{ "Event": { "published": true, "date": "2021-08-25", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-08-25", "timestamp": 1629936181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "a071038b-df62-4362-9073-c9d97386c453", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9611b6e6-0578-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629877601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629877601, "uuid": "20daa91d-2ff1-4715-aa18-d5fa2c98f139", "comment": "Malware payload (RaccoonStealer)", "value": "a59f8ee70ec96291ae05647c60c82f3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629877601, "uuid": "6d4ec5e5-bb18-40eb-8756-8bcfdf0a27cd", "comment": "Malware payload (RaccoonStealer)", "value": "001df263a7596da6c4a9aae3cb05ae724b17a277ca9f600255581f6473946f38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629877601, "uuid": "535b1901-7025-4b19-a82a-1217488e1344", "comment": "Malware payload (RaccoonStealer)", "value": "485d2026ebda730be79a5b19a499a64e17831bbb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629877601, "uuid": "5d9304de-39f7-43fe-9beb-435b2a954500", "comment": "Malware payload (RaccoonStealer)", "value": "60abe19d77d379d29db5dc4fbd341a7b1022a498d60f36307eec5e26debbb4fdce089d185619a185e5f0adf0819f0b3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629877601, "uuid": "66412a6f-4596-41ef-87b8-afdde351d0e8", "value": "T1FEB4E130AAA1C034E5F711F449BA83BDB53A3AB16B7440CF93E51AF95634AE4EC30756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629877601, "uuid": "f056df5c-cb79-4042-8ec2-f7050ddeef40", "value": "b1f244737f482f7370a4248faac2bcb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629877601, "uuid": "19d717d0-a3ad-47cd-bdcf-a13201e75026", "value": "12288:mKRUAfYXZqORaj4SNqviDrJ7md1XlAy/Ah:7YXZAIvcJ7mPNW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629877601, "uuid": "5a6ec3df-c545-49e3-b472-2b85241234c3", "value": 540672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629877601, "uuid": "5310b4a7-f852-4d4d-883d-060ebfbe9356", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629877601, "uuid": "db02264e-ccac-4576-9872-09e9bbb2aa3c", "value": "001df263a7596da6c4a9aae3cb05ae724b17a277ca9f6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e083d8d-056c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629872219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872219, "uuid": "6e68269b-b1b0-426e-8a84-38e22d1264fb", "comment": "Malware payload (AgentTesla)", "value": "eda9c0f50d134a2f685620507542d877", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872219, "uuid": "9bd611fe-a0c2-4399-98e7-6db5bf8b8212", "comment": "Malware payload (AgentTesla)", "value": "003ecbee9386ab26c2d614ab61f60b13cf32c1551aa9efc0f6bd455421327fe4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872219, "uuid": "1988c729-2644-4714-a6f4-2ee59f27cc4a", "comment": "Malware payload (AgentTesla)", "value": "f828dc5d314ecd84505af09935de8a46e49fb869", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872219, "uuid": "6de1458f-aca4-46d7-aa9c-76a3ad3314c8", "comment": "Malware payload (AgentTesla)", "value": "b532a35cc3d7a043253b0ce8df3f4096f3c01832addfe7825c9b205134b4f42e1115fb2a792a41b5262171174536f960", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629872219, "uuid": "098c2463-2492-4a65-84b1-ae6671cbfb78", "value": "T122056B9C3210B1DFC967C972DD585C70AA6074BB930BD203A05327AEAD4E697CF166F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629872219, "uuid": "5d63bc97-7a2d-4105-8935-87f73c0e2264", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629872219, "uuid": "5f2b6d87-c2e6-4d1c-8825-c02c18e688cf", "value": "12288:e4ZZvOqQ/h9mBdaBh1HzcU+BVAH6No/lqSPuCKDbm0B9SJ/sneBLwBV7dxW0Ri9L:fZZvOqQ/h9mBEX1HzTcVAHqo9qSPwsL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629872219, "uuid": "5cfbf5b8-d30e-4dc4-89c5-638cb0207fc6", "value": 807424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629872219, "uuid": "f0f2b245-45b9-47bb-8e38-1d1ff971499a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629872219, "uuid": "730f5aa3-1202-47c1-97ca-d9a5208952c4", "value": "Dresser China Open Invoice Report.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e35432cb-0564-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629869141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869141, "uuid": "3f82c3c9-311d-4564-aeab-616a05404e54", "comment": "Malware payload (Formbook)", "value": "835f337b02af2742c331dc06f1a257ae", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869141, "uuid": "f0db6c7a-9ae6-482c-9bf1-16d3feb7200f", "comment": "Malware payload (Formbook)", "value": "00ac73aae236057c784ae0b2fdebaa0f9871cff8328bf09e4568502715489823", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869141, "uuid": "ad9986e7-a714-41de-bf4a-edb72caca251", "comment": "Malware payload (Formbook)", "value": "532a6fef70821601aaeabb0fd75f83e670392956", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869141, "uuid": "c98b5216-db84-4a2c-be2c-50942e6e5d2f", "comment": "Malware payload (Formbook)", "value": "94553b10a2dc9604aaf32ddd10ecd93b805086011db15df3e860dde4d890b23c0c0c107eb5ab2fac974ee7a5b49f6a2d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869141, "uuid": "bfb8c574-d39b-418c-98c2-9a4edf7deeee", "value": "T1AAE423CC6849C3E13BFC1D7DB7EAB69633DF094E2AB2174419E8426BF464855A323718", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869141, "uuid": "4dc2502c-079a-44c7-92eb-229edb8f7957", "value": "12288:ddgQsCOeZGyjym8ZArFmu6z8st9wb8L+BrygfCpjskoKoV7EXarS3puZ:dmUBwZAsu679IoVZpjs66euZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869141, "uuid": "1d6af519-f4b4-4c5a-a5a8-a6a24f23a376", "value": 663502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869141, "uuid": "cd0ccf71-969d-4d19-9140-d4451a7c4312", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869141, "uuid": "122df966-5cf4-4c80-84ae-1d1763019429", "value": "Purchase Order.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43f9f0b4-05cc-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629913541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629913541, "uuid": "b061c280-2876-49e2-b98d-6c0b6bceb398", "comment": "Malware payload", "value": "623989f4501e7af2a6a094962ffbcb7b", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629913541, "uuid": "ef521d19-79f4-4004-83cf-ddf6b7ca52d7", "comment": "Malware payload", "value": "00dac63a5d9481e4518ead4c25c77f857e85135fc99609a0e0dfadc80c127b2a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629913541, "uuid": "cfca2680-c910-454a-af9d-eff89ebede5a", "comment": "Malware payload", "value": "65d26a3e67bfc684d7861a585108ef672e0ca49c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629913541, "uuid": "f0e0351f-bfd1-48fb-95fe-35a96ef89860", "comment": "Malware payload", "value": "d9dc0bd35b7db4c1d8a4f34b4e97c80c01e15420c35df450925756e8d73549986de07e77f69b5d514e0f15aae3166836", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629913541, "uuid": "76b08291-bed4-4a4e-9b8c-758cf5b9035a", "value": "T1DEB30274E4D85629D29233382803B3D09BD3B25ED227DE5D38DD60D6C9836B72F58AB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629913541, "uuid": "45f0b2fc-5e81-4df9-b5c7-3f9b0b944d77", "value": "3072:WeBQAhNHh83WrtH8ynSlP2UUQk+CmLSZrM:PLvB83+cySlVYmLj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629913541, "uuid": "32c40d0e-d716-4680-b6ee-df5c68da8e80", "value": 115408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629913541, "uuid": "75ce521f-2b76-46fa-a76c-0725989ce7a6", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629913541, "uuid": "9bfaced0-b581-4415-aa3f-0c07ac9b5044", "value": "00dac63a5d9481e4518ead4c25c77f857e85135fc99609a0e0dfadc80c127b2a.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "192bf028-05ed-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629927642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629927642, "uuid": "948f91e4-b0dd-451d-9d8c-3e784b31e858", "comment": "Malware payload", "value": "68b8366e2ab7c689aa2c989aa9813b27", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629927642, "uuid": "75577c03-bec9-45bb-9995-93270a77eda1", "comment": "Malware payload", "value": "01db4f8a99b0cd0fccf3c2a3d90e665cdc144eae2fbf886b43df9a29a7a8cebf", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629927642, "uuid": "c683fa21-cc45-4a95-b53f-4cdbdee77998", "comment": "Malware payload", "value": "2e2305dab18d6a25ee616681c3c049458334d13e", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629927642, "uuid": "23f96aab-77ed-42ae-b3ad-fe30cd8bfd63", "comment": "Malware payload", "value": "36762eac1a8312698864b4f54e5f753eb52f6a78781c6629e02697021d4a220a3dcb6bb492b70f2f965ad0a7bc2d833b", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629927642, "uuid": "2a640017-869b-4540-ba6e-0f620fc5f3eb", "value": "T17051A71AF947D14C9F792327ED978962FF1B401B9DA2104C75ECC2491F2080996BCF9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629927642, "uuid": "80aff1da-671f-461b-a651-dd2bc9e75be4", "value": "48:Ax+4jiLuDQjvUKmc4TQ7QZE96pAUYRAGqqkS1HoyWKLrj6l1CelkEJmZVOQBozlU:sGhrffvIypvK0elkEYZ85ze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629927642, "uuid": "0bdc7b31-5677-4a08-b707-a13093e3431b", "value": 3154, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629927642, "uuid": "7c8ee0be-0fea-4eb1-8893-631d8cd77f5b", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629927642, "uuid": "b2a123e2-87f5-4466-83cb-2e5460b508c8", "value": "G5dgyf61.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22410d76-0570-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629873971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629873971, "uuid": "5dcb2257-e743-4a30-9b3d-afaea6ea2058", "comment": "Malware payload (RaccoonStealer)", "value": "f8e98f1692c4335f9a13206fd07e888c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629873971, "uuid": "a7791beb-e51b-4814-b942-db20b25f2c9f", "comment": "Malware payload (RaccoonStealer)", "value": "030150e033ae9ace40cdaef538f5c8b67074680a5a4ac5513793ec3979b5dfaf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629873971, "uuid": "53da1f8b-f265-442a-8c34-6f73f12da202", "comment": "Malware payload (RaccoonStealer)", "value": "54de17875be8edd751f28b96a810f3ac5fc283f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629873971, "uuid": "b9468f0c-9dfe-4b42-a2f5-b71dd94c466f", "comment": "Malware payload (RaccoonStealer)", "value": "59eb53882eb0e850c0d615bd35aeccadf7e45c0d6cce588e67a47aef41236e61cc4a6a12299f8e04b4ba72e5332453d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629873971, "uuid": "bc3ce0d6-b5a5-4945-a379-1cb36c114d22", "value": "T118A41204B6E0C8B3C56797324895CBE0BA3EB6A26954C64737E06F9F1F651C17E1B283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629873971, "uuid": "8f9f3d45-f2ed-42c8-bb5f-337fb282912b", "value": "bd3c9edf948deca79ee5e78523f1a042", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629873971, "uuid": "d3c4122a-e476-4e95-9d0a-9f3c70cf5d2b", "value": "6144:5PpldM3moJ2euJfuUTFedwbMeQPzhQWYNpWpa/3cDVmxGgm+QAkAZk2cxb:5m3mbB5/TFQwbZQtmNosQVm1p1ZvcF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629873971, "uuid": "9ef7abe4-a421-4fcf-967d-9f3cf62b5c85", "value": 467968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629873971, "uuid": "7c36e386-8f1b-4603-8959-0452f3125478", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629873971, "uuid": "4732340e-91ac-4e3b-8b75-fd92dd2ea36c", "value": "f8e98f1692c4335f9a13206fd07e888c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc42e09e-0564-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869075, "uuid": "a4355d46-6ab7-4cbc-97c2-5bba16beaf2a", "comment": "Malware payload (Dridex)", "value": "e73fc9b802fd807fe51158516b1d98dd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869075, "uuid": "b68606ed-fcf9-45ef-9c3e-e6034161a4a5", "comment": "Malware payload (Dridex)", "value": "030d4a6c8c5ebb9bfc8a3e30292f91ec9603715416e8cffa9d5137c6804a8b97", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869075, "uuid": "715419d2-4909-4f8a-be21-3e3718751143", "comment": "Malware payload (Dridex)", "value": "84a897bb2f739861da6f5c41e611728c7f6e7b15", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869075, "uuid": "41f4d8df-9c0c-4397-a9c5-a9cd8713b81b", "comment": "Malware payload (Dridex)", "value": "8968966d41eee2698746bb6ff6bfb64fbe1cfbc5f485f7f313ee207760653aa727a25974f659b94df01a52260491a4c3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869075, "uuid": "05b9c90a-f1b6-44f6-aa70-3f0853562595", "value": "T1D3D3E0EF6623CD59C02D577C82EE8F766BB44745A3911623222CE43C6F239FBDA15608", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869075, "uuid": "f97019a8-f10c-492c-8438-50e08072ef5b", "value": "3072:oUBbtf8chykvrA0t9fjki63LD6z2qoaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/:oYy2drpt9rl67Moaaaaaaaaaaaaaaaaq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869075, "uuid": "5da8d3da-92ec-41f2-874d-69e206c3d5a3", "value": 142731, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869075, "uuid": "8e313601-174a-4b51-a30d-12370b4941b1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869075, "uuid": "90945054-2c53-4796-b43c-b7e3dc00417f", "value": "Invoice-019657_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28666ee2-05b6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629904046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629904046, "uuid": "23c18500-7c75-40fc-b601-1eefb62c173d", "comment": "Malware payload (Dridex)", "value": "6a2d48899c57d400aae8ec0d25d1fa49", "object_relation": "md5", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629904046, "uuid": "28b313fa-1a6e-4d14-8b32-73a28c49eb36", "comment": "Malware payload (Dridex)", "value": "036f5bf868c0b64d27cab3114e173b59456c74ca670185cc417420cf2b2965d7", "object_relation": "sha256", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629904046, "uuid": "646ad444-9b36-4470-85fb-036a622ad6a0", "comment": "Malware payload (Dridex)", "value": "2b9e0c70f6d055a7d04ec8e7826f8e2b1d70696d", "object_relation": "sha1", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629904046, "uuid": "fb989fb5-3cfb-4a10-b6f2-7cd85161f9b8", "comment": "Malware payload (Dridex)", "value": "ec3bc2d803e53a29242776354ae03f968af417989b1f64b3f7bc752ae02b06d712b1ba1ca7d3fb62f08fcdad535d90ad", "object_relation": "sha3-384", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629904046, "uuid": "080d7c5e-9f3e-45a2-9c64-8f2563703579", "value": "T1F914DF82CD9F46F9C21B167139F531BE21E80605A769CC2BCADAD2FBF47D300D46261A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629904046, "uuid": "e094c398-f0e6-4a58-9d32-70f458e1b9f6", "value": "15d931f2533164c416970d03fa5b5c88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629904046, "uuid": "96d94e51-9490-4fb2-8f2a-f4da71f012d5", "value": "3072:xH0uyjZqEpAK+Gf78TBdrXkTM5vhRg9Esf0DwvtyMpVnpA+z6tX8sxKViW67dU:xUua/Pv7YNhRIEZDeXVpAxtMsxK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629904046, "uuid": "d8940489-3eb9-424c-bc61-11e3bd1b4d2f", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629904046, "uuid": "eb8e8543-2b44-4477-b4bd-48924b190987", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629904046, "uuid": "1e163eda-1c65-4920-b908-296661b88cc6", "value": "d3dcsx_43.