", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650634168, "uuid": "e325624e-1473-4a36-a988-b94f78b4f4f0", "comment": "Malware payload (AgentTesla)", "value": "f99b8595dda35cccff0c67220a52af031393c927f4bb66fe86c37eb16006c00d1432591a02ffe1f75a178b29b5e3ee4e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650634168, "uuid": "84009369-f921-4d29-b4c5-deb8bfea49cd", "value": "T10AD45E2D3B464662ECCE9C3248012A09FF6E0F5372B1F9D257DB16CBCB5F5916D06A88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650634168, "uuid": "82d43b58-37ba-4eee-a17b-409792e9c396", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650634168, "uuid": "412453fb-364b-447b-a3e6-b2546e8a5471", "value": "12288:z3Wg+NwbohF8XPwRgieC5gmtH7ptSRAI+o19b:z3FbN4gIguH6AI+o19b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650634168, "uuid": "3915e3ff-e5bb-45b7-86dc-828096045817", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650634168, "uuid": "c93467d1-de12-4ae1-977c-1bbb6f4ab4b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650634168, "uuid": "f0fcffeb-b498-4e42-bca8-9ce592acbec9", "value": "MV 111 HYODONG CHEMI VOY DB11-22-04.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59cc3f1f-c20a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650611025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650611025, "uuid": "e0c246b4-c27d-473f-8842-3eae453f5744", "comment": "Malware payload (Mirai)", "value": "35a1a222bb941a23ff881d512604944a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650611025, "uuid": "67529ab2-c867-4b91-831d-581f415f4989", "comment": "Malware payload (Mirai)", "value": "d8469b4f4f37dc507f19b786ccd4722a0817adabd332134d25e95de95bf05a11", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650611025, "uuid": "a68ca235-4cf8-4284-8a7a-3322ffcf2e08", "comment": "Malware payload (Mirai)", "value": "5a6f068deb57d89f6d5f8b932bed6aadbfb59a50", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650611025, "uuid": "625a29ec-927a-415b-9266-439f132c8367", "comment": "Malware payload (Mirai)", "value": "9a2976b8cb5dadfd183c7507be960ce8f8a2d6366eaf00550c635b15d85250044b74a927a7f9acffc4ad6ca61b5bf519", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650611025, "uuid": "f8d8052d-f40e-4166-977d-64af3faabfac", "value": "T157D2D07E1307F47AD4738CFF5AF903151A9A9BA7D2B79C1B74A550D7CD80A7024424D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650611025, "uuid": "681b72a4-8500-4f6b-99d4-82f8b078a7f4", "value": "768:WSzlfoEF2q8C3z4f+wzh0yFlIUd5fww8zNmfJgGlzDpUYshK:WShD8MQ0SykZqNmdVqYiK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650611025, "uuid": "e8bc4d9b-03a5-4d08-b20d-852c6419db10", "value": 30336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650611025, "uuid": "a2268c5f-f98f-41d3-b7dc-0f98bdfa2c88", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650611025, "uuid": "1dd3e928-46a1-4dc2-8a18-a93546268b90", "value": "35a1a222bb941a23ff881d512604944a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b38f1ea2-c203-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1650608169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650608169, "uuid": "ea5e71b1-60bc-461b-ac53-332d23036b75", "comment": "Malware payload (SnakeKeylogger)", "value": "4ef5803c499142bac29e07f3ff5fca1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650608169, "uuid": "81a52ecd-b3b1-4edb-9f2b-643c710b82e2", "comment": "Malware payload (SnakeKeylogger)", "value": "d8c2d3d22dcdfcabb82b3826cfcfc6477100c63d43b633c542fa0c378e0e461f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650608169, "uuid": "ed772741-fa6a-4f72-b95c-ed7360da7e03", "comment": "Malware payload (SnakeKeylogger)", "value": "2c96f672cbaf4af9065a2c5b013a7638c7ce9a8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650608169, "uuid": "6a1ab9a5-536e-471a-a5ba-31da302f1d26", "comment": "Malware payload (SnakeKeylogger)", "value": "875259ec96a34fdfe1334d9e40161c513e8d401037bf31bc5d02728200849ad28f6b65cc6b2b6ceb587aec63fd1b8ffe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650608169, "uuid": "b5924c2b-d7e5-4323-b90d-6723a7e3dd1e", "value": "T10AA37FA7DAD750BBD465063F182252B30E61D32D845E981A34B23F13F8736CE71A1F9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650608169, "uuid": "8df78408-6953-49e2-9093-bf6be6bba120", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650608169, "uuid": "67554230-adca-4842-9ad1-923699befce3", "value": "384:a7OKxFrfffffbqLnEb0KPHTidJFFZFfZ0q6YgyH/JF9Ev4dW7RWM8:iH3yLEAPFZV1tH/JF9Ev9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650608169, "uuid": "e52dc0d4-1549-41f7-8195-80a73e4b31fa", "value": 101376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650608169, "uuid": "4ffc89d4-6807-47ce-b4fb-d48416f540cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650608169, "uuid": "92bc36e7-1f89-4808-8c04-a91ef50c96c7", "value": "22041081517_20220329_16042903_HesapOzeti.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df9e63ce-c28b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1650666654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650666654, "uuid": "ca0669fb-a852-4ae9-9686-8dd1de055b90", "comment": "Malware payload (Gafgyt)", "value": "bb891c61788f3d54c416a9128a52dd29", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650666654, "uuid": "d2713b5b-6a0b-4be4-b0e8-cb2739f98aa1", "comment": "Malware payload (Gafgyt)", "value": "d9f2d9b882e9b5fc2603655cd55962497f735d3ecb9a2dcab7d73470327f2793", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650666654, "uuid": "eab94ea1-856a-4073-ba83-60afb73367c8", "comment": "Malware payload (Gafgyt)", "value": "c9b39aabb102fad163c4d4b9d730bfc1ae6c6fef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650666654, "uuid": "2073428b-311e-44ab-b40c-a68752f971dd", "comment": "Malware payload (Gafgyt)", "value": "754b0ca63d31b6f7796e43ac44f9d8bed76b831aff61356370426811991d35d010f55ecd51fe30a5813e53b180a02142", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650666654, "uuid": "d1266b68-d1ce-48a7-b7fc-eba9016a2d1c", "value": "T149833B8AE743C6B3C44306B1029B6B190931F9FA1A2FAE56F31CADB49F125D57127F90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650666654, "uuid": "64b2ac7a-c8e8-459a-9600-3e31745db76b", "value": "1536:hZ6eLECETvtYWnKMS6DXxU2+9XXm5hirBW85AbNI5Vma6jtafbek:OeLERK36DBX+Fm5hirQoAb+5Vma65afb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650666654, "uuid": "592d58b7-d155-402a-8e5d-ff876fb18cdb", "value": 80747, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650666654, "uuid": "f7309ab0-c795-4463-9e0a-2295c934b4da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650666654, "uuid": "513732a4-99fc-4cff-9fcf-1c689588ddab", "value": "bb891c61788f3d54c416a9128a52dd29", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1367be6a-c25c-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650646125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650646125, "uuid": "98b3beb0-37d7-4988-a2d4-83c1f64a8085", "comment": "Malware payload", "value": "e260cd0da69f1103a721685833cf2290", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650646125, "uuid": "d61e69d4-9c36-4362-8b9e-32227252f603", "comment": "Malware payload", "value": "da43ab00ba01a5d6c4420901a604731e0986d5f00f6063458475aa546e94fef1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650646125, "uuid": "eea0aba0-7727-4161-bdb1-a3c9a4316124", "comment": "Malware payload", "value": "9bb6a263a2290997f53aaf1d8998b414c31d9a59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650646125, "uuid": "5c8483ab-3aad-4974-a876-6fb73e8e4903", "comment": "Malware payload", "value": "45b377c5cd6d84975a4f22d1b8caa19fe62d8258d3aa61d6b30e1b7382809140afc418d5455d1fcf0c7b808f51cd800d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650646125, "uuid": "a932b60f-90f4-453a-83ec-a4f32c20c183", "value": "T11BD49D11F6AC80B5E07BD13DC9A3875AE6713C9847B943C79255EB2A2E736E05D3E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650646125, "uuid": "c2636677-8b26-4104-a568-5ae5b36539f1", "value": "6ba79cbed2acbe9b8ecc8e14a572f100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650646125, "uuid": "6c5f9fba-c255-49c3-844e-73a56f84ebeb", "value": "12288:C1FIcocJwMTHzXO7N2jBHiyzskF1CubVnmn:tco9MTHzXO7Nm/115mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650646125, "uuid": "2c1632fb-2691-4fe0-977c-9f34ad255cde", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650646125, "uuid": "974baa6f-1612-44b4-b4f4-a2349dcda3ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650646125, "uuid": "56e26f64-7895-44d7-adc0-792c9448fcae", "value": "e260cd0da69f1103a721685833cf2290", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "791c0632-c23f-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1650633841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650633841, "uuid": "7c65c2bc-688a-4dc0-86cf-3323ae9bb781", "comment": "Malware payload (AgentTesla)", "value": "4aecceeaf92f8c7906b1cd9a49c2bc8f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650633841, "uuid": "09066ecc-5542-49bc-aa08-5668029014fe", "comment": "Malware payload (AgentTesla)", "value": "dac4dab9e6146af5423fdd5710134555400f04b18cd57a65d32c7a3b93b4e6e5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650633841, "uuid": "aa1ce49f-1c26-40e1-a6d5-954203b92efc", "comment": "Malware payload (AgentTesla)", "value": "fd21167930d4fb13c228e328ead6659bc17d3837", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650633841, "uuid": "addb5a9e-935b-4ddf-b4eb-985d0c7fac94", "comment": "Malware payload (AgentTesla)", "value": "9f07070bf9ed2cdf5af0888361e14eb39b2b98f77588718331911a8a12e48f6375dc62b478deabeadd196fbdaa21ab7b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650633841, "uuid": "1b0de1bc-48b3-4fe2-8ece-23832d468475", "value": "T138E4F069F3B2C916DD58033784E2D8B80332BE567173C74E39E26D6B39133A39D84A56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650633841, "uuid": "2cff5b87-7dd5-4c6e-b3a9-8ba01122ea3e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650633841, "uuid": "286419e9-1388-49bf-9f4c-9456e52e1b7b", "value": "12288:R5DiZ8hFF7zK0WABRVy6KSFih31CN+Tf9xsXSXUYsZ+g19liWoZO:Rc8jR+h31E+5WXNYE+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650633841, "uuid": "28c127e5-2a14-4529-ab53-4540b4826da8", "value": 695808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650633841, "uuid": "ac3a41c9-24cb-4b8a-a44b-941ccf197176", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650633841, "uuid": "360f05f7-9815-43f1-9dea-110a9d91bb5f", "value": "arrival notice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c61c82f9-c25a-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1650645566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650645566, "uuid": "d79c5046-db9f-4c69-94a0-44d389d96f25", "comment": "Malware payload (SilentBuilder)", "value": "c2346750046f0402cb2b2d8f55cdb9af", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650645566, "uuid": "7f874429-8f40-47bc-83ac-b8c3cbea10e2", "comment": "Malware payload (SilentBuilder)", "value": "db7caef0e45ac52c7c7c6f8011ff75de5b0ce45eb70a6f410bad7cdeea79ab06", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650645566, "uuid": "cb8a53a8-28a1-4c9e-b167-208422b1f196", "comment": "Malware payload (SilentBuilder)", "value": "64ca261ae42af7ad7b4a4e641fbab53984d92e35", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650645566, "uuid": "a9d03f6c-6c71-45cc-bd01-028cdba563f3", "comment": "Malware payload (SilentBuilder)", "value": "931981fe3054bb0e3938c933732fd8d558706a8c34cb069119264ae877d4a672cedfe759299bc685aa87db8cd0c4aeb5", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650645566, "uuid": "a67dd787-caab-459c-a8c1-6eb7d763b87f", "value": "T159B39D4BB669D459E923477988EB475A7327FC341F9A47836354F3292FB8CE05A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650645566, "uuid": "97867144-f953-4257-9d8e-18bc2e560239", "value": "3072:jsKpbdrHYrMue8q7QPX+5xtekEdi8/dg+tgSmsCpH/KZuAZGsM3:YKpbdrHYrMue8q7QPX+5xtFEdi8/dgwa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650645566, "uuid": "a189b360-38fa-4ecb-8924-06d61e4eb3da", "value": 109056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650645566, "uuid": "86b1c320-cf6f-4aeb-9a82-11069d46f348", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650645566, "uuid": "0ca7e8b9-c5dd-4f1b-86e9-d7eaa3bd3abc", "value": "Opec.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "799a68f2-c221-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650620957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620957, "uuid": "01485418-c6c3-4728-b5c3-111d76ff372a", "comment": "Malware payload", "value": "76ebb483307303e25c2ecaabbfe343fa", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620957, "uuid": "d078ac6a-8e5b-44a1-8c9e-9421f5542a18", "comment": "Malware payload", "value": "dbaaf5e9a761a3f36b2435ace4645dd3a36a33d0fb87d5477ce3e3db2bce2d16", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620957, "uuid": "3244513a-bba8-4f02-b7c0-4a2f6464db3e", "comment": "Malware payload", "value": "4d5b07e78ed62005ad8b395348f418957daaea44", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620957, "uuid": "90585443-141d-4dcc-9015-c1fb0e030347", "comment": "Malware payload", "value": "19254058d824ed4e72e971894bd9f607b9d8d35d647d574ed9b62574e224d7216ca23a13321c5a52de2ba9b48f7b730e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620957, "uuid": "fead1cac-9a2d-4b8c-89dc-a611d2f1bc70", "value": "T1B1F55B22B24C643BD46B4A36C937AA58993B7A736A13CC5B17F4084D8E3F5417B3E607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620957, "uuid": "898c6146-fd51-4b56-bbf9-7096236aa2a8", "value": "5ba15233b1e2e3a3b0b3e3e4df1de513", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620957, "uuid": "f532ebd0-95bb-4afd-8f50-8c8d08483bd0", "value": "49152:u0kR7C5n4cQAugSQJzATyp4l2C9GLigAxT/cet:u0kRYsjlBGLigkt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650620957, "uuid": "d87cb276-0c7a-40c3-9c93-c9df70651caa", "value": 3491840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650620957, "uuid": "9b69f87a-d53f-45b0-b3fe-befe921a627c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620957, "uuid": "0b87fa95-dbb4-42cd-aa11-879c2c693cf7", "value": "SecuriteInfo.com.Trojan.DownLoader44.45995.27184.29440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eb354dc-c213-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650614925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650614925, "uuid": "d4bb5783-3411-4203-a44b-4578df9a17e6", "comment": "Malware payload (Mirai)", "value": "3d9a50316825196bf21671b5eaf55771", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650614925, "uuid": "4172a34c-5e6d-45b5-ab56-8f16b71cd545", "comment": "Malware payload (Mirai)", "value": "dcf0cf79b8101c2141b447dfdc4a1a554ea34a30c09f326b837f937ab28765d4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650614925, "uuid": "73b997b8-0913-4b64-b1f8-aee9b2268482", "comment": "Malware payload (Mirai)", "value": "ed0dd9e30bc5510610ebd5ee6ce6109d762ed6b3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650614925, "uuid": "8d1323f4-619a-4d87-b220-a7a41e7c0df4", "comment": "Malware payload (Mirai)", "value": "ef7525484d0fc98b4565dde60cd7c3f0985a2ab6b0f6f812f481958ab63702bef3f694567d38689be53ad1ae70537e53", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650614925, "uuid": "fade3c7e-e899-4155-b36d-5f36835a5e1c", "value": "T11D136C76C82DAE80D1584638E935CA781F23F2049297ADF61E9985A5C083EFCF6193F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650614925, "uuid": "e9b10feb-154b-4bab-bcf5-1ff21a20cbbf", "value": "768:5a4VHTwtOjphCmbaeRbvevNONBewCciCaoRr9PCq:5a6TwtOj5aw8wPf9RBPCq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650614925, "uuid": "d7b9f943-aafb-493f-b12d-58a8a8762ffa", "value": 41792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650614925, "uuid": "3c82050a-12e1-4d67-b79c-8abb7b2a4b81", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650614925, "uuid": "c83af01b-c5a1-46d4-bbe9-f546759c6f55", "value": "3d9a50316825196bf21671b5eaf55771", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b1aac25-c21b-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650618248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650618248, "uuid": "a53e2137-3393-495c-b329-91c096533161", "comment": "Malware payload", "value": "189af415c774eff91c5368360a5d9119", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650618248, "uuid": "00371bb9-8a97-40a1-a299-0c7e910b655a", "comment": "Malware payload", "value": "ddacc92ca1120b76f8adae0480761b41e24361ac1667b13a7342e665189d627b", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650618248, "uuid": "2a7f0f2c-c35d-4780-87c1-d17e2c7ec555", "comment": "Malware payload", "value": "08834c5f7e31c2fb16ef5debe68bfc5e28f30ae5", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650618248, "uuid": "191c716c-d3cb-4a3e-9015-e46627fbb8e7", "comment": "Malware payload", "value": "12e698f83721a95d1f4225c61e2dc6edf666eacba4245f5a055d0e447f6908a4944e7ecf68dfde1b60332e73de87e7ab", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650618248, "uuid": "2df54bd2-cb27-4904-98cd-8b214687a3ab", "value": "T17E318E261FD98734E3F14E32A87EE3349562B886CA5A47290280D5C46D50604FC31F36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650618248, "uuid": "a9cb08ef-e6cb-4dc9-9565-9ce31ce1a5c5", "value": "24:8fJj4K3KVA6PA+/JvGlvfOo0wi85A343H:8dz6JGlHOoV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650618248, "uuid": "6384b4df-3b0d-4546-9d4c-a4e514d4ff4c", "value": 1623, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650618248, "uuid": "4f96c84f-7dcd-4b3f-abb2-8cc6b60253da", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650618248, "uuid": "3462950d-db14-4bac-ad63-320587e1e582", "value": "documents.