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4697c348-053d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1629852127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629852127, "uuid": "bdbc0bff-2928-4209-9c04-4e04a12c4748", "comment": "Malware payload (njrat)", "value": "c5a90ee4fe4d3cc26530a5dbde95bc2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629852127, "uuid": "745f576a-6d0f-4516-8b36-36d23acf9307", "comment": "Malware payload (njrat)", "value": "04f1fd44b9c0d0974dfde693551f08ce5bf2749c3acb9bac9bfc8d7e2cb74670", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629852127, "uuid": "74d06a60-17d7-4a46-903c-005225c924f1", "comment": "Malware payload (njrat)", "value": "6cdb10a16f73048c7f9a7c0acff304996ea4114a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629852127, "uuid": "52448e10-ca86-4f45-a87b-6a83b87d6d5d", "comment": "Malware payload (njrat)", "value": "bd7b4ee5f26ae0ca0b193a45903653b33c44dd0c72304685ae82a4a4638479bbababdb5954885bfbeade1b6be7187362", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629852127, "uuid": "05e9d311-aafd-4acd-a142-f79f570ef39a", "value": "T17BE208467BE68219C6BC1AFC9CB313110772E3478532EB6F5CDC88DA4BA76D04641EE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629852127, "uuid": "a036d20b-f7c9-422e-a771-d70c85458542", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629852127, "uuid": "e6fb987c-8c39-4ed1-8a2a-4aeb4a02c972", "value": "384:N0bUe5XB4e0X3OxWANuiEO0YaRWTutTUFQqzFCObbm:eT9Bu+oguiEYywbm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629852127, "uuid": "07d49332-e0dd-431f-8402-585fcbb00bfb", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629852127, "uuid": "466e99d8-e195-4347-a86a-890d6ec49492", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629852127, "uuid": "bb800951-410f-4e59-81e1-0f6d0cc38b7b", "value": "C5A90EE4FE4D3CC26530A5DBDE95BC2E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e800317-05c9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1629912351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629912351, "uuid": "0c06e827-8618-4224-8798-d9b5e695f36f", "comment": "Malware payload (NanoCore)", "value": "d915f9f8421aa34dfd88d1595249f954", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629912351, "uuid": "eaf2f849-19b5-46d0-b57b-799845d435ec", "comment": "Malware payload (NanoCore)", "value": "060dc5124e4d0f8869856b52016cbed32339b8ac456b8cb5fea50f628961fc73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629912351, "uuid": "9532ee03-b139-4632-931c-61649bbade25", "comment": "Malware payload (NanoCore)", "value": "ec958c2d48c6719238780878d1621b8af18c4b65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629912351, "uuid": "26753ab6-0fd1-4441-8a57-c4a76218e1a0", "comment": "Malware payload (NanoCore)", "value": "547509fffd4ebe99a11eacfacc048b2e6ef3a6cee49222aa29a2b3b1d64923df4615e4523320f0517461ea1ac7eb98e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629912351, "uuid": "55ad1f3c-e64d-4f85-ab52-52eb7b761ea8", "value": "T1AB24CF1577A94A2FE2DE86B9601252438378C2E398C3F7DE2CD461B78F667E5060B0D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629912351, "uuid": "ce416b17-f2d5-42bb-8f89-bf20baba381f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629912351, "uuid": "d31eed9f-054a-4286-8b83-59119c1a266c", "value": "6144:ELV6Bta6dtJmakIM5nzI9i2Xu9XcEMzABpS7Z:ELV6BtpmkUzI9i2+qEMzA27Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629912351, "uuid": "0a96c435-66aa-4d59-910f-e150a6d6ad05", "value": 214528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629912351, "uuid": "f206a8ea-932a-4d49-8377-b448575c48ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629912351, "uuid": "0ceee5b6-9247-4fb8-b976-910ead2a61fd", "value": "D915F9F8421AA34DFD88D1595249F954.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08ca3c4c-05ed-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629927615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629927615, "uuid": "ff6e534c-9080-43e8-86e6-b3cef6bbc9d0", "comment": "Malware payload", "value": "62311d04cd7e3982531d46c20b5028e9", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629927615, "uuid": "a84773c9-7258-441e-912e-fd1526b8d5d0", "comment": "Malware payload", "value": "06244184468034cef2a71a956e419bc8f08dbadb465611a65fb5d5fc08f644bc", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629927615, "uuid": "3dcec582-bd7f-41f6-8c34-1ad508c9c06b", "comment": "Malware payload", "value": "d71df674f37129b93ae79057593e1430de012f29", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629927615, "uuid": "980878bd-4f5c-47bf-b3d2-ae937474b217", "comment": "Malware payload", "value": "c0e99d46151b7476670cf83aef609209ebf7e81e9968deb3bbb6f3c2e1a4d4bccf5709d60007391749749e4ce96e674d", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629927615, "uuid": "5f561cd7-940d-499f-b885-fff5a8567be8", "value": "T1D551A719F947D14C9F792327ED978962FF1B401B9DA2104C75ECC2491F2080896BCF9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629927615, "uuid": "54ed5d52-5e40-4cfb-bc26-ca3e158561ed", "value": "48:AR4jiLuDQjvUKmc4TQ7QZE96pAUYRAGqqkS1HoyWKLrj6l1CelkEJmZVOQBozl4X:HGhrffvIypvK0elkEYZ85ze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629927615, "uuid": "be80260f-e4c6-4f20-ba7e-82de88f0fb26", "value": 3158, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629927615, "uuid": "a0d217dc-995f-46b4-93b5-de4749f86b48", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629927615, "uuid": "037d3479-e678-4818-8647-b7b330751ef0", "value": "4n3LGsXY.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b907f66e-05b4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CobaltStrike)", "timestamp": 1629903429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629903429, "uuid": "89a5d01d-e893-4cac-a116-c5882179f852", "comment": "Malware payload (CobaltStrike)", "value": "7616efd9d10fd2c8d2b9f313410dc8e1", "object_relation": "md5", "Tag": [ { "name": "1359593325", "colour": "#0C1016", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629903429, "uuid": "874562c7-7bcc-4ecd-af38-9e1409a0c958", "comment": "Malware payload (CobaltStrike)", "value": "068eb2b690144b1a9aef6a1f93c41d1b7c7f804d172124199e20952fe0b6d5be", "object_relation": "sha256", "Tag": [ { "name": "1359593325", "colour": "#0C1016", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629903429, "uuid": "8e5657c9-1c26-4e58-80e3-6771e9f39a44", "comment": "Malware payload (CobaltStrike)", "value": "9211184df686b4f870d1e615c98a1e0629273b3f", "object_relation": "sha1", "Tag": [ { "name": "1359593325", "colour": "#0C1016", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629903429, "uuid": "ad7e6050-3af1-41e1-80aa-60dbf00f00b6", "comment": "Malware payload (CobaltStrike)", "value": "f915b8b2a2493e501270c83f1ecd409cf743b468bb9b96d0d4461c3919a7063d2427d07a531d49231f60815f0d56b322", "object_relation": "sha3-384", "Tag": [ { "name": "1359593325", "colour": "#0C1016", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629903429, "uuid": "67694f17-ebc4-426f-be22-1b6f98c9da7f", "value": "T16904F1278731F54DD9280C3C2AFA5CE01315AE7ADE21BED74262A0A4278B5F795CD2E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629903429, "uuid": "c6367768-14be-4b64-b39c-71f7563d5f8a", "value": "3072:oUNF2bF2s5l80hyyRF3w9TXphoIbXnGGpFsagg4z+OVQaw4+rJDEU/H7DcYtEeGp:o62wIlxhJRyTXvN4zQFHr5/bDc8gV1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629903429, "uuid": "ba446325-40ad-4dc3-9c9e-1869a963e9ba", "value": 178159, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629903429, "uuid": "41356410-3224-4e95-a795-93dcaa05bc9e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629903429, "uuid": "c6669943-f17f-4180-aa2d-be4ce6fefc49", "value": "Invoice_Due-IN-244701726_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5430c31e-05d0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (BazaLoader)", "timestamp": 1629915286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629915286, "uuid": "e7ebcf36-6fb0-46c9-b8ea-90e726a3ccbf", "comment": "Malware payload (BazaLoader)", "value": "c4dac1eef40bf5ded8eb4fb2feef8c15", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629915286, "uuid": "24724c24-df77-4188-b8d4-74a588d06483", "comment": "Malware payload (BazaLoader)", "value": "06a3c3cff1631cf486c6420e18b2bb2b7ee671ed273b94836e831a437badfaae", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629915286, "uuid": "c7735082-b3c0-4aee-b79e-dd37a5c07921", "comment": "Malware payload (BazaLoader)", "value": "dc53fc76d704b6d13201ee61cb149354f8619306", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629915286, "uuid": "39de97b5-84cc-4132-96ac-907acf63023e", "comment": "Malware payload (BazaLoader)", "value": "a82ca00b18fc1d64c9431b57b5fe465629a7e9d9c44f1978659c97b78af54ec4cdbb0b536eff2aa086dda6d88295a9d2", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629915286, "uuid": "9d27940f-f7d8-4fc8-b15e-a5f2c6b18b8e", "value": "T1A98328E0F442AA82E17689315DEAE3D4A37E3E1A7E81591371A03BCD5CB1DF0651F31A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629915286, "uuid": "5575937c-64c6-4141-bf00-62f80b9103ee", "value": "1536:fycUH09CrUBWWP+srVIEfJTjGQPoQwMW9a+ma:fy+N5BJ9PRKaha", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629915286, "uuid": "cd74d899-7ead-453a-b31d-a4605c1a35da", "value": 86528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629915286, "uuid": "b62bf316-e9b2-439b-9b4b-40cef783b811", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629915286, "uuid": "e136f678-4ff1-474c-98e6-4575259ee630", "value": "c4dac1eef40bf5ded8eb4fb2feef8c15.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64dedb6b-056f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629873653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629873653, "uuid": "3c7cf9eb-a75b-4c4f-98f1-0bce94fa937c", "comment": "Malware payload (RaccoonStealer)", "value": "a85ee2f31d9aaf25b34bb6b94e68b698", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629873653, "uuid": "76e6ad3f-620b-4cfa-9b9e-1b507bc71ce3", "comment": "Malware payload (RaccoonStealer)", "value": "06a4dfa73c8fd4a6444bd25d86083b05148674b9efd180e8dff70d4ef796bb5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629873653, "uuid": "286ef5cc-2971-4a35-9779-6f8a37caeb99", "comment": "Malware payload (RaccoonStealer)", "value": "2366ab22ecbcd9cfb621884c88abcd514060f9f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629873653, "uuid": "9743dd19-d2b2-443c-9b25-19bbf05f8e93", "comment": "Malware payload (RaccoonStealer)", "value": "3d577b8f8daeeeba7b1d0950efa2eb69fd6e530f2e82e6be92a5ccddb68c85d20b7d3eccedee65ee05939573b3c20b26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629873653, "uuid": "fa098326-fd48-4d33-b54f-bed733920202", "value": "T19CB4E030A6A1C034F8B611F84ABA82BDB53D7AB06B7550CF53E125ED52386E1ED30797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629873653, "uuid": "4c3f357d-e0c3-4eb8-80b7-3fa1d3c09389", "value": "ddbb3eef631957f988f10b48742f9549", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629873653, "uuid": "ae34047e-9974-4971-94ab-21d4fe8a487c", "value": "12288:syxJi5ZSuw6+ohz7bRgj0ac7lmO0eX4UOuCQUllz1dsD4b:aZSuZGj0LxnXD5CQUl51Q4b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629873653, "uuid": "f680b8e6-5545-4d73-99cb-635ddb892802", "value": 539648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629873653, "uuid": "c08ae891-1a9e-43c0-bae9-8ce371f4e7ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629873653, "uuid": "f668ad92-f1a0-4c47-93fa-fa6cac4df54a", "value": "a85ee2f31d9aaf25b34bb6b94e68b698.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01a3ded9-059c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629892814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892814, "uuid": "82844274-ac7e-47f6-bc8e-1dc33a449e4d", "comment": "Malware payload (RedLineStealer)", "value": "e541740d3f5a078df3843912f8c799aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892814, "uuid": "826b57d1-cdda-4006-8097-6da9b4939929", "comment": "Malware payload (RedLineStealer)", "value": "06bf39977de1aab7c26e0ea0b692246abf25976fd17f627312bf8e584426397b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892814, "uuid": "40887156-3ed8-42b9-a079-5376dd798088", "comment": "Malware payload (RedLineStealer)", "value": "4f3e68667a07a916e742cf40053b7cefe450e4b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892814, "uuid": "d3144201-c76e-4d76-ac70-59a30089a8e7", "comment": "Malware payload (RedLineStealer)", "value": "6ad1f82c954d523160e15fac11d3696f5362c445fe3ed0d8f1a9c7f0a4e293b6de6db6b60b70f86d09e8499e8ba7fc86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892814, "uuid": "fdd84835-9548-4a8d-9986-0c51f5b730c5", "value": "T127E4F130A6A1C035F8F211F899BA9379B43A7EB26B3550CF53E11AE912346E5EC30757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892814, "uuid": "1d11b77e-d726-4e67-bc2c-4ad77cd410e8", "value": "b1f244737f482f7370a4248faac2bcb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892814, "uuid": "70dd1ce7-6557-4a52-9449-4261b23f7365", "value": "12288:K3hfAybG0naAsTlSA7hqlhI2g0WyPs7/LC9F0zGuN+wFs8K5qndmD:4bG0PAFq7HD+DLU0zHUwNBdmD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629892814, "uuid": "f4c087d7-c2cf-4dc1-915b-b67119d78e8e", "value": 657920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629892814, "uuid": "be6e5111-85d9-44a6-b980-09bfca3ab2a2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892814, "uuid": "707c7a29-19a2-46a9-83f7-b8ccbf56b12d", "value": "e541740d3f5a078df3843912f8c799aa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03efe260-0584-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CoinMiner)", "timestamp": 1629882510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629882510, "uuid": "f8fa4d62-77c6-46ed-931c-ae727e2c4cf2", "comment": "Malware payload (CoinMiner)", "value": "c1aa49e236b4b6821a258bb63c425da1", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629882510, "uuid": "005bd6bc-d371-4a88-b1d2-ee35953c96d4", "comment": "Malware payload (CoinMiner)", "value": "0757a3b97f39c1d8a6c3d94770762a3912304cfaffa0330761945acd7f236213", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629882510, "uuid": "78473f3c-13d8-42ca-a4bb-53e8857ef47d", "comment": "Malware payload (CoinMiner)", "value": "d50e05d4a7a082494fcbfd8f6b8dcf03d6d4eb77", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629882510, "uuid": "3a052ba2-078a-441d-b19c-26b7d132d94c", "comment": "Malware payload (CoinMiner)", "value": "460eb7a99aa5154ac8ff0547da28e3cc220f9824f123c8c9f4ce37f74cbb97f9ea5567fb6c6064f2eeb21050dc9230ec", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629882510, "uuid": "e5dc69cb-d5fc-4e7e-8945-24d642375cd4", "value": "T18FA4F06A62A01299EBF290FAD592074AE77034755B10A3CB273527F32B1B4D58F7D3E0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629882510, "uuid": "b667c3ba-8ba8-47ab-9938-ece4e29a5af5", "value": "f326f88ca83c9aacaa44acfb8884f1d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629882510, "uuid": "6f083030-ed28-47b2-a41d-14e0e54f3b75", "value": "12288:stzE5elwLz9Tr11pVNXTkcE8Ey9rKzPk9/WYnCPvSI:stA4KdTR1pVNjkcE8dKjk9/HCJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629882510, "uuid": "051ec572-b33a-4618-94f4-42010f5adc1b", "value": 460800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629882510, "uuid": "864689b0-0f0b-4df8-8b16-86e7b54730ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629882510, "uuid": "a1468598-0383-4789-bb20-b1f3055c8eae", "value": "c1aa49e236b4b6821a258bb63c425da1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc8ed7f5-0564-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869102, "uuid": "6ebe6074-a34a-4029-a3f0-6adb54d96fab", "comment": "Malware payload (Dridex)", "value": "290a5b28a1d973bdc0d6de5612a7a72f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869102, "uuid": "8c1f1f92-0af8-47c2-808e-5e1cf68a617a", "comment": "Malware payload (Dridex)", "value": "082f292eff9ed2b422eb4beb14f4b2adfad93b855b9693a1e01ab3f4f3146c22", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869102, "uuid": "243d613b-6577-428d-a6c4-f3ecaa96448b", "comment": "Malware payload (Dridex)", "value": "0621b16c7cda25d51995f6eb90eb9c85ffaeba91", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869102, "uuid": "39139677-ba11-4db2-80da-bc0daee22593", "comment": "Malware payload (Dridex)", "value": "9020532d34a5735253b45e90f5703b6a9ef052afd7fb1a4ca1ceb31ffc48dd9a6db896d09cdae4ececb35a09205932ce", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869102, "uuid": "33d44e94-cb2b-4717-a77b-66b2b88707a6", "value": "T117D3E1ABB627DA49C02D537C46EE5F7267F4875522D30727116CF8286F228E7CF48219", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869102, "uuid": "8418b8d8-a421-43b5-96a2-2ca9cf5bd73d", "value": "3072:oUqd5GG5zNGvqGXFJCMAjC35ajVy37ehGi63LD6z2qoaaaaaaaaaaaaaaaaaaaa4:on5HQvrXOMAeJtLep67MoaaaaaaaaaaO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869102, "uuid": "0cf8d164-662d-4482-afa4-67dc018549d2", "value": 139323, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869102, "uuid": "856233a0-6375-474d-a093-86341ac93e9c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869102, "uuid": "aeae7257-0f13-4915-b9c1-684ac071e573", "value": "Invoice-0209940616_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80dcece9-058d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629886585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629886585, "uuid": "f7123fc4-1976-4a70-9ad3-02af022dae67", "comment": "Malware payload (RaccoonStealer)", "value": "0aa3baac8e96ead54df1e737592b1fb1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629886585, "uuid": "a811bdb7-2b91-4f9b-b4c0-5d405469728e", "comment": "Malware payload (RaccoonStealer)", "value": "09179a44494e6e219361ecb14505f2c4ff05cf061c4ce1b10c68176ff6663640", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629886585, "uuid": "0989300a-e9df-4049-9e9b-e0e9cfb49d7d", "comment": "Malware payload (RaccoonStealer)", "value": "c3dec7e69b7e4d29bd82e121d5c3db50f0012c61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629886585, "uuid": "77709c1c-ded8-4695-aac3-b784224cb160", "comment": "Malware payload (RaccoonStealer)", "value": "a25ecb6e0610324c6f008e022555a7d29e89a536f4648dd425cf4d2d4e0da6541940ea402a606b00ccac246f9fb4a0ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629886585, "uuid": "857d8e50-125f-4cff-9518-b1b9b187bb22", "value": "T199B4D030A691C035E5F311F815B683B8B93E79B12B3450CBA3E526EE46346E8ED3175B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629886585, "uuid": "a4a796b0-31f8-4190-8b7f-52eaedb2dc0e", "value": "35372ade599ee63db174ac99307517b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629886585, "uuid": "a9b76ad2-e723-4b78-903e-31beebf95098", "value": "12288:eCGxx1qlbYUF84+0DPHSDK0ys69DrH8SdhrOXG:ox1qlYaPHE7t0j8S7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629886585, "uuid": "ce3cb94e-8c23-4374-878e-746994e789ab", "value": 532992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629886585, "uuid": "2e731a0e-3ba2-45af-9e5c-b03cf21896d5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629886585, "uuid": "dcced67a-7f97-4175-8400-d5271d1f892e", "value": "0aa3baac8e96ead54df1e737592b1fb1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63a618e1-056f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629873651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629873651, "uuid": "b3bc8b3e-183e-4c38-93d5-ea6d2e30d319", "comment": "Malware payload (RaccoonStealer)", "value": "0c1ce5bb75adf6805f619b20ba573d48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629873651, "uuid": "648bfac8-a2e9-4b98-9740-e880ccd3c59a", "comment": "Malware payload (RaccoonStealer)", "value": "0948e6455258ff56b36f9fd83f8084614376b11ffba6dc195b28d088bf41045e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629873651, "uuid": "05a0c490-088c-4b8c-bac7-c706843dabfa", "comment": "Malware payload (RaccoonStealer)", "value": "f3dd8853dad1b5fc875ee014f2445eaa83311fed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629873651, "uuid": "12d126bb-fdd8-4a1f-9fff-b6caab1be1b0", "comment": "Malware payload (RaccoonStealer)", "value": "96d2a0f002cdec9182c78f299f62dd373e4eb65126c3230a0ccf2358c080f633ddcd6c1033c2ae5dbaae845725c6fedd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629873651, "uuid": "bb35135a-c66c-4c14-8ea6-ae1b0ffdc63f", "value": "T115A412C0B6B0CC72D15D80364D51CE518ABA79929AF492433BF99F9F5F6A1D03B0A3C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629873651, "uuid": "14e4ff76-5bb6-42e6-a3a7-d0b1960aa8c1", "value": "bd3c9edf948deca79ee5e78523f1a042", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629873651, "uuid": "257be83c-c0ad-465c-9f72-a45a49f4165c", "value": "12288:/6Qpj2LFeBbe554y+ToRYgOV7b/5pC6AvcF:/ZjmFzcy++7wO9S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629873651, "uuid": "9bc0a280-dbfd-4ab3-bece-d7778ea64423", "value": 467968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629873651, "uuid": "fe81226c-0e2d-431e-af51-1b3f35547c7d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629873651, "uuid": "02dec364-1678-48ec-9045-babee9cf7bec", "value": "0c1ce5bb75adf6805f619b20ba573d48.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f4eb55e-058e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1629887012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629887012, "uuid": "0b0922e6-e196-46df-877f-1cc058dc8935", "comment": "Malware payload (AveMariaRAT)", "value": "480da04cfffa57d4153801552f63fb4f", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629887012, "uuid": "69d71db9-dd9d-4a80-aa04-8a4daa8e711d", "comment": "Malware payload (AveMariaRAT)", "value": "0a8c093ba282b608fe04c8f2d2dcb20289c75a9f109b92d4ff34ad48c8c49b74", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629887012, "uuid": "c63c1941-b219-4ced-aeb4-9dc46beb88bf", "comment": "Malware payload (AveMariaRAT)", "value": "6ca400a9c27a73c0174c83107c8c5c3125154d0d", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629887012, "uuid": "6e3400d0-6f77-4309-95da-9c9119ba588b", "comment": "Malware payload (AveMariaRAT)", "value": "7a0b995b73b5166d30d5408fe584d5cbab9201509a1d03b6047aa6c5ee43c38579762e8ef8ca9077c1b29c1b7aa8a84a", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629887012, "uuid": "0e18609e-86c4-4928-bb13-8c3329751c53", "value": "T1EF94CF23B057DDD5C188597D4664FBEC426C8F924E0F768AB0293226DE72C4B2F58CE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629887012, "uuid": "74d4a742-1fc4-4f03-a7b0-095d1602fe28", "value": "35807dcde258f88fa3ce5c21adc607fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629887012, "uuid": "ba9f2f3b-4d93-4fd1-a112-7f9e41e39645", "value": "12288:wrfJolmJxRHHE6mRsc9gC8NLhPtD6IA1eDo3aCmFkwdbV8aV:wrfJ4OWqo3tmpvh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629887012, "uuid": "2f4ea46c-80e5-4e3c-a8f4-9919433919e4", "value": 439033, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629887012, "uuid": "0d7fd0bd-b1fc-4db2-a407-4e679ce91f4a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629887012, "uuid": "baca3140-c1cf-461e-aa32-62693748145e", "value": "MACHINE SPECIFICATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53ff8cd9-05e4-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629923876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629923876, "uuid": "dd722861-be9e-4f5c-8e13-042fe6403978", "comment": "Malware payload", "value": "0d967795caea730a77b8b9f0695c3fd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629923876, "uuid": "0dff7451-8c81-4337-a231-3c57711a88b8", "comment": "Malware payload", "value": "0b976213f5961eb9720219d2624463ec6acc8947004710c7e9885746e2e27234", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629923876, "uuid": "48043c94-6b96-418a-a843-46e3e575714a", "comment": "Malware payload", "value": "9aab2f3af7364624d59cfc17593090bd09b9796d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629923876, "uuid": "e1261d56-bae3-4dc6-9a5e-dc705ec4cb43", "comment": "Malware payload", "value": "8ad8a388f7dca44fcaf846f36251cd8067c8607366aa4ad238a72a0b0aeccc30dde77af8cd1111db637d497586abe824", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629923876, "uuid": "9a34db33-5be6-4b6b-827c-1042401319e4", "value": "T1F505AE332A9A8DC9C3B2B57D8680E37195F46B993D16A3A302761133F70AC4F1E6D9D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629923876, "uuid": "2246dcfb-89a2-4baf-8745-3f76cd948d5c", "value": "f326f88ca83c9aacaa44acfb8884f1d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629923876, "uuid": "d71ca4f0-aa13-417b-9b09-dd66166706ad", "value": "12288:g5oaqjp/9TtIxeu1L2o5nkp3A1iqWp1CpyBPDOyUS3i0i3KXT4:g5v4DTtweu1L2o5nkpphCya0iaXU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629923876, "uuid": "493d3893-72a6-44be-9ac5-8807ce6d3a2b", "value": 870912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629923876, "uuid": "a8ce03d3-b5e5-4f70-88bd-15d0383c292c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629923876, "uuid": "c201bb59-ecea-4b67-9473-aba15ee22380", "value": "exsposes.