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24f7ce42-c242-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1650634988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650634988, "uuid": "f71cc99b-a4fa-4269-be69-37f5230e2894", "comment": "Malware payload (AgentTesla)", "value": "6364cb89a191ae0e04371c76dde7ff76", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650634988, "uuid": "3e37ba80-4cb1-4b46-809e-e50181c45a7b", "comment": "Malware payload (AgentTesla)", "value": "de6a038ab99857596ef652eccfc058874cdf58bfbaeaf31c14e9eb0242267f50", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650634988, "uuid": "6fb55ebf-44e9-4e00-96a8-d0940490c358", "comment": "Malware payload (AgentTesla)", "value": "c1a12417884bc167a3d55d9fd7d5d3b115758d63", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650634988, "uuid": "90003186-fcd2-4bb4-8d20-3c9181c252f0", "comment": "Malware payload (AgentTesla)", "value": "bc2836a6e102402d83882a738b89d1d7aff943b9f7f444393cc17e289f91597a13be86ffb5222e7e1d042601eb1a3c1e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650634988, "uuid": "f30beb19-b91b-4337-b745-92e3dee7fdaa", "value": "T172C4231C23EC8272C9EC273965217A8863F5DA4A3553FB74DF9DE9C52E267C202911E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650634988, "uuid": "119c8a5a-b217-426c-9d54-f962938e2808", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650634988, "uuid": "4e103a6b-6f49-4a72-80af-0e23ec1e589b", "value": "12288:4E0ZQZC8p5MmUFxMmz23NOZTMpM6Qtgc4rI:4Eq8p57UD09uMpMcc4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650634988, "uuid": "bf0c4060-06c9-40a3-9cda-09173f2750f6", "value": 546816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650634988, "uuid": "bb1d6064-7588-43df-899a-7de1fa0b08c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650634988, "uuid": "56e0f529-62cb-4447-a3a7-3b8eb196a019", "value": "NAVDHENU SUN-062 -Cargo Crane.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9d31d84-c23c-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1650632688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650632688, "uuid": "3f2dd833-b228-4eb3-90b8-0e6f6ffdd708", "comment": "Malware payload (AgentTesla)", "value": "18c22046033a4518a292a2ce8d1a19e4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650632688, "uuid": "ad98b442-c617-40fb-bc88-b34aada67eef", "comment": "Malware payload (AgentTesla)", "value": "dec444eccb384af02025d31c749a86e7ec8c306dc0e491c45b839466f3eb2493", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650632688, "uuid": "26d3b225-2bb1-47fa-b7ad-3e900f81439a", "comment": "Malware payload (AgentTesla)", "value": "45e16439e6dcce03cac4dc9cfedb5cc48f51a520", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650632688, "uuid": "2e7a4dc2-e3fc-482a-b684-8dff06c99454", "comment": "Malware payload (AgentTesla)", "value": "71c5e3e021556213acf85d8d7cb4a885343ca5ffd8647db173603c42af3b1c63bc03e0271746205b552fae138ffa1a95", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650632688, "uuid": "937c220a-6413-4bf9-aa15-67b958a18684", "value": "T1C6F4AFD8B55031DFC466C832C5D69C717FA0B8AA030BA397B09397AD1E8E497DF016B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650632688, "uuid": "78b3325e-05f0-4fd8-9ba5-2b2ef85ceae1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650632688, "uuid": "602bcb02-954c-4180-8f31-6e091fd69182", "value": "12288:vu1EiQVZEt4AB4prLcDXGhG60MNzmZiK/6/BE5ZoffzU3cE3DHpJrxtFYiBRCGh6:diaEt4ACrgDWWMYI1BE5XF4Gh6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650632688, "uuid": "ac470aa3-7d7d-4829-9bd2-53aebbc2a2b4", "value": 773120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650632688, "uuid": "1563ef6d-cd1b-4ce0-9099-a2b18ba4f6a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650632688, "uuid": "e3b316df-c03f-4d86-b80d-d456b58bce19", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e60e0bd-c245-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650636319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650636319, "uuid": "1b0a5b77-2836-440b-bd5f-36cfd56aaabe", "comment": "Malware payload", "value": "95507f2ab477caaf3d4e0bc3d9e66d72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650636319, "uuid": "98a72f54-c362-48ab-b6fe-d0ad7972bceb", "comment": "Malware payload", "value": "df1518ed718792c4caa07b0864fef45ecd0e3802f2646e60136c1ce5a8d55d1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650636319, "uuid": "59d11306-7086-47f1-a296-7360f4860232", "comment": "Malware payload", "value": "a437b781fdf3abfcf25ea04e9312beae5fbfefa2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650636319, "uuid": "4f3fed71-fc99-43b0-b4bd-5c2d10f18d86", "comment": "Malware payload", "value": "555e604c51ae0f25ef65659c8a1556215dd52133aa4c0776bdb44e8c29d51bf4ece2f27f2516200872407a3922c6b6c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650636319, "uuid": "d8fc8b83-b29a-4c29-ad88-22a41ae2df4a", "value": "T1AAD49D11F6AC80B5E07BD13DC9A3875AE6713C9847B943C79255EB2A2E736E05D3E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650636319, "uuid": "87ae39fc-2556-4e2b-8fc5-b27af04866a0", "value": "6ba79cbed2acbe9b8ecc8e14a572f100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650636319, "uuid": "ef8fa327-038b-428a-a24e-4d8760a05565", "value": "12288:C1FIcocJwMTHzXO7N2qBHiyzskF1CubVnmn:tco9MTHzXO7N//115mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650636319, "uuid": "eac98ed2-fb30-4a73-b370-604f21b7c9f9", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650636319, "uuid": "00e68622-3111-4bc3-8d6e-962dfc0e5a12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650636319, "uuid": "3d4d887a-db4e-4aab-ad58-fc0ff1102352", "value": "95507f2ab477caaf3d4e0bc3d9e66d72", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e9f1aaa-c221-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650620965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620965, "uuid": "81089539-61ce-436d-8365-b61094396c1a", "comment": "Malware payload", "value": "bbb3378867ad2737f7a5e07c5a3bfdd5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620965, "uuid": "f25a5576-bf7d-48fb-9ff7-84610fce3b31", "comment": "Malware payload", "value": "df9040061a9621878b9367c71a54d2b0d79c3b4703c7c189f6b5b5489aec6f90", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620965, "uuid": "347f7747-3e7e-4edb-9534-cd3e6b4736d0", "comment": "Malware payload", "value": "91cea74727a863a73918e2b7b959c284703f0631", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620965, "uuid": "b3e4bfdb-0f77-4d8f-9e5f-9b1a3decd7a8", "comment": "Malware payload", "value": "b7e75d928ae9b2a68d4932ed1f3d4f3c3e7895251595ef4d35bb1c5fe5f53af7fc278d61a6a2905694fe360e31ae4f5d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620965, "uuid": "e5b9c0bb-8de6-4795-9e59-80c2b4f27a84", "value": "T153D56C27B284653EC46B193A4937A66CA93B6BB265128C1B47F58C8CCF355433B3F607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620965, "uuid": "2b5c8958-b7fa-4789-b30b-0116d99e7989", "value": "8d1fec45294feeb41a8e94a0b60fa2f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620965, "uuid": "413f5b52-8936-40ef-915c-593f3430a8c1", "value": "49152:WYI/Ychp1EZCcPxS0rQ5Hqg1YZF0LssbBTXjWPt:WYIDJEZCvqhF04sbwt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650620965, "uuid": "4afe0138-b2a8-41f2-bb90-d4165a019743", "value": 2888192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650620965, "uuid": "d45c3ab7-2b1b-44f2-a23c-bb964addb448", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620965, "uuid": "f19d3124-0fd8-4e82-b451-ad2da1c0824b", "value": "SecuriteInfo.com.Trojan.DownLoader44.44501.12448.15835", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e9a0cd0-c23d-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1650632830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650632830, "uuid": "a719be77-770d-499c-9364-fa61cc33f620", "comment": "Malware payload (AgentTesla)", "value": "e5914bafa980304a8fc93435393282f4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650632830, "uuid": "a0b4402c-77a8-4d5c-af1e-3f3f4c034773", "comment": "Malware payload (AgentTesla)", "value": "dffcfb7243bdc46f3a768fe485b4ac56728ff42c445f3e561858ff70cbeca59c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650632830, "uuid": "b12f1daa-b893-4e5e-a66f-ac9051dde941", "comment": "Malware payload (AgentTesla)", "value": "f0a48b1a52841d95ec74cbc320cea3b763c2c169", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650632830, "uuid": "5423b7e9-4a48-44f6-a226-6cab7e6456ac", "comment": "Malware payload (AgentTesla)", "value": "546fd00d50b99b0ba9bccb2f915357b2949f6eafb2fd4e6a30c861a88a5ca3ed0e30cb5bdf6b14affc19788116678b97", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650632830, "uuid": "732ed1aa-afb3-4acf-8d74-8e12fbecac0a", "value": "T1C6F4F8ADB2F0769FC45BC93289641C64FA607C67630BC207A05726ADD96D997CF203F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650632830, "uuid": "55b0b25e-4e6d-44bf-93f1-8d1796c0466b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650632830, "uuid": "6d18a351-2111-4677-a200-7bea6bc21b40", "value": "12288:3SmC+xqqOyRkT9iERpMROddB9UI6W1uDbIMaYqpeaiBS2LPvpYxvtkF4jvywh6la:3SmC0qdq09nRpvBrtiFazpBL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650632830, "uuid": "45d531fa-022b-4678-ac07-8dcd2944ed4b", "value": 790528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650632830, "uuid": "1e8fd4ab-dd84-446d-8da3-2c55ce915337", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650632830, "uuid": "859b2157-fc24-4836-b4bb-190dd8355ada", "value": "Port agency appointment for MV OCEANIA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70be07cd-c1cf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650585723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650585723, "uuid": "e705e364-ded8-4108-bfef-f1b3c19c9d82", "comment": "Malware payload (Mirai)", "value": "055e5b5094c5f0fc246843c2119f0153", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650585723, "uuid": "8022a443-de5f-4b37-bef5-4943293b6816", "comment": "Malware payload (Mirai)", "value": "e0047ab40441af90ec304e1f0132c3aa1369ca2a0871a8fe76d116e32d050fa6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650585723, "uuid": "20271c22-92e8-4d7e-873f-a82fcae1f761", "comment": "Malware payload (Mirai)", "value": "4b5ffe9a44ff9348e736fc5dd8df1554fc5fea01", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650585723, "uuid": "725b5dc3-0065-46bc-bbe8-a6fcdd2cb0ca", "comment": "Malware payload (Mirai)", "value": "37dfacc42ae129b218de2a6b2878bc1a9b8e7577f1c3cd1b68b0a738f8533f92b6814e51567ca3e119618645de4e4644", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650585723, "uuid": "675a5efe-e417-43de-b2e3-9dec86a76cf6", "value": "T19F33074652F292B7FA0B20F170657742E139D23530ECD61BCF0018B6F926946FAA27ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650585723, "uuid": "9648bac0-2963-4ed5-a085-b72af8b004b9", "value": "1536:BCq7rl9wW/AcJ8HQelokuw5oQ1SQ1/QZ:Bd7rMsBOwelywWQ4HZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650585723, "uuid": "235e7596-2f58-4971-a385-c68ba862791c", "value": 54636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650585723, "uuid": "f5d141a0-4fc1-4075-b1dd-012f374583df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650585723, "uuid": "d910cca1-4520-4dad-b371-37f9dd079d14", "value": "055e5b5094c5f0fc246843c2119f0153", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5473262-c257-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650644303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650644303, "uuid": "734d9685-3c62-4cc1-8608-123859e16cb7", "comment": "Malware payload", "value": "6b0121f6bac318f2858696242c0c035d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650644303, "uuid": "fc77db2f-8b6d-4b13-9f2c-4ba17d4dba60", "comment": "Malware payload", "value": "e052bce283aa22d927b4d6074524c263da68c6c0fc5f255e9d5a193cad7ee19f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650644303, "uuid": "776df965-10d4-42c7-a0a2-2fb1181611d1", "comment": "Malware payload", "value": "dab47520ea52bd3bba543088e483e5c235deb561", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650644303, "uuid": "55114320-474b-462d-b9e3-2ac30a412d85", "comment": "Malware payload", "value": "c6e625b16af40d748356fc78594afa15fd0a935db39a427af346e15a7259562f6799e5ca0af9c1cf885dcfa2d3057e26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650644303, "uuid": "2637c3a7-7208-464d-94fd-b322169628aa", "value": "T11095BEE39796010FF162643AD11E6E5E71A20630578FB8776B895BE8D31F2D0B91EB03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650644303, "uuid": "d9773458-461f-41e8-ae76-64aa434e92be", "value": "5a498eee87e4d89512a84502f500181f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650644303, "uuid": "bd312bf7-ea1f-487d-9741-328214b9a1ec", "value": "49152:6P+De80zEHOJFkxBNl7r9TFbuMKh+ofgv+vC2MTqX1Gh8RmW:MOe84EHOJcNZr9T9Qh+ofgv+vC89", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650644303, "uuid": "29d83f4d-a2b5-4bc3-b662-0d0fadf4440b", "value": 1880488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650644303, "uuid": "0cf5e712-4eda-4cac-a91b-ab4da215d82d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650644303, "uuid": "3e951308-8f2b-45cd-b5bb-28f5aefd6c83", "value": "StartGame.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7b4ee67-c20b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1650611639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650611639, "uuid": "6367e00f-10de-4a00-ac4b-8550824c79a2", "comment": "Malware payload (Loki)", "value": "7c8eda91c3b50215f11440a486df8b6f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650611639, "uuid": "bd79e89f-b698-4833-87bb-3390576651cf", "comment": "Malware payload (Loki)", "value": "e0854f580affc72b128b3b37355d832a519e7de76202fc3a9d39fe1d0ef5a1bb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650611639, "uuid": "0fc6cdd3-691a-41ca-86ab-f08fdac1d05b", "comment": "Malware payload (Loki)", "value": "b88a640df090045ae9aeb2c50de0cb122898b844", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650611639, "uuid": "922ae16d-0e1f-4c5c-a197-5cccde2312e7", "comment": "Malware payload (Loki)", "value": "61802a69f0a80d68d46ef983e6aca57ca729f8a067bb765106e2e8ca8465ac2a5d2dc983ee7bfdaa320098d7be61c5f6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650611639, "uuid": "3ef96a19-552f-4112-9ca9-784e5f5346d6", "value": "T112E30195B6A0C1A7F0E14B315D3747ABAFF8990611B81B1F1304379EBE715809E2FB26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650611639, "uuid": "8fcfe85a-7b38-4a2d-b8e4-3a4fd76bfaa2", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650611639, "uuid": "b84f13bd-6c3b-46dc-98c9-42cd6b22b982", "value": "3072:l1NjcVVnLpPunbuH+bztF3EdZDpx8plFFVKNruYGnU/oTah78XJxDGb+y:HNeZmK2hF3E3Dpx4L2JmCwDGb+y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650611639, "uuid": "f4c1ddca-d994-42e9-abee-85e32a9b4d26", "value": 153575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650611639, "uuid": "562843d1-6c01-416d-9d9c-c2bbd1715077", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650611639, "uuid": "44bb41b0-f856-45dc-b747-562b485c10c9", "value": "7c8eda91c3b50215f11440a486df8b6f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a081e32-c21a-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1650617817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650617817, "uuid": "c1640afd-0d11-4440-874d-ba9b9aca86e8", "comment": "Malware payload (SnakeKeylogger)", "value": "817ead0a634ca44e55ad4a690436863d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650617817, "uuid": "b9aefdcd-b4a0-41be-855c-370f461a88e2", "comment": "Malware payload (SnakeKeylogger)", "value": "e0c7728af846221d9c6946d4995f6af7e0dabe347deee185d1c6ba7554a7cb94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650617817, "uuid": "1b3cbb99-a611-4949-8477-8e482793b9cc", "comment": "Malware payload (SnakeKeylogger)", "value": "5710b476e2bfc49652531ebab7a3fd81e503c19d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650617817, "uuid": "c58a43b0-9b92-46d2-9a90-65e580cf6f15", "comment": "Malware payload (SnakeKeylogger)", "value": "8a863826b250754aea362a0a0d61bcc69410d8f84c4ee151efd968635d1eb73cd0159f3f95d7031b10fec71b3f3bf0b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650617817, "uuid": "727fdd01-f898-4cbd-80a6-e19a768fdd73", "value": "T1A3B4121277A095E1C87EEFB570E4144B8BF8C643864DE74D2E3792BB6A643C0125AB4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650617817, "uuid": "a8448d40-1c3c-4389-92c3-7c2eaa3645a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650617817, "uuid": "1e05cc48-3bee-45a7-ba75-d9b2650e1bad", "value": "12288:uushUt2SQuToGmtYRnCK+s4ojQFFP76cSTn3uC1AYtv/h:0UtOeX9+s4ojQDP7y1Bdh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650617817, "uuid": "f089f88f-7ace-4933-8132-70b3560a08ed", "value": 513536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650617817, "uuid": "71822721-94ce-4369-be8f-6bdd5846ab49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650617817, "uuid": "1a7af2b9-2ebe-47b5-a150-1f62f6ba8fc4", "value": "payment slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "788e674c-c23e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gozi)", "timestamp": 1650633410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650633410, "uuid": "7d328d72-569a-45e2-bb74-d8519991c6cd", "comment": "Malware payload (Gozi)", "value": "99ff80925202286d75030a1cae587249", "object_relation": "md5", "Tag": [ { "name": "999", "colour": "#62BA7B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650633410, "uuid": "39e99560-04cc-4fd1-9546-6543d6241888", "comment": "Malware payload (Gozi)", "value": "e100b492468b71cd42e556b9c5c59e3cf5d7b2f1426e2388102c71f8ba997012", "object_relation": "sha256", "Tag": [ { "name": "999", "colour": "#62BA7B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650633410, "uuid": "bd12f09e-37f8-47f0-bd85-a2ea3fe4c360", "comment": "Malware payload (Gozi)", "value": "eb5611f49fbf6fcc73dbdb23b27b1237cb6df5ef", "object_relation": "sha1", "Tag": [ { "name": "999", "colour": "#62BA7B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650633410, "uuid": "6651885e-0084-4b6c-a337-a61a836ee851", "comment": "Malware payload (Gozi)", "value": "355959bbddda56608ef02712394f2e13e72aa5c909f655e80d57d942697fc813e6d684caa1581d8d6d48f35f5640b9ee", "object_relation": "sha3-384", "Tag": [ { "name": "999", "colour": "#62BA7B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650633410, "uuid": "826c854b-2c66-4b0d-b477-211ebd81c2f5", "value": "T11AD4BD1A029B2102EBB6CE78A751636C54570CE09B01E2CFC9190DA395E35FBF4FA5ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650633410, "uuid": "25593d5e-7daf-4a82-9633-037940960300", "value": "fd1c62e6f93e304a27347077f6d2b44c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650633410, "uuid": "09467106-d17a-49bd-ba9a-ad082720b7e7", "value": "12288:+w1lEKREbddtOYRbHzcPwka1dCjc3N8Z3:+w1lEKOpuYxiwkkgjAN8Z3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650633410, "uuid": "cf820733-6479-4a8e-9782-bf0f9007ea84", "value": 641131, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650633410, "uuid": "e8d6eda3-4c5b-4d04-8008-1752cf724b35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650633410, "uuid": "bd0e10ba-227d-4e42-84f3-9ad09b80c47a", "value": "FJHd.cyVNM", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b13607a-c221-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650620959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620959, "uuid": "79d75692-34f9-4f76-ac18-4cee068545d9", "comment": "Malware payload", "value": "78be20cd0560660d986cbec273928c76", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620959, "uuid": "00654cb7-30ea-46ef-9bb8-276f239d0f7d", "comment": "Malware payload", "value": "e1d18968b74ac7a6e98aef490dd77f16ff07043fee2dd9955762851350fd716d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620959, "uuid": "61ad74a7-637d-4b19-8c46-289acd950501", "comment": "Malware payload", "value": "9659d48d1aa58703a59e228d65e41b584230dea6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620959, "uuid": "9f03c8e0-5e11-4b49-88fb-e5a4846a37f4", "comment": "Malware payload", "value": "620589669e0a181334ab37fac48c7770162d2a53105866cd24fc84515231c838ed157acb9a48f1008c315dfd3360dfc2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620959, "uuid": "56ebb9c6-c038-4348-8059-fff35d6a563c", "value": "T14AD56C23B244753AC45F2A3A593BA628A97F7762A5128C5727F44C8CCF355803B3F61B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620959, "uuid": "45d1e73d-f6c1-4052-a339-db8a6dc87ddb", "value": "a94218a9ed16b3bb7fcd9b72ba51c400", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620959, "uuid": "c540402a-23f1-4e3e-b287-508ee2b049e8", "value": "49152:zZRCD1oN+/RgS8VajOzVHd7IFXT3pIpJt:zZ/+697I8t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650620959, "uuid": "303db855-05e3-47c7-8ebf-8ac657f5120a", "value": 2810368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650620959, "uuid": "75eed7da-e158-4651-b5dc-fb9368e5371e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620959, "uuid": "4ccfe46b-6a49-49c4-bcf1-9d468b555a9f", "value": "SecuriteInfo.com.Trojan.DownLoader44.48171.1279.8115", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71bc3184-c253-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650642418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650642418, "uuid": "c4babd14-ee02-404b-8610-0bc916f92604", "comment": "Malware payload", "value": "0d5ddf707e1351c449fcca7ae9324960", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650642418, "uuid": "8653fa38-5838-4d80-aca3-19f3829b151a", "comment": "Malware payload", "value": "e22c7fa4330b894f28851d6ed8228e6cfbfe18afc56419a2b329108162440a4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650642418, "uuid": "65efb1c5-699e-4332-95d7-5d49c12eeea9", "comment": "Malware payload", "value": "d5142b1e4bda77eef0e1c923dcfb985c37381cad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650642418, "uuid": "ac4089f7-7b22-4865-96df-1750960ee174", "comment": "Malware payload", "value": "33131293fdad3163f1934c6236feac75f6b59afd097072c990fdcc4a5a0ec12686ea6fead9139f42b9dd662fb6e54117", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650642418, "uuid": "f0c4601b-e69b-4246-bb42-50556cedcf01", "value": "T106D49D11F6AC80B5E07BD13DC9A3875AE6713C9847B943C79255EB2A2E736E05D3E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650642418, "uuid": "a4e6379c-752a-4991-b856-b625ec199fd0", "value": "6ba79cbed2acbe9b8ecc8e14a572f100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650642418, "uuid": "c08ef96c-0479-403a-bb14-5e5d0e85e77a", "value": "12288:C1FIcocJwMTHzXO7N2xBHiyzskF1CubVnmn:tco9MTHzXO7NM/115mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650642418, "uuid": "7655b787-68de-4767-8862-435fbc159341", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650642418, "uuid": "3059b28a-ba42-4bc9-b84b-7ef40a4c3c1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650642418, "uuid": "74a2754c-5a9f-46d3-98f8-a0fcf364d223", "value": "0d5ddf707e1351c449fcca7ae9324960", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9eaa0c05-c221-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650621019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621019, "uuid": "b5bc4550-492b-4ebe-8a35-519bfd0a5580", "comment": "Malware payload", "value": "a3157fa5a18a18dfd7a33edea6ec527a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621019, "uuid": "c87e9ccb-1cb9-45ed-9b36-0bdd27ef52dd", "comment": "Malware payload", "value": "e238b49c4e3de857d788462fe5a45b89c8924af9b3e6538e09a006a5a0fbdc0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621019, "uuid": "40aad348-91c4-4fdf-92fb-cf49a5fc670f", "comment": "Malware payload", "value": "74e8f08a67ec2b456767b4a0509374f8494b1ebe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621019, "uuid": "1420bb39-66df-4ef1-a666-ee02e152b91e", "comment": "Malware payload", "value": "532ef3b5c49d50d300d35e40dbb0dda3bf6eceb0a7ec41cdcec61e13f47070c35adcfc32f3d3d1a1189f498bdcecbc41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621019, "uuid": "aef5b917-4347-4282-a0fb-f6d0db9517d4", "value": "T192B55C17728460BEC8AA1A7A09339798DC3FA66179928C564FF1085C9F774816E3F70F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621019, "uuid": "7e898450-027d-4297-a22f-dba38d83b2d4", "value": "70814577a59a56c7e72777bfae2dc643", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621019, "uuid": "30a4b659-1af7-4c0a-8b59-5b3ea4891a63", "value": "24576:1/3f40Q1R+pbBO3AGmzW355tFvaBGjTtcmEz9UXJBmSQaH38/GeqHQK2Qnmn735E:K5hFnjRJMSQaHi35rN5JTlHlu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650621019, "uuid": "11662da4-ae32-4068-8317-d688dc55ddbe", "value": 2311680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650621019, "uuid": "757d98e9-511c-4aa0-ab76-6c5e556db89a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621019, "uuid": "63caf2ec-edeb-4621-a64e-df10253725e3", "value": "SecuriteInfo.com.Trojan.DownLoader29.29003.23729.11182", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb08b72f-c24d-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1650640072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640072, "uuid": "e672a3cd-a797-4c92-9a9a-b92444d1ef19", "comment": "Malware payload (SilentBuilder)", "value": "a357bebc504584f98c055da7bb5ffedc", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640072, "uuid": "66845c90-67ba-4b78-9325-fabad869b7c0", "comment": "Malware payload (SilentBuilder)", "value": "e2c5685a02e84597e3491708a9e1076ed4104b012c302480bc0a98aa2f6ec90b", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640072, "uuid": "1b699cd4-e067-4479-9fd4-7e33e1ee690f", "comment": "Malware payload (SilentBuilder)", "value": "e69f4ecf95b92f393d8bd374ca02386f79647d1b", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640072, "uuid": "e2ec33c1-243c-4ef1-bc88-f61050cff0f0", "comment": "Malware payload (SilentBuilder)", "value": "2fb1313d093de7b6717f05e3600971ea5c2388afb5347f31b639006f0da05d38e88392c434321547c3e7d9630eeb8cca", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650640072, "uuid": "345995ca-8b9e-42c6-9186-7a9695e24268", "value": "T1DD633B477549B86AE916CB3D4C974B99B613EC104B960B83BB09B3597FBA9B04E0310F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650640072, "uuid": "9c0c0793-c2ae-4b43-86e3-e7130c3fcbe0", "value": "1536:tOKpb8rGYrMPe3q7Q0XV5xtezE8vG8UM+1YW/ESKQHS1yXJFa5etSv:AKpb8rGYrMPe3q7Q0XV5xtezE8vG8UM5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650640072, "uuid": "5fdb1a87-0667-4588-87a1-6a6e4ba40d13", "value": 71680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650640072, "uuid": "810fbf64-78b7-48a9-b3c1-9204f64ea82d", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650640072, "uuid": "d9cc4e5b-5537-4643-ba89-80a5bc74d583", "value": "Frage-zur-Rechnung.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6afcc458-c25a-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650645413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650645413, "uuid": "adb06ab7-4fc6-4366-aa6d-7cc14e3e5fcf", "comment": "Malware payload", "value": "8b719dc419a6b15dd58344739f8f5a2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650645413, "uuid": "7b032036-0184-4c4e-99cf-ed3c1085ca68", "comment": "Malware payload", "value": "e34f7a5d0ee5a8adfe88839e109d569197c9551bf97d2a3453a796f8cb67f53a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650645413, "uuid": "e58ba37e-e06d-49b7-bb1a-faea5f3e2e65", "comment": "Malware payload", "value": "f6df0cfb594b9b1f6632a34d307e412722d7db5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650645413, "uuid": "268c0d8f-58a0-4362-baae-095e86aaa928", "comment": "Malware payload", "value": "fb41e129f69ea9ae8f59768cd4a4e1d49ebee083727e11878d7e8a867db0d8ec2cccc59c9a5c8b8db44e36e2ac54b6f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650645413, "uuid": "e8e054bc-f21b-42dd-bd25-749988c74424", "value": "T144D49D11F6AC80B5E07BD13DC9A3875AE6713C9847B943C79255EB2A2E736E05D3E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650645413, "uuid": "e9786d4d-286b-463f-8648-57072fae9b20", "value": "6ba79cbed2acbe9b8ecc8e14a572f100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650645413, "uuid": "44e47397-2318-4d58-9025-0ddcc538daac", "value": "12288:C1FIcocJwMTHzXO7N2WBHiyzskF1CubVnmn:tco9MTHzXO7Nr/115mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650645413, "uuid": "e3687feb-90f0-4176-8456-b4ba0c14a005", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650645413, "uuid": "9ae1dd81-dffd-4da9-8c83-308652ed4d97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650645413, "uuid": "18ab2714-70e7-4f8d-92e4-ef017863dd6c", "value": "8b719dc419a6b15dd58344739f8f5a2b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fb09679-c225-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650622712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650622712, "uuid": "d2da7d0d-10a0-4346-8885-2fc71eec55fd", "comment": "Malware payload (Mirai)", "value": "2adc6e0aa1ddcf8533f91dd121863993", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650622712, "uuid": "a57dc5ec-42f2-4f59-81d1-15a429dae3b5", "comment": "Malware payload (Mirai)", "value": "e3ca0119bd2c2d9a8416ba35cabd44d424e16620e6eb90a02527ddc01f5fb463", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650622712, "uuid": "9e0f2b32-3d39-4e3b-9608-74d749bc1860", "comment": "Malware payload (Mirai)", "value": "1ef51e68c7a7d0f0c558f0bdc8a92211550a09eb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650622712, "uuid": "163c2377-aef1-4ffe-bf6f-b40fe035dab6", "comment": "Malware payload (Mirai)", "value": "15937915685bcf5c77321e6bdcbce4f31cd54890a13046f25c1e709657043a27a066dd6a97464f79fbae001e7a1a78ff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650622712, "uuid": "174dab21-d3b3-4327-8f20-13e77f078201", "value": "T1E8332BC6F800BD7CF96FE3FB46274909B930A25491920B27B3B7FD976C311A85A16D42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650622712, "uuid": "2e9b54a7-8300-4f5e-9f83-7a0677c8d544", "value": "768:NjejlqhYl48zfDbCc9K1uznrpl+hOtFnTvS6VS0xXdeEuXxEC8ariwhY:hmx4YicrTCh4BTvQ0xXdCXx/8Iix", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650622712, "uuid": "23a1db14-0ee1-45ed-887b-daf3f14b6295", "value": 51460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650622712, "uuid": "49dd2162-55a9-429b-ab98-3519009a3a36", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650622712, "uuid": "3e45cea3-1d94-47cf-b373-81b3ab745a42", "value": "2adc6e0aa1ddcf8533f91dd121863993", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2515e90-c255-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650643466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650643466, "uuid": "ea2938d1-ed66-4e70-96b6-cbb2c93fdcef", "comment": "Malware payload", "value": "652b9ce78387847c11d586ce006cda88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650643466, "uuid": "6aad1d76-a71a-444e-b15f-4364876d677a", "comment": "Malware payload", "value": "e45130fa4f45844a65d25236d73fffc08525194072109fc2b0c7aa8ce4e5ba9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650643466, "uuid": "74edec70-865e-431f-bc07-6a740ca85cc8", "comment": "Malware payload", "value": "03fbee03b4453f0c851d927d29ab03ff71a1de39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650643466, "uuid": "2474e908-a6e5-46e5-9693-97ca05a12a46", "comment": "Malware payload", "value": "9da14f50b6615c3838c626697b4fbe2db3490802b8110ea84eda898f56a69fc0172c03c3713bdb257eef535e48140f9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650643466, "uuid": "3c7d87b3-3405-436d-aabb-23c4bf4781a0", "value": "T1CBD49D11F6AC80B5E07BD13DC9A3875AE6713C9847B943C79255EB2A2E736E05D3E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650643466, "uuid": "2972fcd3-0904-4422-b2cc-bbecd5d91996", "value": "6ba79cbed2acbe9b8ecc8e14a572f100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650643466, "uuid": "a8cfcc62-3e1b-4253-a137-14cab62bd9dc", "value": "12288:C1FIcocJwMTHzXO7N2XBHiyzskF1CubVnmn:tco9MTHzXO7N6/115mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650643466, "uuid": "da263ee0-17f3-4362-9189-8a2971d73f18", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650643466, "uuid": "d574fca9-b926-49db-bf4a-6d90517f1a09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650643466, "uuid": "d7d50261-0db7-420b-be51-949b55df73ad", "value": "652b9ce78387847c11d586ce006cda88", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94da8c8e-c225-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650622720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650622720, "uuid": "b845cabe-06ee-45dd-a0d3-a93dec974ff8", "comment": "Malware payload (Mirai)", "value": "8a344ba15dfc07bd7635dd52720a8339", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650622720, "uuid": "b536bfb5-d618-445b-a47b-e7d5aacb0d50", "comment": "Malware payload (Mirai)", "value": "e4a3746ec2c3a7cb3375b9cdc9e64701af89692340511e0ef72e877e2c05c1c8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650622720, "uuid": "5b9759e0-ebec-4a7f-b5d1-56b944dcfa14", "comment": "Malware payload (Mirai)", "value": "9dd0d7044119b2785695c688287fbf93f04b555f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650622720, "uuid": "ec4d2650-21ce-4682-9474-ebb5a8921209", "comment": "Malware payload (Mirai)", "value": "70b4982f707098514444fb31bf62354597375116054ebff0b53a62852e4ae0d1c5e1f0e85cf93a003dddf0f0a0ae075e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650622720, "uuid": "a83b4926-c12a-4e1d-947a-ecb7b4eaf8e8", "value": "T1E6A2C01469C77C12C0B10C3CDE2EC805671936F8E2FF3AA27448936499E616F61F9BA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650622720, "uuid": "b98b518e-ac1f-41a1-adc5-beb07072a9d5", "value": "384:EZNiFmApp4+alQlT8rCKmQ97UjhUz4VidZvtwOji5dRUz1BZbIhymdGUop5hN:uiEAQ++QBtKrUTVkZKOjH1Es3Uozr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650622720, "uuid": "b84f7cd1-c03a-4dea-bd95-05f4a608ea91", "value": 22468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650622720, "uuid": "ef1bb1c3-0955-4298-812c-2452ffb6c991", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650622720, "uuid": "92e75d72-dd11-4313-943c-6fbc2270c023", "value": "8a344ba15dfc07bd7635dd52720a8339", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "469834e0-c208-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1650610134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650610134, "uuid": "96b95e55-fae9-483a-a335-511cdb6ea60a", "comment": "Malware payload (AgentTesla)", "value": "d9d48124d18a6721d4dbee8122da2728", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650610134, "uuid": "bb1e8109-11bd-4538-bb9e-050e01a16d9b", "comment": "Malware payload (AgentTesla)", "value": "e4bba9c2af86f903aeecbaf44534222faf78b07bdb4c7604e747ecd6898e38e2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650610134, "uuid": "f5a8e65f-d9b5-4055-9c03-714fe39bcaf3", "comment": "Malware payload (AgentTesla)", "value": "61151664f78bab9c92f32ac4b9415427eacd74a4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650610134, "uuid": "699a4cc0-e93c-496f-b424-9cfb01b14e5a", "comment": "Malware payload (AgentTesla)", "value": "d432a4fd8f2cab2643fbbbd5fe6c23e39ef72f612db220b70f610536d9da27e7a5fb131616d207219afc31bf21ecab9a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650610134, "uuid": "ef7844ea-a877-4af5-a179-40c6a50dfd59", "value": "T1D8C41206B3B182B1C46FEB3270E5048B46F8D653A309A78B146766BB2F513D16346F9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650610134, "uuid": "9f05e420-6a37-4aac-ac06-d3b44de91eef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650610134, "uuid": "f28ada12-c083-4cac-8a1d-58b016460de5", "value": "12288:Lr+glUwcejAuiaqJe4B0jZc7OPA1Wk7MXAYtv/h:m5wdjAuks4B0jRI13YXBdh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650610134, "uuid": "fe094031-bdbf-4ed6-83fa-42546ee5ec6f", "value": 583680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650610134, "uuid": "187ce489-3a59-46d5-afa3-bcc93d564c93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650610134, "uuid": "200c01bb-41fc-45f4-9b7c-0b55e0b2a1ea", "value": "Paynent Proof.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9133d57-c209-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1650610809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650610809, "uuid": "7cbfbdd2-f15d-407a-8d94-47e8411f88fe", "comment": "Malware payload (Heodo)", "value": "0012041a7e99f95f7b27ee7b8f3bc282", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650610809, "uuid": "016b0a44-8a9c-4939-b6ce-b9cfb8107127", "comment": "Malware payload (Heodo)", "value": "e53a1f1227a250ea671f3e27f30b3f22e930790380e00b5ec9c6824d7a865814", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650610809, "uuid": "a408cfa3-d816-4e12-91e3-4c749c568671", "comment": "Malware payload (Heodo)", "value": "7436dde53e1b26d396546506423ca35f25296f0d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650610809, "uuid": "5e535fb9-f940-4b86-9505-82d57c34469d", "comment": "Malware payload (Heodo)", "value": "3aecb189192916e23197d16a648381c9bf56422c67ce68fcf6ed8c76e4bcb87b667b99f32b75d42ba67f6e37d178417d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650610809, "uuid": "2d52a94c-3987-43a6-8500-62e6c7eefad4", "value": "T15734920233C361F0CA53B574840FD525BCA7B43C7B15497DA14BA5AF87EB8909A34AFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650610809, "uuid": "56d990b6-27ee-4e0f-9bce-15ba933457f6", "value": "3072:4TdrXJjOjQyNo6BUv1gr8qcKRXyMjO8rSXVKfp8GSaztT2GTro:S5uok8qcKhyMlSXVKfKGS4Tp3o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650610809, "uuid": "7b24a864-6cbf-4fe7-8e82-8bb185405e59", "value": 235080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650610809, "uuid": "5ed45677-262d-4d0a-9545-71c29bf4bdcf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650610809, "uuid": "2cf55916-703d-4b9f-8245-4525cd2dd4e8", "value": "emotet_exe_e5_e53a1f1227a250ea671f3e27f30b3f22e930790380e00b5ec9c6824d7a865814_2022-04-22__070003.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac704822-c236-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1650630061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630061, "uuid": "bc452c3c-03e2-486a-955a-75546b2b57fe", "comment": "Malware payload (SilentBuilder)", "value": "1e57d4cfd4ef642b8d6b56eb6d86ac24", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630061, "uuid": "cf3c2d65-886a-4f51-9f80-d08dd167ddf8", "comment": "Malware payload (SilentBuilder)", "value": "e5a137b0ef439bbc22f09bd0e331930759bdaea8c7d4c88991d73b8e02a7b6e9", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630061, "uuid": "f91e6365-40d7-47c9-9aa6-0ade45edb847", "comment": "Malware payload (SilentBuilder)", "value": "fd0ba75c57b90954fcdb97ee25e439a055a02609", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630061, "uuid": "b0d5c0ec-48f0-4eaa-bbce-3225cda1c1ed", "comment": "Malware payload (SilentBuilder)", "value": "d25808190c375ad6c50822c5d7165ec216aa1468133a74f3b792f6b49bd5a5713ee54674ad0e8a468b14100e222820b2", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630061, "uuid": "b5c4eb68-f0b2-413e-ac13-8b5a3e091041", "value": "T18923B646BA5D9859E9258B7548E743E9B333FC201F6B0B833616B3257FF49E05A03207", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630061, "uuid": "6ac64866-3ca5-49de-9156-0a1e839e7cca", "value": "768:4DM52tfQXi8vgLZkTOHkQT51Vp6AwPdM8gQ6JT5X6DGwUdh+pqjeSLjcvLtzrxF6:462tfQXi8vgLZkTOHkQT51Vp6AwPe8g/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650630061, "uuid": "2d413873-3928-4235-9ad0-cd7d88cd1bb0", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650630061, "uuid": "d018ec35-78c4-4d90-b697-e148c0422636", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630061, "uuid": "ee961195-c30b-4f8d-8947-ffcb2118e27f", "value": "Insight Medical Publishing.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "384552c9-c24f-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1650640604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640604, "uuid": "d323402c-2e8e-4a56-850b-fdcf45009edb", "comment": "Malware payload (SnakeKeylogger)", "value": "c03291f0021898b8e9f915e339df1380", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640604, "uuid": "068543b9-8616-4707-9fc6-5fe193008ad7", "comment": "Malware payload (SnakeKeylogger)", "value": "e5b07f57add08c310208eb33b32c23855ec9abc6eb8a4e5aef74a20a6dabe673", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640604, "uuid": "993da612-23c5-45b8-8a2f-a428f843504e", "comment": "Malware payload (SnakeKeylogger)", "value": "d9a23ad7c199aabf8196945b52da645b404e35c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650640604, "uuid": "911dbcc7-6570-4dfb-b953-aa9899e33609", "comment": "Malware payload (SnakeKeylogger)", "value": "77e643a6a2b29c1179cdc2271e052b85a1c9500f573c3f18aee72c3d086b055232d5be103afb0013f87a46ae647178b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650640604, "uuid": "62f763c2-f08f-4198-8715-4c91aea2e4be", "value": "T13DA46C9C795171CFC457C972C995DCB0BAA0B4AB470BF38BB4934BA86E9D486CE002F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650640604, "uuid": "2a1dcb75-b976-45f0-93f9-eb50240d888d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650640604, "uuid": "c8069c85-dd00-4d2d-927c-ccac4025cf0d", "value": "12288:zmY1k8Q0uNFtdyyFs4V872kNaDiqbXGo08aXzgRZJrx:y8k8QrXWUWsDiqjGi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650640604, "uuid": "9745974b-5b58-4b1f-b37d-9b1a70123832", "value": 474112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650640604, "uuid": "8c0a584c-90d9-42ca-9474-7616bc38d4f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650640604, "uuid": "39c366d8-1c4e-4f7f-a8eb-598b88d2d5fb", "value": "In-depth Research Report on Global Refrigerator Market 2021-2025.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed7c965b-c258-11ec-8e58-42010a9c0032", "comment": "Malware payload (njrat)", "timestamp": 1650644773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650644773, "uuid": "59419022-efc6-4755-97c4-b0cfcb99268c", "comment": "Malware payload (njrat)", "value": "c8f2bc7df41e9da4ff65d03c3d9c7b87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650644773, "uuid": "fde8ab2e-a967-4b44-9dd0-b0a0c4526be2", "comment": "Malware payload (njrat)", "value": "e5c7bd567513a41f27a05fe959fe40e3cb7ce85da96d1d1663b5115bbaf6babf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650644773, "uuid": "b087f9b3-d4f9-48b6-88d2-dc28e645a338", "comment": "Malware payload (njrat)", "value": "7cdc7601275ef7c94f376b653618a05657e9ab9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650644773, "uuid": "0ae221fb-c1d8-4265-9b17-6c50c5828e4c", "comment": "Malware payload (njrat)", "value": "b01ca0807c015069d611222153f2df9d299b0a905e39c12d061dbb5a18c625fa0aa2a17e9553fb8026d8338d3b260bc3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650644773, "uuid": "4fdd7178-aef3-4a33-8628-e8a7d950c920", "value": "T1DBF48D40D6D733D1E95EEF2A185E4673D4374938762ADE181472DE02A833F1E2BEC1A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650644773, "uuid": "08f963aa-0a38-41c8-a70e-16c6a2770d17", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650644773, "uuid": "bec0a0a0-3ed2-4e5f-8def-94fa0744bb9e", "value": "12288:8SEFpJBOl4tAul2fyrw6FdVZUdXdbMF2IzDRFh2oyP:8zpPOl3pfyrw6nV3F22DRFEj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650644773, "uuid": "abef7c83-34c1-45b8-a9f5-067843161ac9", "value": 738816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650644773, "uuid": "35bb1306-0f85-4059-af3c-b99fbac09d79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650644773, "uuid": "cd663c86-8dd4-45e2-9beb-e494482ed78d", "value": "Receipt3913.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "169b9de7-c245-11ec-8e58-42010a9c0032", "comment": "Malware payload (CoinMiner)", "timestamp": 1650636252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650636252, "uuid": "9cd5ccc0-c1a5-44b8-95c5-c596da6aa855", "comment": "Malware payload (CoinMiner)", "value": "af779aace69c5fcb64cb85edf9876a72", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650636252, "uuid": "f404ce6d-fa55-4190-b566-0aad8a76e370", "comment": "Malware payload (CoinMiner)", "value": "e6fca45846eca1bcaedded82438aa64968717c4f0dab149c32c5db6d08210f39", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650636252, "uuid": "69badf4a-138a-49ce-928e-3dd659e58740", "comment": "Malware payload (CoinMiner)", "value": "099992ba6887db6b6b34947926b1d695a4258ef3", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650636252, "uuid": "15228e2e-6628-4e72-8a47-8d8b1d9d7bb0", "comment": "Malware payload (CoinMiner)", "value": "52f53bb94d804c71e73ab7404ef4f402413f4208aa849abfe8ae88b86d2a9253d3fa218e9562666e2390300d72da126c", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650636252, "uuid": "c781a3e8-cda2-4216-81a9-cffcdec815be", "value": "T120C533FA0D9CD357D207613B12192826523A011D2EC9872F378BEFF898A9FF5780A4D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650636252, "uuid": "0a55ed0a-f8d9-43f1-ba18-8b55ac2c4acd", "value": "7dbd2319b33ed25eb7ad7d0162c2bb3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650636252, "uuid": "568e8ddb-e251-45d0-a508-9aa263999d2f", "value": "49152:B4bI1nPdSmz0GzBu64Td6nCVed98heu/N+Ktzxbn8kNxtUpACCY:CGhz0GzL4TUCM//AIKTnJUpN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650636252, "uuid": "628d2dc7-f4f9-45fe-a0ea-5fa28b9d9ac7", "value": 2710528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650636252, "uuid": "3b9b0f30-e4b2-4c92-9bab-f9176b5ba610", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650636252, "uuid": "f47996a5-b784-490f-83d9-ce8f255ebb56", "value": "e6fca45846eca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bf63b17-c24d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650639671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650639671, "uuid": "656f88a9-f691-48ca-a866-02d390608baa", "comment": "Malware payload (Mirai)", "value": "11abec0e0a5cf63e275d17673adc0617", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650639671, "uuid": "1706c0f8-9b9b-47cb-85db-3ad3dd14c2a5", "comment": "Malware payload (Mirai)", "value": "e74755ff8b4927e257566302296e17e5d28cef17a6daf287cda9e63ce6c6f575", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650639671, "uuid": "34bd5c19-cde0-41fe-b708-2d9b85f72771", "comment": "Malware payload (Mirai)", "value": "b0f721eaa06439f1a4e51848e5eea0d75f78afcf", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650639671, "uuid": "9c0fb234-5ed1-479b-9bf3-7c54ecd9f3f7", "comment": "Malware payload (Mirai)", "value": "a78c1486774ea7bfa6dd9b23467581c4b81277fda696d43d7b3a6e39dcf2ad7cf5727b4abfa5251cdf9170d9562c5338", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650639671, "uuid": "ac0577ca-ca35-4e89-9857-4677dcb03589", "value": "T13653F1E484987AB3F1250C32ECEB8A0733902FD4EEB430E71088866A5DD755967FA71D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650639671, "uuid": "ad0632fd-3fa9-41d8-abea-d0a42248486b", "value": "1536:TuyN+6kWbPLYl1KZVwZxwWMU+eFmy8a8mS:TN+6kIPcTbyWMUpmk8mS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650639671, "uuid": "11d7b735-c6ca-48fa-ad11-4bbde16e6534", "value": 61344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650639671, "uuid": "af1a76b0-cebb-4aed-b184-a2b96361063e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650639671, "uuid": "e1284c03-d471-4472-8139-70e806a2ff41", "value": "arm7-20220422-1501", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ca9131a-c211-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650614009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650614009, "uuid": "deea65f7-5672-4b77-8b58-48cbc9ddaa2f", "comment": "Malware payload (Mirai)", "value": "79e069113702f22cb8072cc7deb43d25", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650614009, "uuid": "b87d19ef-690b-4e8b-9d88-19f3f288413e", "comment": "Malware payload (Mirai)", "value": "e74f8fed119fb1d6065740e1aa6f371666a9bd4a5a3fa7e6ce72afbd72da21fd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650614009, "uuid": "83e2673f-7b41-4117-9e2f-51d63c0c1d80", "comment": "Malware payload (Mirai)", "value": "ac1b90ece7440872d4d883a35888d2c41c79fec8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650614009, "uuid": "ff74b9dc-b00d-4ba5-aabe-e54802fa98ee", "comment": "Malware payload (Mirai)", "value": "afdc92eb75f01be2ba4b7d4296ea308536d84955cbb0f1dbdef22e0e04f5533bffbce565e25bce7da458277cbcfa752b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650614009, "uuid": "a17eada2-2480-4978-8c78-d333cd5442ad", "value": "T1E943F946B8818A15C5E813BAFE2E118D33136778E2DFB3129D116F1477C6A2F0E7B946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650614009, "uuid": "f94dcdb9-57a4-4ccd-9817-84150f6a5570", "value": "1536:JdnoOuQ3SvJwLqpSy0ynj0iGr3Xj+aLxIbridgE5Qu:bFWw+pRPgicHbgE5Qu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650614009, "uuid": "ea57d6dd-08fa-4418-a488-55e6117ea1f9", "value": 56576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650614009, "uuid": "6c365e10-0de1-4947-9438-7aa93693f607", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650614009, "uuid": "b14d9bbb-6e44-4328-9dc8-fb9967d39bda", "value": "79e069113702f22cb8072cc7deb43d25", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cd9d1f0-c25f-11ec-8e58-42010a9c0032", "comment": "Malware payload (DCRat)", "timestamp": 1650647484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650647484, "uuid": "e808bb84-acb0-48a2-8458-bf621fa82161", "comment": "Malware payload (DCRat)", "value": "0e78eea82c9e549a4ed00677d2dec982", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650647484, "uuid": "84edbcc0-6401-4623-ba1b-c35c14d64242", "comment": "Malware payload (DCRat)", "value": "e8da6a083a85303e0c32aa2b065fbdcb77422b919bc8a5d92e1c9dead700ff31", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650647484, "uuid": "1686c547-cbf4-46d5-b3aa-7fb2dcdaa093", "comment": "Malware payload (DCRat)", "value": "b72a3bfe87b6170531fe4ade416252907baead73", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650647484, "uuid": "38c13f22-4696-4552-87a2-2dc9f4baa3b0", "comment": "Malware payload (DCRat)", "value": "826d07c60edd401f0fbdc463351b5b8da24da5376ff80a78d308acd5a79e3856c68cc9e8d2058436d77b6955d22ef3e8", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650647484, "uuid": "49b0a4c0-bbef-4964-9dc6-1d0d9f1c18e4", "value": "T18A658C027F40DB12E0A45237C2EFDA5843A0ED456AA6E31F7DAA336D15017A77C8D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650647484, "uuid": "c22b74c3-cce4-436f-a833-a35df8dc8a1f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650647484, "uuid": "570da349-5bfd-4b21-a8f6-b48947637820", "value": "24576:UlmyJ5FqJipBpreVaMkk6wjjvhHP0cXM3BVc7cDsue:1yfxp696wfecOVcAY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650647484, "uuid": "a02254d6-bd67-44fe-870b-6068b152130e", "value": 1525248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650647484, "uuid": "a492298e-a4af-47f0-9291-239da9270a99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650647484, "uuid": "f2a823c4-dcb7-4d28-b826-f16d3ce2eac6", "value": "0e78eea82c9e549a4ed00677d2dec982.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc4888f3-c236-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1650630088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630088, "uuid": "a3569f7e-d18b-41eb-b6c6-d00fbb3a1398", "comment": "Malware payload (SilentBuilder)", "value": "edc209a61b842ffe0e361eaddbac32c7", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630088, "uuid": "54b01913-5510-4a85-8fed-f51e71ea780f", "comment": "Malware payload (SilentBuilder)", "value": "e8fc9c4a918ee21a34294fc3ec260f92fbb40cee59cfe01f71ecb4a2dc69ad8c", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630088, "uuid": "b03bdbea-10ed-44ea-b8c1-fb0b44eb1756", "comment": "Malware payload (SilentBuilder)", "value": "345d16dc8e99b546cc9d4ee8988b386bfefb18ab", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630088, "uuid": "25d84623-3360-4fb3-b6b1-0d62417c2dc2", "comment": "Malware payload (SilentBuilder)", "value": "4bb217b574256d9385bb82d455bc4308a93335d36e2fec5bd76fa2228cf078f8844135119981c2df24e807c0f4632a7e", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630088, "uuid": "5b6bcfa9-9b3b-4010-b95c-6408fae996e5", "value": "T1DC23B646BA5D9859E9258B7548E743E9B333FC201F6B0B833616B3257FF49E05A03207", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630088, "uuid": "2a8fdf30-be21-4dcf-93b6-c7935e243503", "value": "768:4DM52tfQXi8vgLZkTOHkQT51Vp6AwPdM8gQ6JT5X6DGwUdh+pqjeSLjcvLtzrxF6:462tfQXi8vgLZkTOHkQT51Vp6AwPe8g/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650630088, "uuid": "5f952619-3e15-479a-b002-d8810b8fad1b", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650630088, "uuid": "068476ed-dadf-4c24-a80b-ec23cae3a508", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630088, "uuid": "dd781591-bd10-473d-a998-c17e25a1e76e", "value": "OMICS.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "835923cc-c254-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650642877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650642877, "uuid": "cc0b7d59-3c49-4bba-8ebc-658444e2050b", "comment": "Malware payload", "value": "0d9941e36347c112f5a902e71a6ccafa", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650642877, "uuid": "8c7d54bb-3370-4576-be46-fd079d80f849", "comment": "Malware payload", "value": "e8fd95df28832bddcb69c2686d82119e86e2e3b2ec72224351f713f9167d01a5", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650642877, "uuid": "a242389c-8951-403a-a6c0-dc6312da4c57", "comment": "Malware payload", "value": "acf8c6c6fed7730f8ed21bb53a71e81e656ee5da", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650642877, "uuid": "2f309bcb-ecd7-4fd9-a115-fa84689bcd93", "comment": "Malware payload", "value": "6049d4151af7ece401b1788b3bc59cb04fd2f41fdbfef3183fba8e3f3c2cbb5949ad404d133458db059160af60b5341a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650642877, "uuid": "24940647-bd8c-460d-b6d3-caad93fcfd27", "value": "T1CFF48D4BF77C84A6D16AC979C5639A8AE6717C454B71C34B4360FB3E6F337A05A2A300", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650642877, "uuid": "c7f0d599-6c50-42e9-8637-423b20b1c7d0", "value": "57b460f7cd0fab28b120cd121cfb7f9f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650642877, "uuid": "e89e3a51-c7c4-40a4-bdfa-8618e29e03ae", "value": "12288:aIabL1+x29hs+bDBLKhKmCKzTrjmi0I8PxiGhWzx+o8/NQfN7IT5p:XabLXhs7AZKzvjzT0hWzP8/yfRIT3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650642877, "uuid": "86a20f8a-7be5-4668-ba6b-f90d5c8395bf", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650642877, "uuid": "87fb3d97-08d2-4af4-ad63-64b67cfb696e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650642877, "uuid": "1fae6c08-51bf-4c12-a839-32ac6abc4867", "value": "emotet_exe_e5_e8fd95df28832bddcb69c2686d82119e86e2e3b2ec72224351f713f9167d01a5_2022-04-22__155431.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72a9ae5b-c23e-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1650633400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650633400, "uuid": "b9569d96-ac82-4291-bc5f-e8fd017f0a9b", "comment": "Malware payload (AgentTesla)", "value": "1e0a6080c7100fe72fd2715055b468d7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650633400, "uuid": "e69ee9e7-b8ea-4756-b1ad-cfe84364fd47", "comment": "Malware payload (AgentTesla)", "value": "eaa33438581f402122eb0034a42fb438515e83bbe4a63875e4578cbdff6c2c60", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650633400, "uuid": "c1c66f3e-a77c-44e0-83cf-c4667b8ed421", "comment": "Malware payload (AgentTesla)", "value": "6bdf787ebf6b0abc6301ec12777d062eef44dc5d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650633400, "uuid": "7ec74992-e305-4ca5-b03b-58bb8b13b6e9", "comment": "Malware payload (AgentTesla)", "value": "3966c34a996b02a4de948d493f5edde8a1bccb305ba35778ca2e6227f349c3c919a4fc8e5600f5540ad180fc171cd0d9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650633400, "uuid": "f3afb497-d275-4254-8f51-c1cf0aabf3ec", "value": "T1D3B43C2C3A4D1A72FDDE9930894A2A18BB660F0323E4B9C257DB15CB874F1F56D15F88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650633400, "uuid": "3bc37292-f71f-4d3c-ba68-4154e474aa55", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650633400, "uuid": "466cd055-926b-41a6-9243-cdf0b39dd855", "value": "6144:RM19osAoAwRy3yMnpyoik9GwzvwYUzdN8P2OCjd0nqwuZ6Hp2:RM19osFAwRy3yZqT7TUzLFOCjdA/u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650633400, "uuid": "36afa138-1b97-4860-915a-4f5ac7d0c094", "value": 501760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650633400, "uuid": "ae1d5039-4ddf-4982-a1ef-cdb6b5708ade", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650633400, "uuid": "0e4675e2-dfd8-4301-b7af-c1880e5a1ebc", "value": "MV. ZHONG HUA MEN PARTICULARS.docx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0618be61-c1fd-11ec-8e58-42010a9c0032", "comment": "Malware payload (AsyncRAT)", "timestamp": 1650605301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650605301, "uuid": "cbb60c6b-6b91-4994-aa38-db82b015df14", "comment": "Malware payload (AsyncRAT)", "value": "eb5a3687406bba50732dafad3f58557f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650605301, "uuid": "be8c684b-4541-4527-bd64-bbd55486ec4b", "comment": "Malware payload (AsyncRAT)", "value": "eaffa39ad5021afacfadeecdebe3765b8f0b81cc5911f12f0d4b7d2510a8efd9", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650605301, "uuid": "5996f67d-bf4e-434b-bfef-92b60c12e6c8", "comment": "Malware payload (AsyncRAT)", "value": "84f763eae302331ed745ae3553cb1addf5bf8e2c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650605301, "uuid": "39da27af-e1a1-4dcb-9779-e0e8051350e5", "comment": "Malware payload (AsyncRAT)", "value": "3fdfdae208fbe08a53d04f408b6a3e961858d45279c73d4bfbce15b4a6cae4c52c969096270b9d64e584eaacc2a9b934", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650605301, "uuid": "2f68bc46-0089-4985-b3d9-f0e8f12025db", "value": "T1C2636C00379CC926E5DE86B4BCB2554006B4C6372106EA5E7CC451DBABAFFC64A137EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650605301, "uuid": "92d72450-d2be-4fe3-a66c-772743a769a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650605301, "uuid": "52004cd2-7e3a-40ff-bc9a-a997c2ef455f", "value": "1536:3ntG0AgX2IkImQoTr201bbsJsRZMQpE+asgNpqKmY7:3n2gmI4/91bbsJCBOKgWz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650605301, "uuid": "1cf2aea1-169f-48c1-8c10-2749505dd9d8", "value": 67072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650605301, "uuid": "44e70395-e576-46d4-b350-463b12e0f5ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650605301, "uuid": "40820bed-e175-44c0-9f2f-175a575f03e6", "value": "eb5a3687406bba50732dafad3f58557f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55fc86ab-c239-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650631205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631205, "uuid": "1931e38f-1de9-473b-9f33-27dcd47ec8f6", "comment": "Malware payload (Mirai)", "value": "e648a4c5526b078c1622061f1ccf6899", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631205, "uuid": "c553adae-7d35-4cdd-9e18-fca9aa2ad29f", "comment": "Malware payload (Mirai)", "value": "ebe7a9acfc6159b66c483491e3792c89dc7a20f54b6309357f644fad96dafc47", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631205, "uuid": "cf515225-51e8-46d7-ba86-1345b0e17cd6", "comment": "Malware payload (Mirai)", "value": "f4a6ae9370e0ef1c1de4b620a713e357a04aaed2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631205, "uuid": "e1693420-0e28-4be7-8871-c6c5ae16804c", "comment": "Malware payload (Mirai)", "value": "40b12e09e8ab4cc7c7fe5c445d8e2b07ad86520ca3bd478774ae6b6ca6264a516aafc33f9ce829719ad58286a175735b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650631205, "uuid": "e191bc4b-5c69-4211-b135-1beadcdf08ba", "value": "T14DD3A51BBB618EB7D81FDE33059A4501248DE19A12D97F6BB2B4C91CE74B94F08E3D84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650631205, "uuid": "ed5821a7-8e5a-43de-9a43-12c4368064c7", "value": "3072:IAn98I/8ZdlxFy5hjVD3VJrmW+IFB1Dt1hR/:/6I/8Zd05hjV5JrmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650631205, "uuid": "d382b911-ce02-4d44-9597-60e796e7e630", "value": 134327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650631205, "uuid": "75398b07-64d8-4187-82f6-f38a532f73bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650631205, "uuid": "d45bb5ae-e913-4a02-876a-6b0266fb4b5c", "value": "e648a4c5526b078c1622061f1ccf6899", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d98c356-c221-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650621017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621017, "uuid": "ab6f4117-bada-4fa4-bc11-90a56dfa60ac", "comment": "Malware payload", "value": "f45c21ac92786d2120b93e96afcb75b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621017, "uuid": "0e48283e-5e69-4d2e-afd5-100064381c63", "comment": "Malware payload", "value": "edd0ddee732566c1beb441349d7e7ff19b9d0cb8b0da15268541f1b04ca930ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621017, "uuid": "44afc424-2841-4ba6-9a60-3bcb5556f50a", "comment": "Malware payload", "value": "6bee4776afaa51fbe4d3f0cff8045b177deff9e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621017, "uuid": "78fafbc5-725e-4522-b79d-29313c53b6e9", "comment": "Malware payload", "value": "c8433bd585221b4a1081be396833ce6c724fbde0a8a0774b4c3ed80e38af0a8e1d7e0ea45cd1378e053fa78cee81e79e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621017, "uuid": "ba078937-66c8-4c3b-b54e-7c297360f704", "value": "T1A9B56C17728421BEC8AB0A7A09339798DC3FA66169928C564FF1485C9F774806E3F74F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621017, "uuid": "c19c6229-8e30-467f-932c-100c718a7215", "value": "70814577a59a56c7e72777bfae2dc643", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621017, "uuid": "55acbd1b-2e69-4e7f-b1d2-9dbb0af192e7", "value": "24576:1/3f40Q1R+pbBO3AGmzW355tFvaBGjTtcmEz9UXJBmSQaH38/GeqHQK2Qnmn735A:K5hFnjRJMSQaHi35rN5JTlHlu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650621017, "uuid": "d46ee0af-923e-41bb-8148-685ac8c511ff", "value": 2408448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650621017, "uuid": "9632d6fb-d719-45cc-92a4-c46ef86a9bc2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621017, "uuid": "e8c75e98-459d-4327-99b2-dc17b0609f93", "value": "SecuriteInfo.com.Trojan.DownLoader29.29003.27713.10617", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee71b95e-c296-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650671404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650671404, "uuid": "d459b9e7-5a4d-4aee-a0d9-6c7cf970113f", "comment": "Malware payload", "value": "6406f0edf74a097a9ee2f642916a81cd", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650671404, "uuid": "dc5be511-9d18-4ea7-8219-4cf3bb013f7b", "comment": "Malware payload", "value": "ee5cf01097c65c9728d20ce3a044e9403a272691e425027fad2688afd7ef4135", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650671404, "uuid": "839895ae-747b-46f2-8dd9-eb38c9e1c7d5", "comment": "Malware payload", "value": "a4b322afe3874763977380b82e51b915b73ed789", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650671404, "uuid": "0466216c-c787-489c-aaca-a0713d5259c8", "comment": "Malware payload", "value": "b0ca0cf41ad3b0da23c70bc63865f307cb69a9cd83d47bf7bc0a6a916cce36b72a10d03e2b491c5fd30a43d8bd7ec51e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650671404, "uuid": "2e4dff3c-9ebc-4a00-a1f2-dae4ea131f03", "value": "T1C4930941FD418B27C2D237BAE78F435D37366A5467DB33016A396EB42BC27982E39520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650671404, "uuid": "fcb68d66-eaa1-460c-b124-d7ace514efc8", "value": "1536:LBkF9VQPAGaHYyEfgcqpq1innPTxHOxTePczYrmREqQ4b/X7XSee:OQ2HYBv1WT2ePcKmREqQ4bv7XSee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650671404, "uuid": "a74e536a-1555-4faf-bf66-9d61856964f2", "value": 92448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650671404, "uuid": "d4372cf9-61fa-43ba-a7ed-be3f2a92d1dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650671404, "uuid": "5b0c18ab-7d9a-40ed-9534-c5b31090b1a3", "value": "a-r.m-5.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6c0c44c-c28b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1650666640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650666640, "uuid": "c7a000d8-4c44-436e-939f-9fe828c9750d", "comment": "Malware payload (Gafgyt)", "value": "883378a6ddefac657aa93831ad17a333", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650666640, "uuid": "f1ca01ac-b5df-4902-979b-2a6611fa27fc", "comment": "Malware payload (Gafgyt)", "value": "ee71e51311a998a6bda6249dac8990f483265b23e80337ae40fd2a5f6d4390e1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650666640, "uuid": "5db39c58-8914-42db-8849-f132b5a91305", "comment": "Malware payload (Gafgyt)", "value": "ca9806bfb4e3feb6444fae623c43306d7b32b84c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650666640, "uuid": "569c48ba-0039-4aaa-9980-0f625d200210", "comment": "Malware payload (Gafgyt)", "value": "85fe4578f110996641d8f04ef852600428a69ae2bfe949b1badf35482b1ed8f031d78d97148ba27ac0a592e8afca22de", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650666640, "uuid": "f2c0787e-f3f8-4716-ba07-28125744ef87", "value": "T165A32A05F9118757C1C327B6F78F47493B3167B997DB33026A34BEB02BC27991A2AA50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650666640, "uuid": "9e1cae76-dd54-4138-bf60-97f1d2a577a8", "value": "3072:7e9h9oZv5hvFfKufS2faYj0+rQ0Knm4XATe:y9wZv5hNfKfpYj0+rQ0Knm4XATe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650666640, "uuid": "f2bedbaf-4c55-44f9-97a4-2b85d814ba41", "value": 103862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650666640, "uuid": "7bcb7dc7-b027-4b3b-828e-324bc8ea15db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650666640, "uuid": "71f44c7b-4220-4bb0-98d4-b63c621e22f2", "value": "883378a6ddefac657aa93831ad17a333", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9983f7b-c257-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650644257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650644257, "uuid": "cc6bbb88-af5d-40cf-9c37-9e18c3dea928", "comment": "Malware payload", "value": "b334c8b2b2e78df69149b2e3ee11bd6d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650644257, "uuid": "35e4095b-2644-4f62-88c5-c1fb55e4db0f", "comment": "Malware payload", "value": "ee7f035a2ec79483c1c193e4b4a2c8eeb7e6c414705af97c7bad630b0f5efb8b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650644257, "uuid": "d5f49752-1c37-42f6-b788-f5707fbf1a65", "comment": "Malware payload", "value": "90734e0555d7d6f53cacdeae8735b651d1d9cd30", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650644257, "uuid": "7210f71d-b1a4-45af-a5f8-b6866dca52d8", "comment": "Malware payload", "value": "f564689dc1b22034be86c33645c85ed4bd88e9a516718d79ade19d6fc99aea5934ac0a73808581cacf442aafc81d321c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650644257, "uuid": "e8be336b-4306-47da-9eeb-76c2082dd4e7", "value": "T167D3293327660A23C5E6543541E79333B7B6CB883978524BBAD05E9C3F0AAD035973E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650644257, "uuid": "85043d62-bbb1-4c0b-ba50-aa23c3a6b3ad", "value": "3072:MMwCIRNzVwdkhYpz0ZO9c4Ur7im7wAWRnnb:MMXIR55h+ikc4mim7wAWpnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650644257, "uuid": "b9fa93a2-d7aa-4a40-976e-1a504ae69e06", "value": 137798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650644257, "uuid": "b78c3653-0335-4cd7-bf92-cbb833d8cc00", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650644257, "uuid": "e90f9138-11bb-4866-8b89-32e1f009a918", "value": "SPARC-1.o", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2482b45a-c20e-11ec-8e58-42010a9c0032", "comment": "Malware payload (SystemBC)", "timestamp": 1650612653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650612653, "uuid": "b9dc4a08-5baa-43ec-8937-b6b11268a8c8", "comment": "Malware payload (SystemBC)", "value": "b65520eadf05eb595f815f8394c00198", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650612653, "uuid": "64abd555-3905-40dc-989e-c7077325f8aa", "comment": "Malware payload (SystemBC)", "value": "eeaf54eff267bc4507152b623f6d4ed77fe1b849b31956094817795e46155e7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650612653, "uuid": "d15ebe37-4a80-4b0a-84e6-6c391d3d73d2", "comment": "Malware payload (SystemBC)", "value": "9d48758bb2600482ee31b2cc423aac7c3809cf47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650612653, "uuid": "428568f3-9670-402d-a1d1-0d7b4f4e9933", "comment": "Malware payload (SystemBC)", "value": "d5487a7cdb30c23e0393596e94f6f755a106ae5fb3352e6f710afa23d4fb34dd15fbe8c840a7d702754f9d42bb7fb9ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650612653, "uuid": "4764f047-64fe-4766-a7d8-e9cadc169976", "value": "T1C0F3D71765607972D91D52F640A31F68936EDC6362212B3F7BDC3C5E2A723C2CB74229", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650612653, "uuid": "ed971cf1-8ba8-4aed-ab9b-18e8c159023b", "value": "210439a0c1f20e8629c72d5e640f6ab4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650612653, "uuid": "4fac2eb0-714c-41a8-b49d-855947487f88", "value": "1536:P8jeNzpHzBEvBMFLshxcZfnbRTX8JdWluVVCMnmPR3Xj66u7fs:PkevHzu6JN8JdjYPR3UTs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650612653, "uuid": "fda94ede-90ac-480a-9bec-621285c2db65", "value": 159744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650612653, "uuid": "27359918-4b82-43a3-bdda-d92830337c19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650612653, "uuid": "04841fa3-cdba-4d62-bd5d-d0a041596677", "value": "b65520eadf05eb595f815f8394c00198.