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fc203f5-0568-11ec-8fa1-42010a9c0011", "comment": "Malware payload (BitRAT)", "timestamp": 1629870691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629870691, "uuid": "3d6f659a-b9b4-488d-9b71-efade596d748", "comment": "Malware payload (BitRAT)", "value": "3584051e526cd1e681f4f9540d1cb4ec", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629870691, "uuid": "505ebc27-78cd-474a-a521-cb9684b3a656", "comment": "Malware payload (BitRAT)", "value": "0d873887f2b308fd3881ea4fe102f661b822e8da5122c64871c4ae2033332ced", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629870691, "uuid": "a1b8cabf-fba1-4ff2-a878-2194cf27c209", "comment": "Malware payload (BitRAT)", "value": "525af9951fa7fc10cc14e12cdae3c9a9ab50ad01", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629870691, "uuid": "3cc59b16-0bbb-469b-9679-676e5c393b1f", "comment": "Malware payload (BitRAT)", "value": "09a7fb03d0c22f48cb44c99ec5fb9ef20013fc3f7c01823ab86ce6755ec08463960d119f28341b5ef268e30efcc62942", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629870691, "uuid": "eafd7a08-1ef7-4163-a3f5-e47fea02c228", "value": "T10185330172B8C236D3E454F73451284ED3FEAB09E1B2D99BAE450ABCF4B464207E95CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629870691, "uuid": "7e5dbad0-bf5d-4d23-a6df-c1c0e322a467", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629870691, "uuid": "fc4f4f93-91ee-493d-b70d-396aba036bba", "value": "49152:VOOBcX7KkfsLNfYrqZwPQI4Sap+TkhWnFKf:VOOBcX7KkfspYoI4SakcmFu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629870691, "uuid": "cb2e880c-1e01-4af6-b8b0-f8f686b07590", "value": 1743360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629870691, "uuid": "9b3940c7-d0b5-4b45-bc0f-95afec20cfff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629870691, "uuid": "64e01e5e-cda2-4965-b406-fc151fa40e58", "value": "ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95f95bd1-0571-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629874594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629874594, "uuid": "68e9b7fb-a357-4ec7-8b3c-eab779626233", "comment": "Malware payload (RaccoonStealer)", "value": "13541d4f482a6770a482c0d84c46f93c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629874594, "uuid": "d5289611-aff3-49a0-ac81-471534d9701f", "comment": "Malware payload (RaccoonStealer)", "value": "0dce4d7b61b7d154565612b0b8bb5f3148a641eeddd708cfe1208dc863f2f7ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629874594, "uuid": "23ed4aa3-ba4e-40be-8191-7421e66991a7", "comment": "Malware payload (RaccoonStealer)", "value": "0e4d9226a7c108ae1c09413a62c02e4141009fc2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629874594, "uuid": "f748091e-c5de-4497-946a-b7887377637c", "comment": "Malware payload (RaccoonStealer)", "value": "cbc03b3fde9fde2e63996dfd14d8e4b883c689fad1db78b9125bca09806059982be3bef8f1f8c24190639cd99489421d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629874594, "uuid": "7425c289-4cc4-4aa0-befc-0ffa27b65c8e", "value": "T1E0B4E030AAA1C034F9F215F8957A93B9B9393E706B3540CF53E625F947286E4AD30787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629874594, "uuid": "3274be10-b7e2-43db-bf8a-4368716e04ab", "value": "ddbb3eef631957f988f10b48742f9549", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629874594, "uuid": "39e3f045-8f19-4f2c-a655-5ab3b488e063", "value": "12288:dI6LiY9TOgW8CFX8bgq0Wxjbvueoqvf5Azp8juYmb6N:B9TOAJ042qX0KjuYmbM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629874594, "uuid": "096fcdd9-d20f-4c95-bcd5-a25ebef51d93", "value": 539136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629874594, "uuid": "db109ed5-4acd-4ded-b00d-dbbbb76b7cb9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629874594, "uuid": "713a3897-6f31-4076-b3be-a3ba8af246af", "value": "13541d4f482a6770a482c0d84c46f93c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baf163ea-0564-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869073, "uuid": "ff0c538e-e2e6-45e3-bd83-8610c9f6cce7", "comment": "Malware payload (Dridex)", "value": "0633683d4529f5e825e6919b1b41df1f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869073, "uuid": "e77a1293-ae1e-46ef-b004-10b9bb2968f3", "comment": "Malware payload (Dridex)", "value": "0e5d0dc5bda4a6595bacb36ad14ccf28b44aa2ce853520aefbe90c658bc03c19", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869073, "uuid": "88a80edb-ddf5-402d-a6c2-8f39e84515ba", "comment": "Malware payload (Dridex)", "value": "9f18ff80c743dcd5e7256a62ab67a9ac9c252a8e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869073, "uuid": "8344c0ab-ad43-4ee4-8cb5-64bdbc1c2dc7", "comment": "Malware payload (Dridex)", "value": "d325fe16d457c0827e37282251446172b1ce943bf0fddf4dbb843ba20a22b3e3c2bb564d8c0278964b39bac7f9781859", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869073, "uuid": "4deb20c5-d389-4148-aaf4-ff6a81bf4976", "value": "T18774126C97E5C41CC84F403F62D74F76D7721A06AA82B71FD1B1B6095F0393B8A6B0A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869073, "uuid": "4aa3f416-0eff-4446-914c-778e11c1a0d0", "value": "6144:o57+qG2LohOGYw6CC5jTT453mjEIbWiGVAKSLFN+YInSCRvuPsxNt:aL2OGY/TTy2jEIJc6FNu3uPmNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869073, "uuid": "945d0678-6f1d-4388-bb1f-ef5db2b344d8", "value": 355228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869073, "uuid": "4308131f-15f8-4dc0-adea-e3ad80d435c2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869073, "uuid": "f1d927e0-985d-49f4-ba0c-be7401fd80d8", "value": "EoY_TAX_Export-25320009_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "502b5970-05c4-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629910125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629910125, "uuid": "6a855400-e109-4196-bd4b-7c9de6b7eae0", "comment": "Malware payload", "value": "f39868a72ce7a03e0871efdca29d2c9d", "object_relation": "md5", "Tag": [ { "name": "Beacon", "colour": "#3CE751", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629910125, "uuid": "97c0e59b-8f60-468d-8440-bfa64c08acba", "comment": "Malware payload", "value": "1058f8af72d31042e59f3b7ac0d3a93cc2e38074afe1a30e1b224fb7ea0a4f6f", "object_relation": "sha256", "Tag": [ { "name": "Beacon", "colour": "#3CE751", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629910125, "uuid": "5fbaeb12-d6d8-4a90-93c9-6809f21cdc62", "comment": "Malware payload", "value": "b31b00592228777d15832d4d380c8b2a0637375f", "object_relation": "sha1", "Tag": [ { "name": "Beacon", "colour": "#3CE751", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629910125, "uuid": "473702f0-4fbb-41ba-aaff-08bdc3262967", "comment": "Malware payload", "value": "c862e695589856239bf2bb21b5ae2b05fb42d346ae1f3e773a318443a4e242adf281e62b711209143c39192e7c1a17d9", "object_relation": "sha3-384", "Tag": [ { "name": "Beacon", "colour": "#3CE751", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629910125, "uuid": "3a404e65-5773-40c7-82bc-6f3f181e3ab4", "value": "T19224F1F285A1E823970335B4359851E5930D9C76DEACDC2DFF8E0AB29648FD362791E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629910125, "uuid": "940f925c-01a8-49a0-acf4-3a88624ff618", "value": "3072:YqLVOLa4I8X6wa5cJQf/VQKycHfM+BtCIllJJ+kC0nnj0n8W324pxp3V3:YoOLhVtWcyfa5cHfM0jDikxjA8W3Vr3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629910125, "uuid": "1907d051-b5ff-4125-8f50-7eead5276587", "value": 209997, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629910125, "uuid": "fdc06870-ec2e-4ac0-880a-13e5acfbc51f", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629910125, "uuid": "843341d6-b07e-4175-9c23-0cfc5e2de526", "value": "x86_beacon", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e61ef39-0546-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DCRat)", "timestamp": 1629855925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629855925, "uuid": "b1570ea8-33a0-441b-8788-abae57c03c92", "comment": "Malware payload (DCRat)", "value": "bb1d2cff6c40819cdc65821856adc00b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629855925, "uuid": "b9d69f79-5b75-4336-825d-d14ce00c81c5", "comment": "Malware payload (DCRat)", "value": "105f84831dddedb6f03fd79e892afaa1fed238b4f7538058f45fa28e10cb244b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629855925, "uuid": "4200755d-941b-4fd5-91a3-bece1f6967e3", "comment": "Malware payload (DCRat)", "value": "c15c7e1e67d33febc76b599fba53d262debb055c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629855925, "uuid": "b8dfd9bd-b49e-4ce3-b0a7-3e9c774f3212", "comment": "Malware payload (DCRat)", "value": "bac73e0724bf65b197d8dd2546985b7fff1df40ca7de3d63159d8afeb6adbfde635f2fc2a69ee0dccf423907d1c334e3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629855925, "uuid": "bd7748f2-3faf-4fa1-b271-1fae29707c26", "value": "T1B0452812BE46DD02D0E92A37C9DF45380BE8AD017B66DB1A7E9F375D22163A70D0D1CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629855925, "uuid": "0c625363-9109-4bcc-99c3-0d2a747f9a75", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629855925, "uuid": "2954d4b1-cb87-437c-b3c0-c7723819ea96", "value": "12288:k7dCIARgD43FZoZamQwSe1fft7EfinGs2M4FVvnOB9BOYER5dhfpCXegs1qn4:vqD43FZoUpw1uU2OD85dhXgY+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629855925, "uuid": "bf8d07c0-15d4-4364-80ce-d6b1f43e6042", "value": 1216000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629855925, "uuid": "5d686a1b-1cd0-4252-85dd-65d400929773", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629855925, "uuid": "aa807d47-3b4a-46ac-85c6-2bdfb38537b5", "value": "bb1d2cff6c40819cdc65821856adc00b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c245f72d-05bd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629907310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629907310, "uuid": "df17c167-6eae-4e3f-9162-c841bc394798", "comment": "Malware payload (Dridex)", "value": "72be49d1b3f5ea6651b69b68b1e49cbc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629907310, "uuid": "94f6f063-579e-4fe0-8226-42cd6150bcb2", "comment": "Malware payload (Dridex)", "value": "10737be05adc2f1056258e5881c99b04451d7b42de55cc2e6c3f77b8253843e4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629907310, "uuid": "257c4333-6cc0-4c81-9bc2-c7f984a088a4", "comment": "Malware payload (Dridex)", "value": "99bf8f985cbf2528a2c6f266a9fbfff15c149f46", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629907310, "uuid": "db38da23-51f8-497f-b90e-af93e076fadd", "comment": "Malware payload (Dridex)", "value": "8e479334ad08953393dfecc20b7c07503eb9dd22547bb87b07f867d27b6550657da1d59f34871c1ad5962d5e19b20a08", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629907310, "uuid": "411c2490-b44a-43ca-a4fe-158709624f5f", "value": "T1DF14DF82CD9F46F9C21B167139F531BE21E80605A769CC2BCADAD2FBF47D300D46261A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629907310, "uuid": "1c5da1d0-145e-47c6-9fa6-c2a619f440b5", "value": "15d931f2533164c416970d03fa5b5c88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629907310, "uuid": "ae28b586-d21c-4155-bfd8-3dded9a582b9", "value": "3072:BH0uyjZqEpAK+Gf78TBdrXkTM5vhRg9Esf0DwvtyMpVnpA+z6tX8sxKViWb7dU:BUua/Pv7YNhRIEZDeXVpAxtMsxK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629907310, "uuid": "32e70f3d-0af4-4559-8082-5558d74054dd", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629907310, "uuid": "f6f48af2-99cb-4de5-b555-5ef958653cc7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629907310, "uuid": "b8d93750-c21b-4bfd-baac-84d56ba440ce", "value": "72be49d1b3f5ea6651b69b68b1e49cbc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0531324d-05d0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629915154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629915154, "uuid": "1d8ba55c-1afd-45ae-a658-bca620a3ab3e", "comment": "Malware payload (Dridex)", "value": "95d92915b1bad2c6f60254ef159937f8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629915154, "uuid": "a834e14e-050f-469f-9f95-f150a77dabe4", "comment": "Malware payload (Dridex)", "value": "11e9ee1999098bb6125423d09c244f818cb267fe0f32ce82463ea9d48815511a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629915154, "uuid": "8652d372-2321-4fde-8053-19b03dd16754", "comment": "Malware payload (Dridex)", "value": "8fd44a7f06c5526e836ed66a60cc68a1c5a3127f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629915154, "uuid": "bed76bcc-4a07-40b9-aa25-9e904db5035a", "comment": "Malware payload (Dridex)", "value": "93c5b9453895c7984cd46d9355e12dc55239d5e34a2ef797c411d7a6be5fb721727cebb117b77d0a85747acd992cc9e3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629915154, "uuid": "2d2cb913-6cc2-4a76-8984-493a733e90ca", "value": "T15414D082CD9F46F9C21B167139F531BE21E80605A769CC2BCADAD2FBF47D300D46261A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629915154, "uuid": "7a398510-821c-4a20-bf19-accdc776aeb1", "value": "15d931f2533164c416970d03fa5b5c88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629915154, "uuid": "1cf0a346-12c4-4f31-9524-a086d781bcf0", "value": "3072:uH0uyjZqEpAK+Gf78TBdrXkTM5vhRg9Esf0DwvtyMpVnpA+z6tX8sxKViWO7dU:uUua/Pv7YNhRIEZDeXVpAxtMsxK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629915154, "uuid": "d9e600e8-dd99-4368-b046-1f3d15115df5", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629915154, "uuid": "da6201bc-ad9a-43ad-9fb1-0dd02a50f7d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629915154, "uuid": "1be6e3f2-310a-4f3e-a9d5-3dc8584fc7e9", "value": "95d92915b1bad2c6f60254ef159937f8.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4c4eee8-059b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1629892658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892658, "uuid": "b92fc857-f4b0-4319-869e-6863df0740d5", "comment": "Malware payload (Smoke Loader)", "value": "c7ca9e3d7aa76db77e8b11a00d12b5bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892658, "uuid": "b97805ba-4477-4985-88eb-15d6d0eef391", "comment": "Malware payload (Smoke Loader)", "value": "124add633cc7af34b0ff753f26265e66453dd2dbf9870953f7a76593941917c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892658, "uuid": "209c1301-ef60-48be-b1c1-ddcffb5df99d", "comment": "Malware payload (Smoke Loader)", "value": "ac4f541a27c8bce97574cf369e5eedecdb9c1dd1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892658, "uuid": "d954efb4-c651-4188-9bc2-ebf78e093f0e", "comment": "Malware payload (Smoke Loader)", "value": "96b159d6f65cff1aaa6aaa5c558c54dbc3b5ff472afa75071bff520c8d17ffe38c2065ba47ff13104abae50ec48c62f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892658, "uuid": "4d2798c4-9ccd-4b36-8438-20331bba2144", "value": "T197548D30AA91C034E9F211F889B983BDB9393AB16B3550CF53E12AF956346E5EC30757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892658, "uuid": "f02583ce-5862-49f6-8ca3-8cfb0945276e", "value": "b1f244737f482f7370a4248faac2bcb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892658, "uuid": "598ecb3a-11e8-41dc-9d50-571fe525157f", "value": "6144:JveL46iAwjXfpMOOlSG9S60+SK060yBiJ:wLDiA8PpVvG9S6TS9XyYJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629892658, "uuid": "4544d341-213f-42ad-9bde-4a941c092b7a", "value": 281600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629892658, "uuid": "7c270f3a-d5a2-4f2c-a461-8100c3eb55f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892658, "uuid": "b0756a33-f32f-44a6-b558-886176794995", "value": "c7ca9e3d7aa76db77e8b11a00d12b5bb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b49a6dd-0565-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869208, "uuid": "c61d0466-9742-4bd5-973b-f8bae35240fa", "comment": "Malware payload (Dridex)", "value": "e41a1c0d096bd6a658cf781f40ac33c1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869208, "uuid": "2ea0f95d-f9d9-45a6-9922-ed3757fda3db", "comment": "Malware payload (Dridex)", "value": "126a5bb68199565e38f184a8269eb5dc52dab0db837aa1a5fddacc52ac448349", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869208, "uuid": "9ef5496d-5d6f-45ec-bf4d-f74cdb460c5b", "comment": "Malware