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91f4734f-c208-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1650610260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650610260, "uuid": "1f2f214c-d6e4-4f93-b674-d387f0ac8f04", "comment": "Malware payload (Formbook)", "value": "f025f14a9c8ac48339516a72957cefbb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650610260, "uuid": "4e07527c-4eac-47c9-bb59-1d866dd8cfd7", "comment": "Malware payload (Formbook)", "value": "ef6afcf6443963adffc7556a9ba1774d893dbcdabd7f5d5f30c84b5bd506a727", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650610260, "uuid": "7153f95f-519c-4365-a0fc-0567739e8379", "comment": "Malware payload (Formbook)", "value": "deed54683505f04574db49be27a5c020680f0c5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650610260, "uuid": "e35477b3-68fb-4590-8e76-789d603b18f5", "comment": "Malware payload (Formbook)", "value": "f28d2d95b05e2951b1ead43b7f4bd03725de6a9f5a03bbf11d420996c6bed0782b341f7f492468f8f51426c62ca2801c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650610260, "uuid": "5058e418-9ab0-43f7-af93-a017a0043b13", "value": "T17123E71A7DA6951AC5E43BF859B1518356367CE20024C18FECFA7F29ADB2313CCC266D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650610260, "uuid": "1512e97a-b3d8-4279-b73f-2519d4071ab7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650610260, "uuid": "22da619a-bdec-4c89-a55b-f53fde58b1d2", "value": "384:yT5+/bWfffff4hrA52sHTidJkFNQXulaiAMwCKFH2S3dd0hUADkaj21Y8:aU/bnMPFNxlmMwCK/3deVDdK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650610260, "uuid": "dd83fc8c-5978-4b1e-b1d2-29dcd56da178", "value": 45568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650610260, "uuid": "36e7b6c6-04ba-40fb-a2db-a404088723f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650610260, "uuid": "d5f0ba49-08e7-4656-bcea-a91323812407", "value": "PO-AO XIANG FZCO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a78de95-c21b-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650618247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650618247, "uuid": "c0954836-e54c-4295-ad28-5e3c7e8ee496", "comment": "Malware payload", "value": "9c86649e5ddae7dcdce9f7a27455e681", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650618247, "uuid": "cc84f457-a352-41a5-b58f-d46ce394d6dd", "comment": "Malware payload", "value": "f148bb704408a1ebcbb4fdc3859de68f67192de1a09ec94d5e5677c656c684e3", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650618247, "uuid": "088c66dc-4324-4275-bd1e-010dbd9f124f", "comment": "Malware payload", "value": "2f14315e30cf0c9a71af8bc3102c2db1976b18b7", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650618247, "uuid": "cc1d28ca-3ccc-4596-8a6f-bdf4fe117fe3", "comment": "Malware payload", "value": "e7b14899dec01a6c147afd3680fc6d13662278acc0023a8adcfd664f7d99634829631db77e81b7f1a961560557d97df4", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650618247, "uuid": "cd32f534-a535-4a14-9b62-1414e03c61c8", "value": "T1E2318E251FD98334E3F14E72B87ED32496A2BC46CA5B472D0280D5D46C50204F931F36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650618247, "uuid": "a4f754a4-4ac9-4b62-8b75-c401f0f9d335", "value": "12:8EhY0m/7MwMlXgVSXWIr4Ri6EX6HDyjA6PBW+UcUwi3Wllo0ITMf88iNNZYZJkH5:8fJj4K3KVA6PA+/gGllo0wi85A343H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650618247, "uuid": "c794551c-d071-4509-9747-51a691ad998b", "value": 1621, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650618247, "uuid": "f070612b-d3d1-40f8-ba0a-49754cc83ac6", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650618247, "uuid": "717130a7-09e7-4672-9f78-ee5df2799d05", "value": "documents.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1a2e81c-c21a-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650618044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650618044, "uuid": "c47ed845-13ba-45a1-9eb8-3e1a16d3570a", "comment": "Malware payload", "value": "fbb04229516d21996795f9e8a4363a31", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650618044, "uuid": "217c0e2b-2e51-4d81-9b03-1ee072fba7db", "comment": "Malware payload", "value": "f1ae9c1d20eaf8e619b79f74480dd936a5b62f3d24b5dcb91439736c87995952", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650618044, "uuid": "9905655a-7666-44b4-a4cc-22566f6e3226", "comment": "Malware payload", "value": "5767c45179f1fe992423b4ad369ba44bb24c572f", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650618044, "uuid": "5a0d85da-e0d6-466b-8c46-7b60bff7a98e", "comment": "Malware payload", "value": "d817c77ff9c1117182932a5e103c32273ceb13d1c4b43999cbeb102fd091188f091d873f8253b74c0b437bcdc1b818d4", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650618044, "uuid": "09da06bd-dbae-48f8-8130-bc46194c99bf", "value": "T1ED425B163F99CD11F2E31FF64FA8C261053DAD0E9998D29730A6330C58B5DC685726B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650618044, "uuid": "259a65de-4c24-4277-a471-decc7325436a", "value": "192:i2WNdPI7jhYqSB+gxkBS92sm+dD2Znl7w:7SIZSZxkBS9r7N2Zn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650618044, "uuid": "edebe1a6-2e0d-4a74-82ea-f788d4c0583a", "value": 12288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650618044, "uuid": "d04d7aa4-91fa-4942-a10e-15eaee46f093", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650618044, "uuid": "0ad94c60-9400-48f3-b1a0-f34d4fe16d1d", "value": "Standard Payroll Summary Report.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65ac5bdd-c22c-11ec-8e58-42010a9c0032", "comment": "Malware payload (CoinMiner)", "timestamp": 1650625648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650625648, "uuid": "b46fdb36-244a-4716-b686-452802e5008e", "comment": "Malware payload (CoinMiner)", "value": "9b792aa012164a6addab7b198e47205c", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650625648, "uuid": "e238a335-58c2-4d7e-bfd2-071ae3f1c57f", "comment": "Malware payload (CoinMiner)", "value": "f1e19127c9bff1d2c532bb7c21c4c391a63f72ecce57661b3c39edc3d4d2f9bf", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650625648, "uuid": "62f9e7e4-6b4f-4aa8-b46f-61df7d02d3ec", "comment": "Malware payload (CoinMiner)", "value": "fbb5de06a0f581140c8b992c3d15d49cd9dd5943", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650625648, "uuid": "c02eb178-1aec-4e97-b808-9924e34aa4d2", "comment": "Malware payload (CoinMiner)", "value": "d462c0cb0424e083149c6e30a1c35fd1dc287aa282c90cae35615fdaacea01c2fc03c74d8c4501a3c57499e9c029dd69", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650625648, "uuid": "f3dd1683-cdb9-4468-ba4c-4c55303c11db", "value": "T169C533F90D9C9347224B513B13152826513A514D2ECD873F378BEAB89CADFF6780A4E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650625648, "uuid": "0b833146-0950-4873-aa58-45cf1430a5b3", "value": "49152:4bwzLv1SGP00vHK24bB67CdwP5UdqE/b+S/Z1TnOknVtEpS+EiDX:4arP00vv4bAGSBTmySfn5Ep1z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650625648, "uuid": "127eef90-8c43-4caf-9ec9-ac521b7c5f1f", "value": 2706298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650625648, "uuid": "154919b5-d1b4-4d19-a5ec-47474c6fb080", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650625648, "uuid": "a5ebe712-0f65-4852-812c-d981472010cd", "value": "9b792aa012164a6addab7b198e47205c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "346c0c8e-c229-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650624277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650624277, "uuid": "2f6baef5-96de-4b2f-b320-daa0d6de95fd", "comment": "Malware payload", "value": "1e9b78a1d3e4d3476ff348cca9bff6d4", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650624277, "uuid": "16d7cf95-2c6b-4815-a6a1-e9f3551b086d", "comment": "Malware payload", "value": "f217d7652934d4f26c379250ed93d94f0f751bf8673f8992b75da703bf408168", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650624277, "uuid": "ad87fe96-dc90-4246-a21f-6b86ee6d6fe0", "comment": "Malware payload", "value": "07e015f40e80954f23f78563d1aae73ccdac9300", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650624277, "uuid": "5fc98888-f93c-4fb1-80ec-c429bbcb7a1e", "comment": "Malware payload", "value": "c58e3e7a9ae6d4dc66e0baeed28427cfe7dca4c03e8859e2acb8d9e7b1bdc81954d7afd22fca52e4d038ce93dc088fac", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650624277, "uuid": "0296a3ea-6494-45b8-8786-001aebe3ea77", "value": "T1FD450143F265F86BC877C1322640233A151A4D29CA92F78A394537ED78BBDE84FC96D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650624277, "uuid": "6100e284-3ed6-4ebc-a9e5-b64532abfda4", "value": "24576:BQwS3qSoEHSAi/AqQrJRwvoYG0U5sNrmhkH629owW4rDM046BOuHs8H:u1qyHSp/AjrvwgY02WAwwbfMQBOuHsa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650624277, "uuid": "8ee8a505-9bf7-42a6-acdd-d000bd0d690b", "value": 1196557, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650624277, "uuid": "3e8287d7-3bb3-4b9a-8911-9b7bcdaee5e2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650624277, "uuid": "ef82dc30-350d-4c81-be51-7839caba0b8f", "value": "f217d7652934d4f26c379250ed93d94f0f751bf8673f8992b75da703bf408168.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "739d8e0e-c23e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gozi)", "timestamp": 1650633402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650633402, "uuid": "9b183dd2-c17e-4160-a8ef-27b47655230f", "comment": "Malware payload (Gozi)", "value": "f0f0659d9838d978a8b7e7391b81c801", "object_relation": "md5", "Tag": [ { "name": "999", "colour": "#62BA7B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650633402, "uuid": "444b7127-2c3b-457c-93c0-3031eb0b727c", "comment": "Malware payload (Gozi)", "value": "f32f9fed2539cf3a6f585bc961035ccf3a03095c1f27e688f2da2811eca045f1", "object_relation": "sha256", "Tag": [ { "name": "999", "colour": "#62BA7B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650633402, "uuid": "73ba1d5c-4d71-448d-9dbd-109b3da4f0ea", "comment": "Malware payload (Gozi)", "value": "6adf95dab8d012a85ee4ed93f970d610ea2138bc", "object_relation": "sha1", "Tag": [ { "name": "999", "colour": "#62BA7B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650633402, "uuid": "932d30e5-8061-4927-9a5b-3ad844616d94", "comment": "Malware payload (Gozi)", "value": "431c7e779f0d4ea9cd144329c2b8bb5e25d9d6d9aae28a132d3c44561c38c7cdcd71e447b5938c5226a838ef439f1586", "object_relation": "sha3-384", "Tag": [ { "name": "999", "colour": "#62BA7B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650633402, "uuid": "978ad44c-007f-4fcb-8932-514b84ff5a5b", "value": "T137D4BE1B029B2102EBB6CE78A651636C54174CE09B01E2CFC9190DA395E35FBF4FA5ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650633402, "uuid": "0f8bf1da-8243-4676-953f-43b2a9b01c95", "value": "fd1c62e6f93e304a27347077f6d2b44c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650633402, "uuid": "a32d0998-4504-4dfb-b463-136583e90acd", "value": "12288:+w1lEKREbddtOYRbHzcPwka1dCjc3N8Z8y:+w1lEKOpuYxiwkkgjAN8Z8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650633402, "uuid": "507f1a5e-2398-48ae-a75a-4e4d1e72e515", "value": 641942, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650633402, "uuid": "2b2e9d1a-fc3f-490d-a6d0-0f71e22109f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650633402, "uuid": "654bf75f-6863-406a-aeb0-db12d9175c60", "value": "NdmYtW.xyiLj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eff33acf-c230-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1650627598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650627598, "uuid": "6676212b-15d7-4a3d-af27-e33422ed8ba9", "comment": "Malware payload (Formbook)", "value": "77c987df95879015501d23f3a3c24566", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650627598, "uuid": "36874093-862c-4a07-9695-61b7e9463103", "comment": "Malware payload (Formbook)", "value": "f4035c640596e4179ce46db95d0eca5d74a9d80c5170da8186f7d2001f673bbe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650627598, "uuid": "33b344ef-42fa-44b0-89d1-0fea6a1bc353", "comment": "Malware payload (Formbook)", "value": "124f1248536b03efba5821e3b5161e2882d6cd62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650627598, "uuid": "4f4e00fd-7877-44ff-a8b4-5066879c6d9e", "comment": "Malware payload (Formbook)", "value": "6778474ee8e9ab742a73c6933c648ba761e72900f4ec792686b95f3b009052f3b9cab4b0e83369f86969fdc4b4d176a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650627598, "uuid": "a2bc43b6-7f99-4a6a-afe7-d84d5b709990", "value": "T1AB158D42F2EE019BC37BBE3D81D845209F9DF625E68C8E36C848F2DC4536A336865D95", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650627598, "uuid": "ba8b7403-e9b5-4679-b500-c4bda20b6d41", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650627598, "uuid": "5a1b8344-2e84-4f56-8665-e5cc671253c2", "value": "12288:xJiwcz3TyGQDD6xr09ALJ3DIlgHkuDSgHTx5/bFU4s5oz5VGJVp3xqv5v:7iwiuGQXvAL6lgxDNV5NzrGJVp36", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650627598, "uuid": "7cddece9-4f0e-498a-b3f1-c7fb8ce7ce4e", "value": 883712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650627598, "uuid": "75bc6e59-cdb4-450b-a3fc-d8494e4ebe28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650627598, "uuid": "ca0fbfb2-7abf-4f24-8aec-6cdefc6074a0", "value": "SecuriteInfo.com.IL.Trojan.MSILMamut.350.9773.14271", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb10d4e6-c236-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1650630086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630086, "uuid": "767700dd-c8e0-47c8-8a42-3780afd695e2", "comment": "Malware payload (SilentBuilder)", "value": "18f5aab0a3ec9ffae95d3840bbc0a036", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630086, "uuid": "4a70901b-4bd3-4998-9ca3-251cdc6c2be6", "comment": "Malware payload (SilentBuilder)", "value": "f4df17393ded80993f0dcfeb86177bfade99a7a93805d232d60197b079825f0f", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630086, "uuid": "a98226cd-ab73-4c48-9a2a-8bf3d76cfb98", "comment": "Malware payload (SilentBuilder)", "value": "109f24afd7da7d3343a1b03f1151606a322998c5", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650630086, "uuid": "11d596a1-c977-4272-b570-de994bc68ef5", "comment": "Malware payload (SilentBuilder)", "value": "49a80b85e611540f9377f71ab7fa7d8e72390d8a1f2e8ea730a7b337dc268c6ba03144f7a79e573f940893d9b3c6cf58", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630086, "uuid": "f4e31341-4670-4f20-864e-01cd46f28ff9", "value": "T17923B646BA5D9859E9258B7548E743E9B333FC201F6B0B833616B3257FF49E05A03207", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630086, "uuid": "5a08568b-128d-437c-8b85-338ac687600a", "value": "768:4DM52tfQXi8vgLZkTOHkQT51Vp6AwPdM8gQ6JT5X6DGwUdh+pqjeSLjcvLtzrxFq:462tfQXi8vgLZkTOHkQT51Vp6AwPe8gP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650630086, "uuid": "71facf60-54b4-4161-9246-d863446d25c3", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650630086, "uuid": "bdb8ce77-dba4-4e88-8341-bc560b0a6451", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650630086, "uuid": "d5e3179f-c531-4fbc-9e69-8f695222c91f", "value": "Omics Journal.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f205f9c6-c295-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650670980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650670980, "uuid": "5f7a14f6-e20f-4ab3-83b8-e1b5e391c829", "comment": "Malware payload", "value": "84447675558d32de24159e23b0b9fd33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650670980, "uuid": "8c41e3a0-d46f-435b-9fcc-71ce5e85c09b", "comment": "Malware payload", "value": "f4faf8a0b53f7f191fb907a2c0b0a51e09ea78b01f1f7029030b085a9ba07bed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650670980, "uuid": "b6f9e425-7afa-41a2-82b3-8ad4885843a1", "comment": "Malware payload", "value": "372ac0a1afb70e4484d6f89a46db594ad448cfb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650670980, "uuid": "057772e1-10ef-4664-a059-0e5d8efbf2d9", "comment": "Malware payload", "value": "1962b2ce2bd6af3ef4eb26ae7930998d3557484174815bdac8fbd008629d02ee94e04892ecc96d0cfdce0a686180e34f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650670980, "uuid": "62d5df35-27e7-4eb4-8d5c-7f0499c0b507", "value": "T1C5D49D11F6AC80B5E07BD13DC9A3875AE6713C9847B943C79255EB2A2E736E05D3E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650670980, "uuid": "26e1b281-9855-4aa7-9c0d-9626c739ef7e", "value": "6ba79cbed2acbe9b8ecc8e14a572f100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650670980, "uuid": "0764f3c3-5381-41d5-9a85-c79ccbbb4db6", "value": "12288:C1FIcocJwMTHzXO7N2zBHiyzskF1CubVnmn:tco9MTHzXO7Ny/115mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650670980, "uuid": "48485fd1-594b-41c7-b990-ac5f80cf0d02", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650670980, "uuid": "c6197d28-69cf-4026-aad6-e15a0051d410", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650670980, "uuid": "e2f946da-65a6-4e8c-b9cd-adaf49aec51e", "value": "84447675558d32de24159e23b0b9fd33", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c4c07ed-c224-11ec-8e58-42010a9c0032", "comment": "Malware payload (NetWire)", "timestamp": 1650622250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650622250, "uuid": "5755332b-38ad-4396-910f-33a63892af7b", "comment": "Malware payload (NetWire)", "value": "777a79953b2d85aba7c28c736a41f027", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650622250, "uuid": "7163965c-648f-47f3-81f1-2c68d26da1c1", "comment": "Malware payload (NetWire)", "value": "f52b398d958c3ebda27ec4f40d4f788bdf6cb514cf43cdc5687d8ada61a0ea38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650622250, "uuid": "584fa176-96fc-41ce-9a22-dd42f9993e16", "comment": "Malware payload (NetWire)", "value": "ebfedead60dd198f87932369859e42f9436ddf2f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650622250, "uuid": "666c3035-ad37-4c0e-95bb-b0f9c512f21f", "comment": "Malware payload (NetWire)", "value": "23432bafbfef26e902be7d6c0127bbd5007063615d2c92d17cbba891eaa91ebee19a1b310f3ad85f341ede5aca281386", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650622250, "uuid": "bc6543bf-6ae5-4b28-b0b5-6553401bce3f", "value": "T1D8254A31A2A005F2E4625E758E5E92B4BF667E00DD24954EE6F4BDC83A373C1E0251FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650622250, "uuid": "22070f80-6128-4589-9f3c-26e7713187ff", "value": "9ce2f30aeb19f24c41844bd28f56defc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650622250, "uuid": "199a3b66-fc67-4558-b46f-0807de6a6e3f", "value": "12288:ueiJMC6q9g89SmxrmogsE43GWpy8YlEvGjBjufY8afqUKzaRHr:tiuCq89SmxysECLtY2vCqaynz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650622250, "uuid": "1c7bf183-205a-4683-8829-572e4439f70b", "value": 966656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650622250, "uuid": "42270389-8ada-4483-b754-63cc0e0fd771", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650622250, "uuid": "9f7452f9-aec0-483f-a3cf-797a12967801", "value": "2 (2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66568393-c239-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650631232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631232, "uuid": "17a83120-666d-49f8-be6b-14caefc702e1", "comment": "Malware payload (Mirai)", "value": "00c8c892d7ee0f474a5d0c807035cf67", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631232, "uuid": "8840b665-d22d-4f5c-ad87-59d685a185c5", "comment": "Malware payload (Mirai)", "value": "f5b9d28e5c766c56223154264ff35545d7ada6e61acda9d42b9bf90a85765597", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631232, "uuid": "9754ec13-1c70-40d4-ba90-a6636455e2f5", "comment": "Malware payload (Mirai)", "value": "644234925ce8d5d7647930c196666136dabb77a9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650631232, "uuid": "f59e66bc-50b2-4cc2-b4b0-6472e46a51bf", "comment": "Malware payload (Mirai)", "value": "1162e720fc533787d6d2a1ad74d37d756593a31f6260c82c8d0497678d5553f5cc1544facc7dcf76865c96f859a76946", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650631232, "uuid": "918eda50-bb22-4e7d-9385-5874f90886ef", "value": "T17BA34A07B71C0B53C59B59F129BB3BF08B69B6B112D761C1A10AAFC05772EB12422FE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650631232, "uuid": "03dd0026-40b9-4cb6-b883-9716192368c8", "value": "3072:scyMJYgcxOMx5hL6N4numXxVqDrIKfz9e:scHWgckMx5hLZumXxVqDrIKfz9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650631232, "uuid": "1274d3df-2c41-4cc8-ade0-e59ccd52c7d8", "value": 99292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650631232, "uuid": "d98a7d13-eac8-48cf-9ac6-586d723bd44d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650631232, "uuid": "40d45910-d69c-454b-ac31-c97af1b49dc0", "value": "00c8c892d7ee0f474a5d0c807035cf67", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a854f18a-c221-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650621035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621035, "uuid": "f6406305-574b-4856-aaa4-8e292155e9ee", "comment": "Malware payload", "value": "c2edaf968732d71aca6a81d923c1b526", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621035, "uuid": "579a9cb3-8534-45c1-ab88-b5aeb3817c6f", "comment": "Malware payload", "value": "f7a8b0208ea068c3653f704ced8107e929fd7947fb0f8089ea978147811b64b5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621035, "uuid": "b31993eb-cd08-4e59-98e9-02e77258efa9", "comment": "Malware payload", "value": "8b0a92efc2f4d996d78a5b66005910d1cb159bfd", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621035, "uuid": "8ae476b8-c82b-4150-ac76-b94614323173", "comment": "Malware payload", "value": "2db27272811df573c3b76f8b1358293d7d628756bfe2207c6590b3051fb7c9eec32c81bab03c48e34ba765099b48b377", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621035, "uuid": "f205734e-8ae3-4855-b0c5-86bf73e4a23a", "value": "T15A164C12B284A13AD0AB1B3B8D37A65C993B76712926CC9B1BF44D8C8F355407A3F747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621035, "uuid": "f1c9efeb-f0c0-42a2-a038-64412d0cf069", "value": "3702a5d1db2d821ad0ee4ab9b8a40bbc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621035, "uuid": "eca882e1-bcd2-465c-8f48-a75b72d27540", "value": "49152:zgUBNhBAWx2SVpBrgaH36MdrNsVbYeYXdQUYTVsiYqTKnUVTBGXB:zgUBNTAu7drVeYX+UYTmiYGBGXB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650621035, "uuid": "ee52f812-e0f9-4872-9cfe-22d4625aa100", "value": 4051456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650621035, "uuid": "da09780b-205c-4031-b29a-9142087cdabd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621035, "uuid": "16a180b1-2bd7-4b82-b5b8-170c8acd6777", "value": "SecuriteInfo.com.Trojan.DownLoader44.45172.4158.9312", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1df5fc78-c22e-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1650626386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650626386, "uuid": "26cd2264-9eda-4352-85b3-7ed3fe8f9759", "comment": "Malware payload (SilentBuilder)", "value": "58d410e0d5e0bdf027a32b49b1364266", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650626386, "uuid": "342515a0-2a72-4380-96d9-d8d58eb41a0c", "comment": "Malware payload (SilentBuilder)", "value": "f7f82a0e66831438f30b0a942efaab9f21dc1ecb2eb5a967369ed8440eaf866f", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650626386, "uuid": "a5dea871-43be-42d1-87f3-46f52176d09c", "comment": "Malware payload (SilentBuilder)", "value": "6dd8fd5858929218c895eddd4d8ca984ab5554b9", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650626386, "uuid": "ba4940a9-7a44-44bd-a7d5-8a4e53cd5bd1", "comment": "Malware payload (SilentBuilder)", "value": "29db4ccbce29405e509e8022af20f7293ff07e444b11aebb8364662c7ec06788c75ef2a72dccb97bc62c86af73d120db", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650626386, "uuid": "cfab6239-7528-4d1a-a16b-9a213131fd64", "value": "T13523B646BA5D9859E9258B7548E743E9B333FC201F6B0B833616B3257FF49E05A03207", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650626386, "uuid": "cc427e01-2f33-4f36-b97a-c820e2f05710", "value": "768:4DM52tfQXi8vgLZkTOHkQT51Vp6AwPdM8gQ6JT5X6DGwUdh+pqjeSLjcvLtzrxFm:462tfQXi8vgLZkTOHkQT51Vp6AwPe8gz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650626386, "uuid": "27bbae84-7478-40b3-8a90-b0a9a1ed62f5", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650626386, "uuid": "5c2fcade-7356-4332-a544-469453787293", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650626386, "uuid": "25007c43-cb09-462a-8d29-490c4075bd8b", "value": "Rechnung-04-2022-18934.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d87a0bf2-c209-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1650610808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650610808, "uuid": "82290f4e-b1fb-4adf-9918-1e3469060b6b", "comment": "Malware payload (Heodo)", "value": "3f68c168c0644565612adc503c9d8096", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650610808, "uuid": "6653047a-ec46-4831-844a-89da16c0af1f", "comment": "Malware payload (Heodo)", "value": "f859748488c743e59c02cfbd1d99199238690bc66a0b64c4c56804e2d845c1dc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650610808, "uuid": "62bcf383-a936-41b2-ac98-26a0cbfb810e", "comment": "Malware payload (Heodo)", "value": "b9e675455d1151dcfc0fca7359dc11fb111cfa85", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650610808, "uuid": "355328a2-0ac1-46b1-8d6b-cadb4e4ad7f4", "comment": "Malware payload (Heodo)", "value": "3ab3730fc506a787bf1b0aebc8fd792f08f179169b15ccc82880ef34b8993849621e89eb4379e1d851f7d0b65a4905d5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650610808, "uuid": "a27bd6d5-d85b-4638-a2a8-188237dda3aa", "value": "T1E874F9A22493CCB3C7F5B3710A824E69AFA1E69553732253D6900435FB389FAE3B45C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650610808, "uuid": "4d55a2bb-87fe-47e8-84b9-d37a9a5edf12", "value": "6144:bTSIaQIvz1Q+X4LJMByRR3AplChL4OSrDYAfk1:Wvz1CLJyyvmMLSrBu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650610808, "uuid": "aaefccc2-579c-4e2d-8982-af85f83e9353", "value": 354336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650610808, "uuid": "6e69caff-014a-4f4f-8feb-c664ae09f361", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650610808, "uuid": "e383c802-d375-42dd-9795-ad4855e5bc66", "value": "emotet_exe_e5_f859748488c743e59c02cfbd1d99199238690bc66a0b64c4c56804e2d845c1dc_2022-04-22__070003.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a64b35fc-c1fb-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650604711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650604711, "uuid": "fb4551e9-30ad-4878-b87e-34ff441e4e7f", "comment": "Malware payload (Mirai)", "value": "1718b6be79c44d7070414677447123d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650604711, "uuid": "c104ef5b-2c4f-478a-90cf-2ec58691ab07", "comment": "Malware payload (Mirai)", "value": "f8b0489b58ce8a8dfa43f96eb31d9b65ac13c8a81c606044b8ae4b6bce4539bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650604711, "uuid": "7d8a3143-1771-41d3-8e4f-09cd149b96d8", "comment": "Malware payload (Mirai)", "value": "7ec463cd24c42ed31e5acd03dc65328981e1394b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650604711, "uuid": "bbe7af63-11de-43e8-a39f-3e09e6019d73", "comment": "Malware payload (Mirai)", "value": "5b1957d0e26fd00caa804446a58d968ec91ec53816f8c5b5818fddaa701177a385a36b45c5b5bfe2bf6dc3ae8bfb227b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650604711, "uuid": "6dfcea13-cf2b-4c46-aae0-6ff836e8a946", "value": "T12A83294AFD82AF05D4D813BFFE0E128D33536798E3EE7112DD116B11A7CA91B0A6B452", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650604711, "uuid": "74ee606e-da4f-4359-8760-dbd2ef6b9789", "value": "1536:sNnZfR509sAlbqn7sazXqZGT3Ya+Z0vilQ9gjtZ6llOIiWmrNPr4wbZnI:IpO9sAY4cXqZGTYa+Z0vilQ9g/ZAmrNE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650604711, "uuid": "0a6b4f68-4cc9-402f-9554-60210418b41d", "value": 88348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650604711, "uuid": "94ab0c54-71a2-46bc-a829-b44672cadc74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650604711, "uuid": "b2b697cf-f190-4b9d-ae9b-d022e74574f1", "value": "f8.o", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a231f93c-c1fb-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650604704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650604704, "uuid": "bc37733b-a32b-4004-bc8c-6b6ca9852006", "comment": "Malware payload (Mirai)", "value": "84acee860651e4f5ab842edc359d3db0", "object_relation": "md5", "Tag": [ { "name": "AMD", "colour": "#B080DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650604704, "uuid": "dcc0846a-da73-4d7c-a7c3-b98014dbf078", "comment": "Malware payload (Mirai)", "value": "f8be6d645a78c1591be42a6a9f44e2d06d4fa45814f1c99390bd8e07fedbef76", "object_relation": "sha256", "Tag": [ { "name": "AMD", "colour": "#B080DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650604704, "uuid": "b3b83fe9-b580-4449-a3c1-964c5caa4e90", "comment": "Malware payload (Mirai)", "value": "f21cdde8dd1974d94dea715c954e677d24d766ea", "object_relation": "sha1", "Tag": [ { "name": "AMD", "colour": "#B080DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650604704, "uuid": "6dc03939-8de5-40fd-8833-da156f8c922b", "comment": "Malware payload (Mirai)", "value": "7799a7f40e54db78004a82a594c3649a05b8da75b779a4e8a43d5bb311c4f8d22959263b8ae12a3a13acc851ea6f0cda", "object_relation": "sha3-384", "Tag": [ { "name": "AMD", "colour": "#B080DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650604704, "uuid": "267ec880-b981-44de-be90-0ba0d281846a", "value": "T134632A03A68644FDC089D27429BF6A72D822F47D13B6B19237C4FF2A394DF105A6B61D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650604704, "uuid": "5b9e73fa-689d-4269-90aa-fb1a00c56391", "value": "1536:sGRPkMj3DoFCknrRL9uisQn2UOs2aqCTwGNnKbnDLs4:1RPka3UFCCDdOspJTwGYbn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650604704, "uuid": "84b311b8-10ae-45f6-b52e-3ed42e094468", "value": 70976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650604704, "uuid": "812cb24c-28f4-41f9-bf61-9d1b116f87a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650604704, "uuid": "5013a3e6-44d2-487f-a99a-c9f2cc2ad434", "value": "amd.o", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc6b6aaa-c22f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1650627082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650627082, "uuid": "f401f3ed-8ae4-4dd2-899a-b484b83faa6c", "comment": "Malware payload (Formbook)", "value": "a495aa65c4fe6736f58044c53752ef7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650627082, "uuid": "5d269daa-08f8-47c5-85ba-0f571a4cc054", "comment": "Malware payload (Formbook)", "value": "f990f0196dd14d3d2c38039bbe7098c86dbed89782ca9695ed8d6270e93108bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650627082, "uuid": "b9c345eb-966b-4f61-8f88-27bc53044527", "comment": "Malware payload (Formbook)", "value": "df6022137db0d5f491b7663a769a28e7fe478192", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650627082, "uuid": "2fd45531-9e14-44cd-ba70-34a997e7402b", "comment": "Malware payload (Formbook)", "value": "6d10342087a6b61e8fdbe9b62785a4a02e82d5c57f3e964d77d0e70810588fe54bbc9d728c8c6b170e8882aeef640a8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650627082, "uuid": "cfdbc8d2-026a-4bd8-94c6-fd4753a5ba30", "value": "T11004968CBD58802CDDA9EA71180FF173FE297F8AB54C9B50E4487FDA3A72621064D835", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650627082, "uuid": "5e69c75b-eacb-48eb-8dbb-ccdda20fa2cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650627082, "uuid": "e7e5680b-bc65-45f7-87f1-ba111b403dc0", "value": "768:ARVlvoW5k4kyipmi8MYQmmAtYcFmVc6K:ARoW26ipmi9zmmsmVcl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650627082, "uuid": "7abbe347-73eb-4081-825f-1d5433846cf6", "value": 184320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650627082, "uuid": "8772ed5a-7436-410f-832a-58857ee6bf33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650627082, "uuid": "9fca2725-4f2f-4695-961c-d30b07647c34", "value": "MT076131806.