payload (Dridex)", "value": "ab258088573133508ff188269a94b039ca1b7473", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869208, "uuid": "b06b3248-cb66-40b5-8dc0-bab57324ef61", "comment": "Malware payload (Dridex)", "value": "27b0dbf3da0a43b956ccdcc2d236e324551cfd0b9056f4a6ea5d7ab419d0fe50dc9a75982c830246c4ee18d8400ce561", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869208, "uuid": "499a8a03-b412-4f06-b990-c2b5a932dd92", "value": "T1CF84126886A1C80CD95EC03F91E74FB297716702A5C1B71F82A1E6185F03D7E8EAF19D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869208, "uuid": "02577394-f0a3-45c6-b84c-a7723cd4fb5f", "value": "6144:o6KilOJdK16TSL1h0y4M2LohOGYw6CC5jTT453mjEIbWiGVAKSLFN+YInSCRvuP4:bodY62Zh0ymL2OGY/TTy2jEIJc6FNu3/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869208, "uuid": "6f2e2c0c-3b9a-4136-b256-72689fefadf2", "value": 381420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869208, "uuid": "561fe0d3-1652-4ab1-b361-abe222351940", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869208, "uuid": "447a2d41-97f7-4dbd-b3f3-a22618060625", "value": "EoY_TAX_Export-334118770_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f662d1e-05b9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629905400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629905400, "uuid": "51782519-3e05-46d1-9288-a6fc30d3fcc8", "comment": "Malware payload (RaccoonStealer)", "value": "caa5f3d5d0174f7bb2aa4da093d66674", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629905400, "uuid": "d3f3c951-274f-4b34-a202-eaaee08786c0", "comment": "Malware payload (RaccoonStealer)", "value": "12e161db75470e5e06c98e0ace41cf08cfc15672c7f6b01674fb1b5add20f336", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629905400, "uuid": "33fcdf1b-5023-4d34-9c89-b7daf1474aa3", "comment": "Malware payload (RaccoonStealer)", "value": "1f7df39ab943a2ecf44c376f581687af13f06bf2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629905400, "uuid": "45249b66-9bb6-47a6-a599-09c3c536242f", "comment": "Malware payload (RaccoonStealer)", "value": "2e599b931a760fba5bf5f5c140d98aafa42122f8732579cbf5c4cabf0678d7b278981261de306763daae335b00ccf937", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629905400, "uuid": "982982f3-ca8d-42c1-8355-80ca89c67f3c", "value": "T1AFB4DF30AAA1C035E5F312F85ABA83BDB53979B0673450CB93D526EE42385E8EC31757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629905400, "uuid": "a89e3910-c5b7-4aa2-8790-57f9ca695a91", "value": "35372ade599ee63db174ac99307517b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629905400, "uuid": "f0fbe9aa-425e-409b-a4c3-2d2884406f05", "value": "12288:oPcmFAjDIoSoH+f1kAAqhdZ1xv51m5/WFVzaylI:GFAjcf1Z5hje/CVzaa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629905400, "uuid": "df9d2faf-87ab-4c29-8aba-f1254d0df875", "value": 532480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629905400, "uuid": "0b2fb567-82af-4af2-93cd-a7e6f5d0a594", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629905400, "uuid": "741b854b-3900-4f22-8949-8b74384ec328", "value": "caa5f3d5d0174f7bb2aa4da093d66674.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fae1363-05e8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629925613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629925613, "uuid": "5f0c6025-8c26-46e8-8c99-d580db13f1d1", "comment": "Malware payload (RedLineStealer)", "value": "54907df508790354d133e051bacc4716", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629925613, "uuid": "6a39a798-28a2-4aa7-b6ce-8074965d59e7", "comment": "Malware payload (RedLineStealer)", "value": "13538b5b8bcc7dea403e11d1b9227fcb745c37b32f4c0493706ef0d04076ed2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629925613, "uuid": "255c06c7-307f-46cc-86d5-a51b17ececa6", "comment": "Malware payload (RedLineStealer)", "value": "f84e960f4a5170943d7bc890df80566b2a46d176", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629925613, "uuid": "6dfe8da1-c2c8-4904-996b-aeb66eae812b", "comment": "Malware payload (RedLineStealer)", "value": "6cf080703868ff1effa7ef4875a3842f3156367a4fa53d29f61ff31411a3a278f83958e492e3c9686b1788157fc06376", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629925613, "uuid": "121a5ccd-2989-487d-8e23-5b249a8616c8", "value": "T1BAB34B1563D8D629EBFE0B7674B0171047F0E19B6021EB5B8DC274DE1E76B826A442F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629925613, "uuid": "e38a2dae-ade3-43db-9899-3a7923098af7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629925613, "uuid": "2e0c5bc0-c782-4858-bda9-0f5c079fed96", "value": "3072:W4JFfXmsHbz2EJFbOvIGCnjyjd57YXff5l:Fn32EJd8lOyDU35l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629925613, "uuid": "4c8108a7-b71b-4b86-af40-f2c31972637d", "value": 115072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629925613, "uuid": "f75bc1e3-c718-46f2-acc1-7b58c7914553", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629925613, "uuid": "b4ae648e-5179-46bd-b564-a0840269548a", "value": "FortniteHack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "554ccce8-05a1-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629895102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629895102, "uuid": "cde3573f-4735-4a3d-b3fb-76e870a13a96", "comment": "Malware payload", "value": "d013069348693530d0bd8750d31b8cad", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629895102, "uuid": "70bbc410-844a-448d-8b85-1db64a397a05", "comment": "Malware payload", "value": "135f55be7ea1b1c1e0f98f1e4288eb77cfb363fd900314c6f0b935d866a3376f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629895102, "uuid": "c15b8760-69b9-4aea-a702-fcae17acbffe", "comment": "Malware payload", "value": "12b0f8984adb96d87d4f97aad067aa17199b6da5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629895102, "uuid": "a975abe3-d4ee-4f3e-aa1b-f5745ba7696a", "comment": "Malware payload", "value": "494c3b27b8fc50288b3a97a00c6d0527d777ef69800fb6ab77cfebe3e3244d23042f5b058e5678b9d0b9724febea40f2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629895102, "uuid": "70413e4e-8080-43bc-a1f1-7eeddd004a9f", "value": "T1C2D423ADEF9EC006E0C8CB76E422F9049A281D69B0DFD51F52E46EEA2075730565F72C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629895102, "uuid": "04849da5-1692-495f-a530-4add8d79eb22", "value": "6491b3f31e856ef7c46904fa9057e6ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629895102, "uuid": "dad7b3ad-97c4-4221-8541-6bcec77dafbc", "value": "12288:oupU+OVXDZ/YhwAes0K0APYX8rcB5vGY/trIfaOFah4ZIaB+:CZ4h0pZB5v31rIyOlIM+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629895102, "uuid": "d32ecd77-78fd-4072-84f1-e6bbd7926c5d", "value": 622080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629895102, "uuid": "65056a85-c659-4383-9bbe-80a23195982d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629895102, "uuid": "1f789565-ed4a-472f-a6d6-d41dda5a4244", "value": "MSIMG32.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbb025da-0564-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869128, "uuid": "a49f35b1-8e6e-46f4-b15d-e06c09b3f485", "comment": "Malware payload (Dridex)", "value": "54d630ddbaab05a9e11dab752a9f459c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869128, "uuid": "3f1b93da-67b1-4802-9428-720f3971b764", "comment": "Malware payload (Dridex)", "value": "169731ae6417687fea6bc9253b52a04c248b435abeaaf70e93a1d70a3af3cdd5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869128, "uuid": "988bab1d-09ad-4d4f-a131-70fa23f5371d", "comment": "Malware payload (Dridex)", "value": "de7170516a40dd7bfd56bbfae65dcc62dc16f3c7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869128, "uuid": "0372fbf9-074e-4198-a22d-f3121eb53b53", "comment": "Malware payload (Dridex)", "value": "25c8090d61d949c450b9339beb368ec616028c85a0c8af4f225fdb3b0edab80cd4026e4e9de6e3b815ee0fe569bba70d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869128, "uuid": "2d955bfd-08c1-45f9-8f9d-84d389eb9ae1", "value": "T19C74126893F1C41CCD4E413FA1DB0F72DB622A06A6816B1ED671E21D5F1393A8B670E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869128, "uuid": "cb74010e-8035-47b1-8c3e-7fd9211a08fe", "value": "6144:oofiGIHZCVnnj2LohOGYw6CC5jTT453mjEIbWiGVAKSLFN+YInSCRvuPsxNM:ZfRIHZenyL2OGY/TTy2jEIJc6FNu3uPp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869128, "uuid": "5f605d00-2595-4692-9876-c2fa8c5a6965", "value": 354562, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869128, "uuid": "19d3cb9b-f51a-4d32-b52f-7fb652987d83", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869128, "uuid": "9b03b95e-eb07-43dc-b9d6-045ece1c12d9", "value": "EoY_TAX_Export-6179_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60abfca5-05e4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1629923897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629923897, "uuid": "cddeff1a-b02d-4e66-8b9c-b546501ad80f", "comment": "Malware payload (RemcosRAT)", "value": "9dce130ca10f1405088fe0e0c51e9a2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629923897, "uuid": "95aa0a3c-1f23-4083-a6d9-63da6f1f98f7", "comment": "Malware payload (RemcosRAT)", "value": "16c1d398cdc6b1c425f8adbd315aae2886ce2e953baddd90fa645783cd13caaa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629923897, "uuid": "93493396-00a9-4c42-a656-c530685f8e14", "comment": "Malware payload (RemcosRAT)", "value": "014c92ef07295811021c36cd6985ee54e61595f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629923897, "uuid": "96cf9d3d-e584-439e-acea-1b1620827535", "comment": "Malware payload (RemcosRAT)", "value": "abdec897dc4dad1080db7dee506914bb359625889ac1342ede9d35833bb0c24c4686abca8ac819bd67096f17d64b210b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629923897, "uuid": "01b00a9c-f3e3-4c58-bd15-53f489c3c9f5", "value": "T1C48449007B98AA2BF135D5375B63813682B24AC7E1E1D744C940D77E7A31371AE4EA8F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629923897, "uuid": "d8e8d3bf-7275-446f-ae24-e49c392c5239", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629923897, "uuid": "9b5a405c-ca87-4c8e-b313-092bb242a8e0", "value": "6144:qE1cBFw2Xn5lkqgHg/ncRvXnbU0lOk+VnBqW8z8ncQLxtsp5fmnYzwrA:qE1aConrkTHg/nevbUoOBVnBe8J2pQYp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629923897, "uuid": "b4a62585-f808-4a3c-bcda-1bb8d3b7d5e0", "value": 381952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629923897, "uuid": "3d525aae-fd13-436f-ad90-5556ed839154", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629923897, "uuid": "b0964a4e-ec3d-46fb-83c1-33880045a3f8", "value": "loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0b3fdb0-0564-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869109, "uuid": "6c7201ef-e4a1-4972-ba2c-7674765817cd", "comment": "Malware payload (Dridex)", "value": "93a478f4d10d33926b53a4d8e339ec62", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869109, "uuid": "f762d853-bd1e-40e0-a360-8987ab05938e", "comment": "Malware payload (Dridex)", "value": "17166dbf4f4d830b26bc57c1fd591a4b248df038ae67eae73de3ce21d96b9975", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869109, "uuid": "1236656c-e06b-4572-a168-b0a49463302f", "comment": "Malware payload (Dridex)", "value": "8eac8e08a7dbc1ec4c416ffe6165d497065a9bb5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869109, "uuid": "de359a7a-24d2-4522-9921-5f4416eb9d9f", "comment": "Malware payload (Dridex)", "value": "e8656d0dfd17cbf11196ab88449abf1203209b5b34746f2517c0bdfb74e8026a10bfd65f6f01a2798f1bb70385812fe6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869109, "uuid": "67b3a868-ba08-4cf5-9651-e16334eaaaa2", "value": "T17BB3D0AA3172CA9CC43E533C95EF1FBB6BB48F4616610606113AF92C6F225E79B5021D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869109, "uuid": "f954c9f7-aa5c-4e77-a3a2-f649e369e1f7", "value": "3072:oUGtM6vMQrti63LD6z2qoaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa3RY3PaaaaJ:oTtH3r867Moaaaaaaaaaaaaaaaaaaaah", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869109, "uuid": "171eae29-60f1-43a8-bfd9-f0c2b6d85d39", "value": 112373, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869109, "uuid": "8f92adec-92d7-4510-9cb4-649e39ad0468", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869109, "uuid": "a70c822d-0790-4ef9-a74d-7a0635916e42", "value": "Invoice-27463_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bec6b081-0564-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869079, "uuid": "a9d22c8c-fe01-4c93-89ac-802e700e0f57", "comment": "Malware payload (Dridex)", "value": "21d1ee7daa923f1243d4f757cfde71f6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869079, "uuid": "3b5d2a0a-28e6-492c-b054-59fe0b870fd9", "comment": "Malware payload (Dridex)", "value": "1785380ea3e5970dce00c09a47348406169b06d183ad95c3b75d3a01c53e2d7b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869079, "uuid": "708ca0bb-9cd3-40dd-94c4-695a89dbb20c", "comment": "Malware payload (Dridex)", "value": "952cd21bec9e397b5ccea4cd57cec347a3150303", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869079, "uuid": "65b509d1-e760-4787-9e2e-66d1a384b105", "comment": "Malware payload (Dridex)", "value": "3d14078e2598383442467eea1c6a6dd7f020184436cdd6652c6fc9109f1fb76cba2b1bcf96187b26be72118a99822e68", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869079, "uuid": "97d0f288-f92c-4f93-b278-198c3c1093d4", "value": "T130B3D09A3663CA9CC52D463D55DF2FB73BB88BC912524B16223CF85C2F225E7DB40119", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869079, "uuid": "a3efd2a6-456c-42c7-8b02-e82c26b6dadc", "value": "3072:oUSJ3RvmOIDw56ei63LD6z2qoaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa3RY3PP:olzkwa67MoaaaaaaaaaaaaaaaaaaaaaI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869079, "uuid": "d20d25f2-2a4c-4505-be26-60fc36c8c975", "value": 118068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869079, "uuid": "15e74776-b9e6-42b9-a0b3-f8a9d4263b26", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869079, "uuid": "f023231f-6bfe-44c5-90a9-5682f3aefba4", "value": "Invoice-543291321_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f3618f4-05e2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1629923116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629923116, "uuid": "61444eed-165c-4e7d-99a7-931cdbbb5987", "comment": "Malware payload (NanoCore)", "value": "db4b6127b0eba1c8e0535283e52ee1df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629923116, "uuid": "8334e158-ec79-4eb9-9786-f45add9e93b3", "comment": "Malware payload (NanoCore)", "value": "17d901ea338cf7b487226ebd86f963023ce246d9f3aaa973f6d15c44cb01907d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629923116, "uuid": "185219e9-4773-4933-8f0b-d526befcef22", "comment": "Malware payload (NanoCore)", "value": "cc66a1ac6beed78b419d99f71b921df371d59f53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629923116, "uuid": "18a1c922-c25d-4aaf-8ae0-590ea6eb9224", "comment": "Malware payload (NanoCore)", "value": "8ff0bca34503d74639f3d11d94a0826f94c4b023b93c3b6fb3a3d8aaaa891ebd5849c7ecaa0b8b156b254efc8d8dee99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629923116, "uuid": "52b79520-ca95-4a58-af7a-1af9e41f4d6b", "value": "T1F084124548C4CCE6E71AB371D0B3CE9819657832CCD56B689758EA2EB870343B853E6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629923116, "uuid": "8359d43d-76c4-483f-ac4b-d5b406e9bb15", "value": "ef471c0edf1877cd5a881a6a8bf647b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629923116, "uuid": "33d21350-1149-4b6d-9008-528f27d23325", "value": "6144:u4XrK9PX7Fp6Gh2wWRGl0EDDf1PisZQ5rAGQwg1QtP1f4paaYlsdcaMJEdbI0Pzt:tXe9PPlowWX0t6mOQwg1Qd15CcYk0Wed", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629923116, "uuid": "fc8f85a2-639f-4597-92af-ce853f43256c", "value": 376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629923116, "uuid": "f1d231a1-7c88-4422-8c14-1c15437dad9c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629923116, "uuid": "b0f4d584-a3eb-4128-acd7-d7fbf2deb29a", "value": "DHL AWB TRACKING DETAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f89fd3c-0575-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629876140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629876140, "uuid": "5ae6b660-111b-432f-81c2-bb0e3af8850b", "comment": "Malware payload (Loki)", "value": "14767e85a7e2bb77793ebc1e52ada513", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629876140, "uuid": "d78429bf-7384-431d-90f6-f2f5d4da8c23", "comment": "Malware payload (Loki)", "value": "18da7b8849dbeced86dd4f093e8d0216863530820a22a3b69cc03806c1784630", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629876140, "uuid": "78c1ec58-4a90-4e37-94cc-fbd42c25cf08", "comment": "Malware payload (Loki)", "value": "0c0777c7fbb75fd5ec733816ce77e396d7c9f361", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629876140, "uuid": "141b07cb-5dbb-46ea-a02d-50b157a2c9a1", "comment": "Malware payload (Loki)", "value": "b592ef83f153f9855f52ab0390362ab97490653b72b610c4297889ba0775a5f4b8cf762dfd7fedd703d8c58fa268448c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629876140, "uuid": "f4ae3214-b86f-4847-89d0-7d883d1fa9e9", "value": "T17224F121C0F71855F70136FC798E60912C21DD8BD23B2AE6DDB93A2BF1B281755BA843", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629876140, "uuid": "8dab14a5-45f6-4b89-ba38-7a89b986e402", "value": "35807dcde258f88fa3ce5c21adc607fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629876140, "uuid": "c9837c81-175f-4eb5-bfda-32815ca548d3", "value": "6144:nzdawq9BdOr+8adSHwFK/5fRsZLiYRYoYVMiKFpxSluswx67y9tm:nz4wq9BdO5LHwFK/JRImYRYon5DJ67Wm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629876140, "uuid": "608d5cac-94de-437e-a92a-150ec4f8ba8e", "value": 229448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629876140, "uuid": "46bc1a49-c57e-4ed9-99e9-3b6becf967b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629876140, "uuid": "9f599000-7dee-4f7c-a4b9-e34794ab7172", "value": "Shipping Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c73b5a0-0545-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629855680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629855680, "uuid": "c38bdaa1-5e9e-4bd9-ad6b-8a50dd2f2907", "comment": "Malware payload (RaccoonStealer)", "value": "c8f3719f09fa3745d000e418825cb947", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629855680, "uuid": "c46e272d-d9c7-4f40-8629-30fb30f6f964", "comment": "Malware payload (RaccoonStealer)", "value": "18e9bcf34eddc90a695dbbc6e9979b163affc9288e7ea7f2e7dbb4a2f693cf18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629855680, "uuid": "78bce3bd-f6ad-4b54-9f30-aab9ceefbdd3", "comment": "Malware payload (RaccoonStealer)", "value": "a92d5a33dd958c47e2d4d2632298b4100f4905b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629855680, "uuid": "e393591f-218f-4586-9a27-cd97650a6d5c", "comment": "Malware payload (RaccoonStealer)", "value": "bfa6e20f4185d6c533e925cbf7f5c09b5410c7d1cab6519981bc548cda7c25992676b5b3aa0337f9e127480a904e6246", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629855680, "uuid": "1c533b1d-2ca1-461f-88ea-cb7cf66c0747", "value": "T178A4122D7D71C9B0C5D24DB68890FEA4EA757D22A9D01E0367981EAE7E303C1393D35A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629855680, "uuid": "18e5acdc-1ca4-4e13-883e-95d553764af0", "value": "6b22ece31495fe337ab5b098b4e30ca3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629855680, "uuid": "28b471e3-6f77-435f-bc77-4c08846006b3", "value": "12288:GRPBlUd03F7NVwutV6Xbm+L6vD1V/yXXdP2H:EBadenw2V6rBL6r1V/pH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629855680, "uuid": "59b3586b-d6ba-4a0b-8dd1-c40cf65831d9", "value": 472576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629855680, "uuid": "40b1b174-e78e-4a24-84ab-f51b31a4e5b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629855680, "uuid": "3bb8f83d-5d7a-4ad7-9bc0-c00be3b7f5a4", "value": "a92d5a33dd958c47e2d4d2632298b4100f4905b5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5c67604-0564-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869091, "uuid": "c23b15c9-55a8-4b7e-bfa8-774f04f0e755", "comment": "Malware payload (Dridex)", "value": "63be1b28e8eff44af5ef5dac9c0898f1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869091, "uuid": "a61f1fdc-62ed-42a3-b5f2-5e7acd3931d7", "comment": "Malware payload (Dridex)", "value": "197b3fbed541ad22a0f7e2644a84ef7b9ecdeb747114473516b3b80728b80969", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869091, "uuid": "b7807f46-75a8-4ec2-a407-ae9a0c4be8d6", "comment": "Malware payload (Dridex)", "value": "f54e3aee3e197f9cd3189af62c888caee3e4b6f7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869091, "uuid": "e7b3b0a8-2210-4dd0-a264-9a08f0b67e8b", "comment": "Malware payload (Dridex)", "value": "91ac99659b5c7f0e65bedfb1700d1ec270610c1b2b7b9e8c3532986a9fa41e21c900893b95c89f89d65a2440aa224706", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869091, "uuid": "6254d69b-c87b-4856-a0f5-25e12b74e57d", "value": "T1B464021CC9F3E93ADE8609FF4DB914D6A3A78A33C55549DA88C431EC2E1313A4249ED7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869091, "uuid": "44ef740d-7e89-4655-8fe0-49eb6aef1cbf", "value": "6144:orCDsJHXO/J6t/VYfASkKTzZYwPMPFde/Qxx2u+OA+NT5Ao:iwsJHX7ifASkKTzSwkPFduQx0uD+o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869091, "uuid": "96b60323-daf2-4092-a5bb-1d9487799670", "value": 323376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869091, "uuid": "03cafc20-7c1a-4f73-a771-92e3c6b49845", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869091, "uuid": "62109665-de3e-44aa-ab0a-c9ad089180f7", "value": "Invoice-42709_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fa73336-05bd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CobaltStrike)", "timestamp": 1629907064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629907064, "uuid": "573ffc87-7a5a-4636-8834-d95e73404f6d", "comment": "Malware payload (CobaltStrike)", "value": "9815bbaed20019321a33d132cd9fe66d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629907064, "uuid": "8f5073d3-fdbe-43b0-8a53-33c34a4ca4ba", "comment": "Malware payload (CobaltStrike)", "value": "19c0307d2da8178e322430c496e5dcb2accb869b7b7f2fcb7937830451ca235d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629907064, "uuid": "dd3f7bc8-6ca9-41c2-9e29-8b6c2c88accb", "comment": "Malware payload (CobaltStrike)", "value": "2bca61fb3c7e016b86314898328721202034005d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629907064, "uuid": "10b557ab-4a5f-4d6d-89e2-515c383b74e1", "comment": "Malware payload (CobaltStrike)", "value": "9c3b6e135571939b01aa185d3d155714ea6076c2477e744da0ded9e3be21deb2aef6c29c8365ef792861f69746a71a27", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629907064, "uuid": "21a6bd1c-a41f-40d4-9631-435031bc5d1b", "value": "T19D740160EBEA6555F5F77731A93A0721572E7D82A838F50C871042CE8A71AA5CDB0F33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629907064, "uuid": "ffdfa0d2-ebf6-467e-9543-ed32c223529a", "value": "e218f655f036f569d7a87ccfa333d177", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629907064, "uuid": "a935c56e-c323-4503-9f0f-1ebd5965764f", "value": "6144:p61FoHY1j12PbimfGsE6m4FtWfAvpofL0tJ1PDi7wfaZwln/6kgUB9Z5Dr5kCvjM:vcj12PGYEgvIE9Di7orlikjOCvjbD0vG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629907064, "uuid": "1ca62c9e-52c1-4426-aeca-9ea031db8025", "value": 364544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629907064, "uuid": "25522417-4cde-4736-a45b-eeca8e8b4777", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629907064, "uuid": "0d4b0973-d4de-486b-94ec-918cd290212d", "value": "9815bbaed20019321a33d132cd9fe66d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a47576ff-0564-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869035, "uuid": "eea522d3-be26-4589-9e06-008f2de1eb9e", "comment": "Malware payload (Dridex)", "value": "450f53d6b2a89bae9871791dc27569b4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869035, "uuid": "2c6f0b24-9ba6-4235-a45f-21e3295359d4", "comment": "Malware payload (Dridex)", "value": "1a02a42a53a6427cf7a22e2958514648751a3064995125bd74cef9a75a72bcf6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869035, "uuid": "264c85b8-4f36-41dc-8142-bbb4c277d2f6", "comment": "Malware payload (Dridex)", "value": "dcdf52075d17aa83b4c001c733eacc5885e02a8e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869035, "uuid": "55e2de32-d2a3-4423-81b5-e3a16b73b5fc", "comment": "Malware payload (Dridex)", "value": "ff0cb1180499c4c7ff3e3b3bc340b7dac889fa49f00965f64c4baca6b7dc0c92cc6dd4ebbc05963c5c373752fc08fa57", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869035, "uuid": "bbacd894-e203-4f53-9e0d-17e2ee2c586d", "value": "T104D3E1AA7637CA9CC425537C81EE5E776BB0CB4456B50667125CF838AF228F79B0920C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869035, "uuid": "d905b256-be16-49d5-9c32-be89d4c46352", "value": "3072:oUjw9bKoHV0NX+lEXbrYbYOlwgi63LD6z2qoaaaaaaaaaaaaaaaaaaaaaaaaaaaP:oKsKAJELrnewp67Moaaaaaaaaaaaaaaw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869035, "uuid": "0c374e99-6649-4a0f-a800-7cca6fe3c9fb", "value": 140113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869035, "uuid": "93705e5e-a2a1-428b-b7b5-5783810bc7e1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869035, "uuid": "fca0b9ee-a60b-4462-a0b3-1530854fff5a", "value": "Details-11682_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff091fbf-0564-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869187, "uuid": "75827d04-a98f-4278-9d1f-92fe52e6ff56", "comment": "Malware payload (Dridex)", "value": "8728a0e84629e17938292a7ae8068a8f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869187, "uuid": "8db81566-6ce8-4112-a583-b4b83a6776c9", "comment": "Malware payload (Dridex)", "value": "1a94b36bd3f029da53ff4bade35f5841fc0a0dc9d95db565a00727dc1b949a52", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869187, "uuid": "748924b9-f991-4ed4-87cc-0ebabba42709", "comment": "Malware payload (Dridex)", "value": "da7f24acad3e51d2cc54bd6893cb28d6d388efa5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869187, "uuid": "99d82ad4-aefa-4ea5-b9d4-b015aacd701e", "comment": "Malware payload (Dridex)", "value": "fefa60caf1deee9f3e057f056c9c508f76b23693ea87f128ddb05e6796a819bbbb8b3695dc5c99fc139cf286b3f61032", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869187, "uuid": "80565db9-9b90-46b0-8990-e5cc9a9689cf", "value": "T18574126C92F1D81CDC4E413FA1D70F71D7611A06A782A71FD6B1B20D5B03E7A8A6B0AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869187, "uuid": "40880adb-705d-4c8f-91e1-2d7f7b7477bf", "value": "6144:oE3nyXZJ2LohOGYw6CC5jTT453mjEIbWiGVAKSLFN+YInSCRvuPsxNu:TI4L2OGY/TTy2jEIJc6FNu3uPmNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869187, "uuid": "cd6804d6-f998-4384-9e18-02435fed01c1", "value": 354450, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869187, "uuid": "e38c4342-5027-4855-90ad-7bf9a6cc7593", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869187, "uuid": "0827306b-ac4e-4578-ac92-826c48a10215", "value": "EoY_TAX_Notificaion-5909059067_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92cd052f-0576-11ec-8fa1-42010a9c0011", "comment": "Malware payload (STRRAT)", "timestamp": 1629876736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629876736, "uuid": "4ddc9094-cf69-484c-9454-32483f942f9e", "comment": "Malware payload (STRRAT)", "value": "075383dec7f7f734703c07ad452ec516", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629876736, "uuid": "8e1c0880-e94c-42b0-b17b-b9f6f19c7913", "comment": "Malware payload (STRRAT)", "value": "1aa7af496d4c49c35a9bd663783a6ecf3d076d774ac7a53ecfe93b1837d05710", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629876736, "uuid": "e5f283f6-6ae4-456c-b7ad-6a9b7b907539", "comment": "Malware payload (STRRAT)", "value": "baacfa9cfc1aabe3e9b17f26011d6f516aa50088", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629876736, "uuid": "97646478-75cb-438a-939d-2e4930d9a77f", "comment": "Malware payload (STRRAT)", "value": "74b7e846ec90afafdbd12955ed98263c4c07fb07f7637a808d3139ea6b852e42c6d1efb11e661768ebc9f6e9be76c18c", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629876736, "uuid": "adb86ad6-475c-4132-b83a-2829a1db2d6b", "value": "T1E9B3DF2B3DAEC0B5D657C0B1901182B7AA0C02E4D595851F25FC283A1E39A7E5763FEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629876736, "uuid": "b9d4aa6e-3598-427f-a2f9-9f1f1f44deb5", "value": "3072:9mLkb6oj/F/r+kV5nvDA65eshM1zmZpYESmjOYxthST:oLkb6obVVvDVprYESmj7xto", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629876736, "uuid": "ecde49bc-0fa0-4ec9-aa7c-b10034e4fb01", "value": 109794, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629876736, "uuid": "2228a362-411d-4c3a-89e7-fd864c65c649", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629876736, "uuid": "3e507d33-bd4d-432c-a006-82d12069d3ed", "value": "invoicepayment.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "466ff654-057e-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629880044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629880044, "uuid": "68ae6d15-a71e-4b3e-b233-aebfd655d46b", "comment": "Malware payload", "value": "9636df4bef49cbfa73a6c9b0c99e32d5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629880044, "uuid": "40864188-433d-4382-a852-2624950612ad", "comment": "Malware payload", "value": "1ad9ca0334fe57ac0180acc93d5df563050b1c494b495fe9248a06f9c5cdeac2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629880044, "uuid": "c6a56ea4-c1b5-491a-9d05-4fdd33516292", "comment": "Malware payload", "value": "884948e32fb70fe035c9d25d1f31e1d6ae89b854", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629880044, "uuid": "08dd05a3-c119-40bd-9c7f-2ab804b3d8ec", "comment": "Malware payload", "value": "f37bfede1e82f9e2e59032062f9e97858ff31c7df12a15d1e29eab5413579b82c4bfa9d3f4784d2266cdb5bfc4701dac", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629880044, "uuid": "03e71e97-dd5e-4141-95bb-374596c77201", "value": "T1B7936C10B5C2C471E572193518B1DAB15A2DFA704F269EEB379C0BAE0F740D0AA35EB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629880044, "uuid": "1c1b7cee-e559-4354-8e24-0a580ee13e11", "value": "c7d3661f79d58d30854a3af50a6f4c2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629880044, "uuid": "ad6ac590-94df-418c-9ad4-a690c2b5a1ea", "value": "1536:OdNgvNbjS6BlJBYr1WXt6xoHkLLUQAOuxVm1tX6YwuIJLO+s8jcd/0fSdY:OdeBSMbYxEtgWkXdAZLmP65uIVO7sf4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629880044, "uuid": "4ded2370-7721-4e17-91fe-8264089b4ae9", "value": 92672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629880044, "uuid": "e59a3b5b-107f-47cc-92e3-5e763dc41957", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629880044, "uuid": "ac8c7edb-d8e9-4090-81e1-5b4b7f5e5457", "value": "9636df4bef49cbfa73a6c9b0c99e32d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d36c2bb-0565-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869238, "uuid": "42509389-f645-45ed-b01a-4bf5a8dc616d", "comment": "Malware payload (Dridex)", "value": "b97d7a86848b28232c7cd7bad6463cab", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869238, "uuid": "a4a232cd-ab1a-4bbb-b95a-fdf00ff4df95", "comment": "Malware payload (Dridex)", "value": "1aec14598dc1cf4b51ae211703872bff744d134c74d60f6accb8a6f8d7c01989", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869238, "uuid": "a981acee-91ca-4c07-822c-9fb719a0ca13", "comment": "Malware payload (Dridex)", "value": "7611b4ca4f41acca97a203e44af3c931dfac2cb3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869238, "uuid": "a4a0c0dc-3c19-4554-9af6-1dad163a0369", "comment": "Malware payload (Dridex)", "value": "0f93878a1e1e0e11ed3df7a25d9d646af7e1bca4b89ce1da77558baec85d98c4ae1aa982f689d0fca173b9b7593f331a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869238, "uuid": "58b05e6e-147c-43e5-8d3a-062c4208e689", "value": "T111C3D0D57662CA6CC07D833C51FE9EB62FB48B4522A2871A1239F46C6F135E7EF40219", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869238, "uuid": "f1106ef3-6316-4e07-a863-d84f37da5366", "value": "3072:oUv7idQxXq4CJi63LD6z2qoaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa3RY3PaaQ:oVQlJ67MoaaaaaaaaaaaaaaaaaaaaaaE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869238, "uuid": "20e1d53c-7829-412a-b10d-872f493e66e4", "value": 122342, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869238, "uuid": "5a40bad7-6081-44a5-b99d-fd84740769c7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869238, "uuid": "6fca5048-c7ab-4f23-9f63-1af8076cd8dd", "value": "Scan-1895827_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3fb141a-059a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629892281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892281, "uuid": "f0f31d3b-ff98-44db-b0ac-f2bf8bf6f81d", "comment": "Malware payload (Loki)", "value": "477fef3a87351fcba8331d3e9b96bbd4", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892281, "uuid": "4d23dd49-1143-4681-a7ef-bd63f8ab2ff9", "comment": "Malware payload (Loki)", "value": "1c76deda6c626aff1b2e584a1559e789f16b573b1b0fac7f78c553510b29aa0a", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892281, "uuid": "cb731f73-0272-47a5-bba4-8b488ca88b48", "comment": "Malware payload (Loki)", "value": "62b780e64ec3c3c8c2a7c0e258e02cb44293fc1f", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892281, "uuid": "332f4e28-b7cf-49d5-b684-7d1326b5e2c0", "comment": "Malware payload (Loki)", "value": "f69ff2be5a03b6cf463369edc1591827429d0325bb9dc77659a556cce3988299861348ede2e1e2ceca913ba85b1758e5", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892281, "uuid": "fc78a9bf-6c08-4c5a-9d7e-35d013054e98", "value": "T15F451237A5820FB9CF4AAB78079AD12C00DF7FC01280511FAAAAB758717D5355FEA61C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892281, "uuid": "e92ded5b-530e-4eae-a5cf-08014f09066f", "value": "24576:o35q8bQHneN2FHDs1hYxpngoZxOPi9mAuzBKjVH4yDBKdYLCZ8zF:o3rQHn/FMhYxp9OPIZuQ4yDBKOLZF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629892281, "uuid": "4e69b2e8-5e89-4e5a-bb88-4f3099ae3c8f", "value": 1248056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629892281, "uuid": "eced9f23-f45f-4230-8346-9141d87ce789", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892281, "uuid": "62bee104-fa7c-4201-815e-18753efa075b", "value": "Payment Advice Receipt.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9a3149f-0570-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629874278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629874278, "uuid": "5c74b2ac-785f-424f-b7d4-4dfb749ddf52", "comment": "Malware payload (RaccoonStealer)", "value": "da3c36223567432fc17f3fe1f2cc6e95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629874278, "uuid": "4067b2e6-afcf-46af-9c2b-a7a647d7e000", "comment": "Malware payload (RaccoonStealer)", "value": "1c9c8e55430bf1affab8777f70f42f369f457e089e5c49dcb09ff11918f25d37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629874278, "uuid": "0353e61f-7a36-41b7-ada1-32c6d11a07dc", "comment": "Malware payload (RaccoonStealer)", "value": "677cf8e22118be5472f5b5fa6407764312c4d296", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629874278, "uuid": "316bff8c-a3a8-4209-8694-e7a255f9bd23", "comment": "Malware payload (RaccoonStealer)", "value": "121aff6698ad6baad809c2e63ac16d3ae2fe796a60cc0daac63886af6f000db4d7231bd0e15dd19883edc0ad4c8b1432", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629874278, "uuid": "af37d485-26ac-47a9-9b82-f809ef85c7e5", "value": "T17DA41210B6A0C476C4B55A734CD0C670D33EBE91A175828B7BF99E9F1F222C0377668A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629874278, "uuid": "726ca9ca-9c3e-419e-80c3-c1f85005a2b1", "value": "bd3c9edf948deca79ee5e78523f1a042", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629874278, "uuid": "526b076e-bd13-4f75-8565-2af9f4c52036", "value": "12288:kBuxI7Cf7EAfy9JlgVj9zpsGxSCx+gPvcF:kqSCfP/hzTSCxDPS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629874278, "uuid": "928ec93a-fe3a-4440-a930-f86f0e24a187", "value": 467456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629874278, "uuid": "69a27c4d-3450-437c-a2e2-5e63d0c70c9a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629874278, "uuid": "be1d06ba-ae94-49e6-8520-596fd46afd17", "value": "da3c36223567432fc17f3fe1f2cc6e95.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51b4141a-0572-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629874909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629874909, "uuid": "59858724-baec-4e74-9f0e-9a8bf3b5b1fa", "comment": "Malware payload (RaccoonStealer)", "value": "ed61c6f7a5d38bedd2ff01193e78dc27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629874909, "uuid": "3ccbe91a-20a2-403f-9e75-320fa83b9843", "comment": "Malware payload (RaccoonStealer)", "value": "1d5b96478e7fe484db4b8de6828c03b7a5cbe38e53dbdacde6eb6fdc29757d4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629874909, "uuid": "c62929f0-6d99-422f-9260-7ae003e07a31", "comment": "Malware payload (RaccoonStealer)", "value": "a5309021aceb33e556bcb6242497cbb35fc87c4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629874909, "uuid": "71bc3a74-cad9-4dd3-8eae-a700789b2fc1", "comment": "Malware payload (RaccoonStealer)", "value": "7ce32b3a7ee6e1413a38649428191093d62e44a8625839dbe7eecd6b4cf739a529ae09603746eeaa48574037f482f55c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629874909, "uuid": "b280e440-6cf6-4ca9-ac72-b42fbf27f963", "value": "T115B4E031AA91C035E8B711F8897A83B9B5397DB06B3040CF53E51AF91638AE5ED30797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629874909, "uuid": "a3247f6e-92c1-428a-986d-662141613992", "value": "ddbb3eef631957f988f10b48742f9549", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629874909, "uuid": "28341c25-f715-4e25-b984-004510c71304", "value": "12288:RZuhi6OXIa6+Fh64bFrMAEqumgZR0ttH94J8mUA7U9KMDL:KOXIK6Lqu90ttde8mUA7Uxn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629874909, "uuid": "50b89030-58dd-42b9-8092-8458e831eb40", "value": 540160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629874909, "uuid": "f0e6b12f-5bbb-4c46-9d14-c2704753761e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629874909, "uuid": "44624551-c9de-43e7-94f2-573855d55c09", "value": "ed61c6f7a5d38bedd2ff01193e78dc27.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a76d924a-0564-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869040, "uuid": "15a5a9bd-9b1b-4a9f-aeb6-9ab7f1f97e19", "comment": "Malware payload (Dridex)", "value": "06d007383acde9729a038d9a4facecc2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869040, "uuid": "333003bc-5f77-4237-b153-a1be961ddbe8", "comment": "Malware payload (Dridex)", "value": "1dd723cf63fe60909317aba4a9e2bcd9f47a320c3176bac30f1e6a0d5fdf7d57", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869040, "uuid": "4c27d601-c79b-47a8-9e0a-1ad464f14ea5", "comment": "Malware payload (Dridex)", "value": "f4bba2c2ea0e0724c58dc389c84628fb90516403", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869040, "uuid": "95bd1a57-770e-487b-a05f-12e1b00df8d0", "comment": "Malware payload (Dridex)", "value": "d43a4faf1aebf8fbe6f921526c5007675b77cb94938bd678acb6ed14ec018f6ce2b55c69cf93034304c428062d094ee7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869040, "uuid": "4e969d61-c667-49d1-9e14-39b368efebd2", "value": "T19384126857A6C81CC84E913F81E74F71DB606902B6C1B72F91B1E2196F43D3E4A6B0DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869040, "uuid": "6e8b7d55-b7a8-4197-b05a-83c60c6bb073", "value": "6144:oNTNbUnRex2LohOGYw6CC5jTT453mjEIbWiGVAKSLFN+YInSCRvuPsxNq0:CNURewL2OGY/TTy2jEIJc6FNu3uPmNq0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869040, "uuid": "c0c16e7b-7275-4675-a345-c18a6939b5b1", "value": 378782, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869040, "uuid": "a9780836-c5c9-453c-8bea-f3a6c66364ae", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869040, "uuid": "0ad13f53-6821-4b19-a157-6a5006c268e4", "value": "EoY_TAX_Document-007202_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8370eda1-059a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1629892172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892172, "uuid": "d018ac4c-37c2-4483-baa3-40a989348387", "comment": "Malware payload (AveMariaRAT)", "value": "b432b63fa8ac6540ae3c6474ede8c923", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892172, "uuid": "dd6b9c0a-1e0f-4c07-b629-8b534e5087ac", "comment": "Malware payload (AveMariaRAT)", "value": "204671d989631c99ed12773546e79d980aec9a79922769d13c732fff64325353", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892172, "uuid": "eebc9691-70aa-4487-bc72-a256cb5fc19c", "comment": "Malware payload (AveMariaRAT)", "value": "1dcdea4c1a48c63962172a5cc0834bee790cb5b7", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892172, "uuid": "919856b7-0153-4150-8b5b-ff21c2f6f81a", "comment": "Malware payload (AveMariaRAT)", "value": "2590d8e518d6ea1eefb49f09c641e46933e4d54fa40dc250f77ee143acfa801120d568c109df1d3c9ec53660d8d02fc9", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892172, "uuid": "bd592132-79b5-46b2-b5e1-aac9315b27a9", "value": "T192F46DA56DFC0C73D693263E4C1986BA0530FD9039A4DD5A6BFA3D8ACE39340193E617", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892172, "uuid": "03beccc2-5ec2-4a53-aae4-c7ad05ff16b5", "value": "95ca75521f0d84796bcc75c19eb91d03", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892172, "uuid": "b8bb4530-46be-46e3-8d91-683f4989e43b", "value": "12288:HG0z7gLLMuRN/tMvdEAwM3nrkaoUfpACXDoVttivrly5g1+yVt:HfzMzRxtMEqAP0iCXDvvrlm8xV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629892172, "uuid": "8d57c217-78f5-4a9a-a934-54d3b4435ef8", "value": 757760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629892172, "uuid": "55a43002-d549-415f-bebd-60d3c1d978ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892172, "uuid": "7b40b7b5-d4a9-43d4-85bb-41a881d8c44b", "value": "Order confirmation request_25.08.21.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7fa3df3-05b8-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629905146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629905146, "uuid": "87e0f509-ca99-4cb7-8b65-9a9b969e252b", "comment": "Malware payload", "value": "a3523feebd730ffcc1016ad81c35be6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629905146, "uuid": "5d52d49c-c16c-4679-8f94-9fd1d8c5e9fa", "comment": "Malware payload", "value": "2063e7cc6524afed5360052106f2ba59135244ab21676b533d16c3eb5767590e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629905146, "uuid": "04bebb80-9074-469d-8a67-4a5362f4c552", "comment": "Malware payload", "value": "976b1cb923b3f8bd8f7b24614249b389b8662111", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629905146, "uuid": "e87b5a48-c54f-4f03-9b4b-c235da4807b7", "comment": "Malware payload", "value": "8856311c3e8d21805faed93d71f61fcbc7b154100d585a19782f9332f18b1e9b111713efaa5dde25040bbfafafa65f04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629905146, "uuid": "0aead31a-0e7a-44e3-a93b-2f9fa63f60f8", "value": "T1CF658D57BCA520F8C1EED231C629A112B9313899073437D72F9163F91B76FE46A78368", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629905146, "uuid": "14a3a01e-b7f9-4b93-baee-266569412ccc", "value": "24576:779/XIGPCrb/TkvO90dL3BmAFd4A64nsfJJFugDRbFsR5XACCyx5GzhLTvO4BNfH:775Xbarb/TkvO90dL3BmAFd4A64nsfJr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629905146, "uuid": "01b41701-5f38-4995-81b1-716ff9fa7cfa", "value": 1544460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629905146, "uuid": "ef5fec42-0ab4-4bb8-b506-7dcd11316689", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629905146, "uuid": "ff02cc2c-1805-477b-866f-8b6866855b5d", "value": "a3523feebd730ffcc1016ad81c35be6c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d79db2cf-0566-11ec-8fa1-42010a9c0011", "comment": "Malware payload (KPOTStealer)", "timestamp": 1629869980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869980, "uuid": "f94bbcad-d333-47e9-b1d1-1a47b98e894f", "comment": "Malware payload (KPOTStealer)", "value": "a4c7348870f5652c4c19c2d4a95cf43c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KPOTStealer", "colour": "#42A642", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869980, "uuid": "f6c96317-f3d4-4211-b91f-5be2eacca0b6", "comment": "Malware payload (KPOTStealer)", "value": "20fb4600c5fa835a26cd5967d864e2189b15bdc626abadf75be7466cfec9919e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KPOTStealer", "colour": "#42A642", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869980, "uuid": "64fc2fa2-4def-45ae-9cc8-1e05e97732f0", "comment": "Malware payload (KPOTStealer)", "value": "a5de5f110aadc1693b9705ef9496a81f0c721f9b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KPOTStealer", "colour": "#42A642", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869980, "uuid": "59cf4737-789d-44b0-a5d2-472c702a17d8", "comment": "Malware payload (KPOTStealer)", "value": "b7c126cd5cdd471c67c39e9417591d872733e0d99ba1ad93f77758f9c54b6dc6426d1007a6c2ed96b1db5f6845eebe14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KPOTStealer", "colour": "#42A642", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869980, "uuid": "6de728dc-d07c-44d6-8a8d-c27f6b0348d4", "value": "T16884F1003670C537C466067089D3DBB0E62C7646AE759547BBE4AEEF2EB12D0763A3C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869980, "uuid": "0e37a804-a07d-4ade-8d21-bb1f81a33bd7", "value": "3bdc58d7d3add14fdfc74404aa032a2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869980, "uuid": "4d39e823-e9e2-4596-9c3f-26bfd7dfe536", "value": "6144:4Uu7BQTBcpdBo3kRGwGReyEqV5l6hTKbU2rVXwRlCF7e8bEcxb:4LQ9oM+srzghZlCHEcF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869980, "uuid": "a542f974-5c5e-4de9-8dcf-127a7ca6ac28", "value": 406016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869980, "uuid": "5cd6923c-389a-4a9a-b470-cdd93330b9d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869980, "uuid": "4b20a7b6-0914-4292-95f4-a74d0ef0c343", "value": "a4c7348870f5652c4c19c2d4a95cf43c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "383f44fc-056d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629872719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872719, "uuid": "2ea0e403-d620-4f87-aac1-5d1a60af9ab1", "comment": "Malware payload (Mirai)", "value": "8901a652ae68813845f9a10e86d79100", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872719, "uuid": "c2f4cf08-90cb-4ebf-a691-71ef5027b846", "comment": "Malware payload (Mirai)", "value": "214c9cd543bc6f5fa328dab440f6e8a195aab3cdb58f6911bd288040847a8d56", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872719, "uuid": "f642df67-c5eb-41d8-a8c9-3b02c86c749d", "comment": "Malware payload (Mirai)", "value": "b15db1b0ef6840e11beeb53327281c765d8ffe68", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872719, "uuid": "61fe14c6-d6cf-4e2c-b0c4-4ca5f301d61c", "comment": "Malware payload (Mirai)", "value": "d8c95cbea18dc0d51e032f8ad834e381fe5c74208c9d9a47571c1d3ce29365de50e0115a7c0087422080e8dcee194f90", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629872719, "uuid": "e4adc1a9-3a6e-4a3f-8edf-03d0b04bb77e", "value": "T17F73021150962D5B88701C3BACF44151EBDA967CE44CACBB5728172CFEA3A23353B2E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629872719, "uuid": "b7bcb61d-4e91-4414-87fa-41633a029864", "value": "1536:PbB0/O3GbJ/RpLIX7tixYdyvpDLMrx6q5fy:s7NIUxY0vpDLMt686", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629872719, "uuid": "0230d483-8e94-44a5-ad04-4f9bce564e61", "value": 74448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629872719, "uuid": "0d0325b6-889b-478b-aa42-e916efddb73b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629872719, "uuid": "657578b2-5391-40b2-b15a-2ea079f0b455", "value": "8901a652ae68813845f9a10e86d79100", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d0193b8-05b9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629905315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629905315, "uuid": "9afcf0ca-96bb-40b6-9b34-7ff789c9490e", "comment": "Malware payload (AgentTesla)", "value": "c1e872d6aea9f4c23401047114261837", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629905315, "uuid": "305127ee-12d7-4cec-946a-e01cb0adc1f9", "comment": "Malware payload (AgentTesla)", "value": "2150695b2a65591b7015a05734067bc4cd3243b98ac1a495fd5791d0211011f7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629905315, "uuid": "5b1a23c8-1a87-434f-870f-6d855488940b", "comment": "Malware payload (AgentTesla)", "value": "cb876b0bd9043152ddfe84d03e1441f2d4728334", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629905315, "uuid": "9e4a7700-8de9-4c22-ae1c-969365ac06dc", "comment": "Malware payload (AgentTesla)", "value": "9042983e71565a7d0c01505172c44cd5feb667bd97a0aa899c8bbe8c139a867061681b360ac875cfe8956b31697fb260", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629905315, "uuid": "a3269239-2a2e-4920-9c5b-870d8dc0a724", "value": "T1A425AE3233947A57E07A9B3055F1549482F6BD263A31D14E3DD2B2CD16F1BC0A7A2F2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629905315, "uuid": "2bfc7a5b-6d8c-4f7a-a994-7432cac60d55", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629905315, "uuid": "ecf2f917-b433-443f-8160-cc203a7f573e", "value": "24576:+Jn2YxZRUi/5Cgaq+msQAZz73ASJn2YlZRUi/f:m2YnRUi/5pwGA13h2YzRUi/f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629905315, "uuid": "b0c129c6-2190-48e8-ac87-033aa91f91ec", "value": 1032192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629905315, "uuid": "d6a05b3f-43c7-44a1-8ad6-351d4c289c00", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629905315, "uuid": "b7332031-e1d1-4809-bcdb-ea98971edb35", "value": "c1e872d6aea9f4c23401047114261837.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a436d162-05b2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CobaltStrike)", "timestamp": 1629902535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629902535, "uuid": "78d886f7-3af3-41e6-b58e-9d8b0ac61c7a", "comment": "Malware payload (CobaltStrike)", "value": "c45acb836528237631b1305d352fcde9", "object_relation": "md5", "Tag": [ { "name": "1359593325", "colour": "#0C1016", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629902535, "uuid": "90559c7d-fa05-40e6-a709-125e1f4ed0d5", "comment": "Malware payload (CobaltStrike)", "value": "2160af903da06c25c2f6426931d20eb7e7a8ea6f9951e144188027252ff64281", "object_relation": "sha256", "Tag": [ { "name": "1359593325", "colour": "#0C1016", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629902535, "uuid": "7ec2386f-4e4f-450b-aa41-3301a60306b2", "comment": "Malware payload (CobaltStrike)", "value": "cc0da2c701289df460bcb859a19888adeabd2225", "object_relation": "sha1", "Tag": [ { "name": "1359593325", "colour": "#0C1016", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629902535, "uuid": "f1e249ee-6508-4f7d-a356-36387d331915", "comment": "Malware payload (CobaltStrike)", "value": "90d9e6c82dd99c83715c6aaa9ffd95278774ebfa4abc479ef77e4d5e16f078f3296fd8a62ddc5702a8aad81cad7f114b", "object_relation": "sha3-384", "Tag": [ { "name": "1359593325", "colour": "#0C1016", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629902535, "uuid": "6636e551-d027-4c86-a851-b305e67cde85", "value": "T121740160E7EA6555F5F77731A93A07215B2E7D82A838F50C871042CE8A71AA5CDB0F33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629902535, "uuid": "148104e1-eafd-4dd2-9d6b-e5341ef13f4e", "value": "e218f655f036f569d7a87ccfa333d177", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629902535, "uuid": "c0786a57-5568-409d-a9c3-8253f7ef0ac4", "value": "6144:x61FoHY1j12PbimfGsE6m4FtWfAvpofL0tJ1PDi7wfaZwln/6kgUB9Z5Dr5kCvjL:Hcj12PGYEgvIE9Di7orlikjOCvjbD0vj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629902535, "uuid": "2120a2ec-e917-44b7-905e-8c9cbfd22be2", "value": 364544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629902535, "uuid": "c56fee58-4ec4-481a-a380-7c2ac78dcb9c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629902535, "uuid": "dedcc5db-e21c-4692-9f90-88d523e3d123", "value": "blm.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac2d5d4b-0567-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Glupteba)", "timestamp": 1629870337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629870337, "uuid": "bfaa7266-cb59-469b-af1d-e35437f612d0", "comment": "Malware payload (Glupteba)", "value": "0dee20e59eeefd2d90bbb14a40d7d3f4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629870337, "uuid": "09d9b88a-cb02-4eac-8996-dac8682cf41c", "comment": "Malware payload (Glupteba)", "value": "21a849c6d51e5ac4c0668e0140aea661cb8b7801e502fe08f08fcd7943075d81", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629870337, "uuid": "50c79e6f-2dd0-419f-9063-e6d8e4efefe3", "comment": "Malware payload (Glupteba)", "value": "ccab393833c0606d0d59838f3848085bfcfe4163", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629870337, "uuid": "5ca22cd0-a0d4-4dfe-a473-9a01a227c1b4", "comment": "Malware payload (Glupteba)", "value": "2b86cbb71ac523123ad442a644be55c3b18a24915979a969b59842a67fd9226a78a93e533be3b9e4eaabb964a2fb6287", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629870337, "uuid": "0a05f737-5daf-4b21-90a0-b2d0da84f43a", "value": "T121263320ABD0C420FAB6A8F8596E8669A43D79B16B7141CFD3F515FA06341F9FC32352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629870337, "uuid": "d21bf3f3-b58c-43d6-9b76-257e8cc97d66", "value": "b1f244737f482f7370a4248faac2bcb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629870337, "uuid": "f55a79c4-ac21-4f34-82a3-817e84cef22a", "value": "98304:6HXfOh7raFkrwk56xWaVwmKlhRFdWxqIYr+ynSgumGjuToHF6jsW6s:6vYLsy6DwhhLQMIYrDujwuE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629870337, "uuid": "bdc61414-3ffc-444f-aeb8-573f82648e48", "value": 4657664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629870337, "uuid": "150cca87-166b-43d4-9b0c-806c90d7abbb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629870337, "uuid": "db0a5f58-8458-45d7-bd38-687b04468393", "value": "0dee20e59eeefd2d90bbb14a40d7d3f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0599bcfb-0588-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1629884230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629884230, "uuid": "a94d7018-99d7-4772-82c4-61d13d20ac31", "comment": "Malware payload (NanoCore)", "value": "0d9cd3249a91a46f8c2b67f9476d0967", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629884230, "uuid": "65410600-b1b0-44f0-ab23-35ddf91c6ac3", "comment": "Malware payload (NanoCore)", "value": "21f9146e690dcee6812b44fa33ba898f893d0dcc613c67ce1c61bb747ed177c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629884230, "uuid": "51b9158a-669d-41e2-8184-03eaa6fffb5a", "comment": "Malware payload (NanoCore)", "value": "0a89b53d9628cd1deee8c1a3221ec99315a5fbbc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629884230, "uuid": "0f3f1104-5609-47c7-a1de-44d82fffd991", "comment": "Malware payload (NanoCore)", "value": "f56802f46d8e62cc71453b938ace6879471990dad946d7e19742a4ebc0c0d38b24d73cce0ad3f16ab02f6a9d735c9334", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629884230, "uuid": "d23f537c-0c3b-4d2c-8feb-35bbdc10d26c", "value": "T11224123CEB2B935ADB6A503E4A47421596305D69B3D105CB23537EC82331AC1F47BABB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629884230, "uuid": "bec6b5d7-78b9-4ca8-919e-21c398253eb3", "value": "439ff53323e9506db8654c0d8af9cf37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629884230, "uuid": "59a990e8-f70b-478c-af31-2ddef0145c5b", "value": "6144:6+dt03j2NsyLgfgnqNOn3vXE5G3EW570IbP1faFNfH:bd+j2NbFqY324XtbPJaFNH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629884230, "uuid": "e69c69d5-2b55-4c67-a848-f9a86fb35e76", "value": 221747, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629884230, "uuid": "b9efaa72-4677-4960-a44e-c34bbdd643d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629884230, "uuid": "c4daa81f-1196-4e95-b7a6-87d924e7b29b", "value": "BANCOS20212408.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "121abaf9-0565-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869219, "uuid": "fd9