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e150d7cd-c23d-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1650633157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650633157, "uuid": "2033c635-d7e6-4c50-9d37-3c75b820b7bc", "comment": "Malware payload (AgentTesla)", "value": "4f53dd7d3f8c369e392d53b667f480b4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650633157, "uuid": "68c8a3f2-dfac-4cdc-a55d-8afc8c0a70f9", "comment": "Malware payload (AgentTesla)", "value": "f9a789747a0f32b55b803ff46ddc502409cccfa82dcefa6aee93dbbafefd1123", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650633157, "uuid": "ab975c13-fa4b-4b7b-b442-1bbae0741e36", "comment": "Malware payload (AgentTesla)", "value": "8a09fc013b77818ecd25db7d0b080db959eafa7c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650633157, "uuid": "fcec81cc-b394-490e-bcf1-ca15cd55e88f", "comment": "Malware payload (AgentTesla)", "value": "243b1d95c0b80657b24fb5aa82c479e90f29619ff528910f5234ac97b5fb7443a8fc0ebb938d1edad17df372b385ef1a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650633157, "uuid": "ee759177-29ba-485d-888d-c53a9259496c", "value": "T1E0B46F2C3B424E72ED4DC138A4030A28BB620FB36B4AD9C257DB2DC997DE1F95D45887", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650633157, "uuid": "3be83a1a-0924-4533-a3e9-f6620d1cafed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650633157, "uuid": "556be576-fe30-489c-bdfe-6f32f88996cf", "value": "6144:2eDlQoJPDoQizO397zyFj5ilZHiCw0CA8ohCnFWul+/R1bGLabh7L7RN50PFn0wX:2WBPkQ6l5ilICOFWP0c7RNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650633157, "uuid": "e7c1a026-73aa-457e-9d8e-09448b47190f", "value": 494592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650633157, "uuid": "6c016790-9e14-4146-a6d6-15f2631ea759", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650633157, "uuid": "9db321f6-93cd-4f00-9748-606c2113fa7a", "value": "MV TBN PERFORMING VESSEL DETAILS.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a29fbc5f-c221-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650621025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621025, "uuid": "04ec6c2a-457f-4039-9300-6f231ba39bd6", "comment": "Malware payload", "value": "1063bfeea85ab64b91d4a17f9b73c444", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621025, "uuid": "13d3fced-88f4-438d-ab63-333f4f8c50fe", "comment": "Malware payload", "value": "fa65ff716be501c94a40378df3f767f0c2ff5fc0ab9d27fffbecdef7eb787253", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621025, "uuid": "ed887490-a9c0-4ba4-84e6-8be12c107067", "comment": "Malware payload", "value": "18f5ecb19f600b7a00fa0e4cc45b37dd25f5be74", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650621025, "uuid": "d786a829-041a-493a-89c7-5354d8da6f9e", "comment": "Malware payload", "value": "72020517636ddae590ad23c9efb657f4a45223155cdc86830820a18004f4343548de0bcc405aef50ec1bdd9a1963d7f3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621025, "uuid": "550583d9-d8bb-48d2-95b9-bdd1ba6d07b5", "value": "T101D55B27B644A63EC4AB1A3A4537A758993FAB7265128C1B57F24C8CCF354813B3F607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621025, "uuid": "20fcb97c-2ee3-4765-8751-b7b16cddb627", "value": "8d1fec45294feeb41a8e94a0b60fa2f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621025, "uuid": "a185a88f-7c2f-4179-b89b-f297c4eed971", "value": "49152:bLo3YchJFETJbPxSELAJHqX1YJYULhsbkT4jWZt:bLoLZETJGq+YUtsbKt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650621025, "uuid": "d070e2ce-9f62-40c1-8df9-64f9a1e6e48b", "value": 2897920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650621025, "uuid": "9969c87b-a450-4caf-98e2-b2c8175d265a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650621025, "uuid": "94616eba-9e58-44b3-b8e9-9d1d99ff80b1", "value": "SecuriteInfo.com.Trojan.DownLoader44.44500.21177.29752", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af688a30-c240-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1650634361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650634361, "uuid": "45a72c65-8a18-4ccb-82a9-a3a6e2580f10", "comment": "Malware payload (AgentTesla)", "value": "ba8facc3c2b469f4911471662e49032f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650634361, "uuid": "669f7686-7b10-4240-b349-0bf071c77d56", "comment": "Malware payload (AgentTesla)", "value": "fab571430838f6c0b3c2ef8b152d7b04ea0f3298b20f06aca0ee037d4440f6f8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650634361, "uuid": "902cdb76-1029-444c-9574-2876b5f022c0", "comment": "Malware payload (AgentTesla)", "value": "e8a928377bc6615f0d0b027404c53b5760809a41", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650634361, "uuid": "faa8eabf-9f07-488c-b26c-344a379cc274", "comment": "Malware payload (AgentTesla)", "value": "45486701d54322e5f0d26b34877367a19426718536a5508e765afecd63c4109e3d0b53703d203a4b3d2711b48445273b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650634361, "uuid": "2dd795dd-3352-4369-a718-c8c8b80b9ea2", "value": "T13FC48D99F55035CFC456C971C8A1DC707790B3AA420EE347B8A36A985EBD4C2DE10EB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650634361, "uuid": "8458bec7-9d51-4e7d-9b0a-13ee73b8193c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650634361, "uuid": "7558ed7f-b0da-4e08-96e7-4468822fb705", "value": "12288:Je8XkXc6bhli7dlb+5LGV1CvDGcgjqNcabvBqT8GiYk4Ncq5gfJrx:w8UZNY7f+Lebqbr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650634361, "uuid": "e6108729-3df7-460a-a378-06e0f7351f3d", "value": 546816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650634361, "uuid": "59c72197-232b-4929-a937-7e3b8378848f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650634361, "uuid": "ad6d3fe5-d77d-4487-9d24-31bad070af52", "value": "COSCO SHPPNGS BL PL and INV # 1570-01 CHECKING COPY NO COAU727984220 VESSEL NAME SSL BRAHMAPUTRA 892E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f078dec4-c296-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650671407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650671407, "uuid": "d13d2dcb-1d7d-4a76-a2d3-72a32abcd1a9", "comment": "Malware payload (Mirai)", "value": "c52ef8c9e237e8ebd3675958916e6538", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650671407, "uuid": "3af32e39-300c-4d0e-b0a0-4a4345bfefbf", "comment": "Malware payload (Mirai)", "value": "faf4069e9f2bd9e973e9e4d335b1cfddc56ca4ca2ebecb2f317f537b1221509b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650671407, "uuid": "145afe22-5ca4-42dd-b20c-ba0530c1a75c", "comment": "Malware payload (Mirai)", "value": "825ba0b83e8feaffefc23a7cd2fb174e7c70b013", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650671407, "uuid": "c09b61a7-6431-4a66-a6e4-2a81a1594f61", "comment": "Malware payload (Mirai)", "value": "4bff26d8cd8859e323b5b71e045708e5f8f361eb2ee76bb3313d982be7ff08fbf332dd2f8c990a0d7c1e1dab39a98eb7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650671407, "uuid": "1ead0406-d2ef-46c9-973e-880728b47871", "value": "T151B2D0B8B1AB7DAE81702D3CE639CC4356C745BCB2CE36B205008A78FA4C559F3695D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650671407, "uuid": "03857311-7b90-4e56-abe6-a5fada1eabb1", "value": "384:91Z3dZJW+RjWfm4hISjp9dqE6cicx+RfOtLMYlhE8PpbRDyhymdGUop5hd:RPRjEm4itE6ciA+0tXnE8Ppb9ys3Uozv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650671407, "uuid": "e7d99e67-e242-4d9d-8105-aa3f5ed3a370", "value": 24556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650671407, "uuid": "196e033f-5a72-4836-abf0-fdf0797444c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650671407, "uuid": "b3c24318-f93a-42dc-9d3a-bbba06395720", "value": "phantom.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aa06b5e-c221-11ec-8e58-42010a9c0032", "comment": "Malware payload (Grandoreiro)", "timestamp": 1650620932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620932, "uuid": "b4ea8ff4-fe30-4c49-a6d1-2f80c9cc6c1e", "comment": "Malware payload (Grandoreiro)", "value": "835e9371fd00691a61ce6bb813f10609", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620932, "uuid": "eeadf3c3-25c2-4b48-bf6b-98e6d380d0af", "comment": "Malware payload (Grandoreiro)", "value": "fb4143799ae3a69ede6a95c7e7acd741f6d893c6b47bd138093a6344f56bf3e2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620932, "uuid": "77ec393f-ad06-46f2-9a46-f00d0ecfdaf0", "comment": "Malware payload (Grandoreiro)", "value": "5bbc0c9f0d39de30562d5005c71a4fb572764cf4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620932, "uuid": "9b8b2779-9f52-4789-b5aa-39886e32c888", "comment": "Malware payload (Grandoreiro)", "value": "0dd824f230882488b3f303633149c7f1e84fd6d0c27202d93f10059556f6f80c5fd4271f2c914b212b0ea1e6d7e38513", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620932, "uuid": "1cf470cd-7f7d-41e4-90fc-059a442cb94b", "value": "T112567D12B784763ED46F0A3A5837E254A97F7B7139528C9767F0088CCF39640AB3A647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620932, "uuid": "50ea8cd8-c98a-42df-a0c7-a24d0e045f49", "value": "bca82ccd57f48f3915c6b1172ba7ab9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620932, "uuid": "1d8605fb-65c5-48f5-840e-e6903767d818", "value": "49152:4H0leiJL6bJSB00dxaLd9jcw62Pw1XGVdOtB4WwAuqiTjTyznaQgUfKKBDNh:4UTLFnQVcw6Aw1LtB4WwAwu2U5BD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650620932, "uuid": "fb125392-08b5-4291-be75-3e68c37dfdf2", "value": 6069248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650620932, "uuid": "239a40b6-a296-461e-9e92-67bd356e76c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620932, "uuid": "827f0094-7cf4-406a-82da-034328a33ebf", "value": "SecuriteInfo.com.Trojan.DownLoader44.40675.1186.471", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74b0c7f8-c221-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1650620948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620948, "uuid": "143309b5-eda1-4cd0-8f05-80e11fa680bc", "comment": "Malware payload", "value": "75edfbbeac42b6d21b3446ddec3a11de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620948, "uuid": "b4226826-2084-4a48-a4bd-41922932e124", "comment": "Malware payload", "value": "fb89d76055c675b4d7643282185dd551a7c611aa7a63810c114f9b5bc330088a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620948, "uuid": "e573f962-b9fa-42a5-9e43-007670e22036", "comment": "Malware payload", "value": "00499751773c9f7c339833e570aa3bb7d9d951b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650620948, "uuid": "8a1c4018-4ee9-45d6-a66b-5a3019c26498", "comment": "Malware payload", "value": "79d7055e08fe2abe1e1eadb71bbfa7f2bf55020bbf2a54fc7a564e9657f948c16c66d4dab028764889b61a184eba7ace", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620948, "uuid": "c18cd249-e266-46f1-8e54-8915f5adae31", "value": "T1A1A55A23B29460BFC06A1A3E45779A50AD7F776176938ED75BF0084CCF365402E3AA4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620948, "uuid": "15220717-e3b9-4cce-b7ca-fca9fcca02a4", "value": "9025568f4a25f0a40e98eda24f66fc65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620948, "uuid": "864b1a7d-e89d-4d23-808c-604d022ca930", "value": "24576:CL58M/nWhMzSXj+8gF3tHTdkqBDrzumfE6t6NBMS2rbq1x5fjIgEKQD9536/mZzM:5KZSXj/QequNOS23AjI36/mZzzTOobbc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650620948, "uuid": "a114d911-72ea-4911-bd53-b1c1c5ea0c89", "value": 2237408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650620948, "uuid": "3c24b7bf-0da2-4ed6-9570-ce235c106abc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650620948, "uuid": "d861745b-3a3c-4fd9-a0a2-70592a6b07fa", "value": "SecuriteInfo.com.Trojan.DownLoader27.61892.11631.1355", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7adcb630-c248-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650637709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650637709, "uuid": "6a91e190-0414-478e-9d65-5edac38a8e8a", "comment": "Malware payload (Mirai)", "value": "6d7ad2404ec38908e7297f664677fd4a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650637709, "uuid": "71cf356d-d9c2-4e7d-b542-9e1465cd7c75", "comment": "Malware payload (Mirai)", "value": "fca29295a5aeb243c0b49d0f4cfb8d7b21424333ffa816fdb6516782854bf8cf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650637709, "uuid": "d30f6bca-7a01-4f95-afa1-fe8c2ea44145", "comment": "Malware payload (Mirai)", "value": "6bdeff19e6746caae4ce31236e865a78ba5fa2e3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650637709, "uuid": "2c69bf4a-042c-434f-bcdc-29c04a01c3b7", "comment": "Malware payload (Mirai)", "value": "ca1f46ad813756fb77da84f36b210e0bbeee343ff4c98b99ddfeb15f75e99a13854dd80ce4de1bea8e6849554c7320c9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650637709, "uuid": "59a5dd65-2182-4fc6-b4a1-4c5270d2aae6", "value": "T16DC32805D5508767C2D3237AE79F825D37325BA4A3DB33215A34BFB82BC27891E39921", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650637709, "uuid": "91d9cdf1-b64a-4c18-8dd1-cfeab2bfae21", "value": "3072:ekYPUfsgnsb0J2ag/Vf2kDN0dn+mTQOY5NX3cn:9YPUfsgEo2a02kDy+mTQOY5R3cn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650637709, "uuid": "1e228b16-916c-4a55-958c-0ce9e5c40cf7", "value": 121007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650637709, "uuid": "9ee183ab-e727-499b-9a3c-f7c420ce9e86", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650637709, "uuid": "8df09dcb-8d92-44ab-9dea-20869f3050dd", "value": "6d7ad2404ec38908e7297f664677fd4a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db274ced-c28b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1650666647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650666647, "uuid": "895e8a98-f0aa-4c8c-b03e-997a7cfd6b4b", "comment": "Malware payload (Gafgyt)", "value": "d4251de371ebaa3dcbc3370efcf4d678", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650666647, "uuid": "301af27e-238f-4cb5-923c-e4f632d7b286", "comment": "Malware payload (Gafgyt)", "value": "fdbb6c216ecb4c402a9d319080ac811423b5fc7c3ef23d441a0ddbbc15a2b26d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650666647, "uuid": "d5093d24-efe5-4e22-9913-0184009bd12f", "comment": "Malware payload (Gafgyt)", "value": "e238dbaec39af86b291058f199de9346ee7ff9a1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650666647, "uuid": "4284b81a-92a9-49f7-a666-eaf73d2852c3", "comment": "Malware payload (Gafgyt)", "value": "335d85b81ffbbc1674db242da0245cef1ec4fdbe0c66aefd54e66eb6de0d91d90322da430c6b173b8d7851abfad98c20", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650666647, "uuid": "949beb08-6dee-43e6-8e39-3d0b8bc35e3b", "value": "T1F1934C06F8419713C1C327B6B7CF47093B3667B957EB330266386FB02BC67991A25A60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650666647, "uuid": "9b53780e-20b7-479c-a3a3-3c9910bf5b14", "value": "1536:ZvgGLI1gX3JGQxPuwjxtOZyV5hXNKV6T/Fo2kjvVqQEqn/lJXCPe:tIHQjjx5hXNKV6T/cjvVqQEqn9JXCPe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650666647, "uuid": "04a29f5d-8581-4f8d-9fd7-206b5e5a2ef2", "value": 96620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650666647, "uuid": "9d68ece0-231c-47d2-9318-82855c81b2fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650666647, "uuid": "9e90cd74-8ca6-482b-88ec-9020d9c4d91c", "value": "d4251de371ebaa3dcbc3370efcf4d678", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7117d9ad-c208-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1650610205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1650610205, "uuid": "9425d0ab-3ab2-4bc5-ba8d-2d90cff438be", "comment": "Malware payload (Mirai)", "value": "265f73b1a99a98e92bb4b723163dbd07", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1650610205, "uuid": "6a02e5d7-48fb-429a-9e76-f3fbcabd7094", "comment": "Malware payload (Mirai)", "value": "fe1932e1ddb6c81959e624db66b7364191f183057f8e00276b44be49e4bc52db", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1650610205, "uuid": "d3c8999b-576f-434b-9066-d35e475efaac", "comment": "Malware payload (Mirai)", "value": "fba687b54ae0427c3ba90118f65161a410dd1d60", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1650610205, "uuid": "b7e52966-b91f-4b2a-9ddb-11c36f0dc19a", "comment": "Malware payload (Mirai)", "value": "140baddf3e6b250e9869b1356360df75f4869b88055e2217ea5e1603cd77289ef1a9616e38399ec33e3d9f8c51ca9c02", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1650610205, "uuid": "7ac71a79-c8a7-40c6-8d45-c45d37a9a7f5", "value": "T19EC2E123E5449CA3C5B08F39C9A9814597B26364F0C873E3A2A09A3DF3D34D956E4DC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1650610205, "uuid": "24d912f1-5d3a-498c-b5ab-0bf4b7483bd5", "value": "384:0d4S1JuZrgEniqrHTHazWiBLBjSEpayN7TgoqemRpH9qe7FR62BmdGU5EW:0vuZr9nisT65NhSEAyNgo8RpdtFRR3UN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1650610205, "uuid": "5e9f76f2-d9ac-4439-afe2-925a15e4126d", "value": 28164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1650610205, "uuid": "08428beb-6f6e-46ef-a2a0-8c9f701ef257", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1650610205, "uuid": "fa1cacde-3c9d-4aed-a746-4685ea951b45", "value": "portlordarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }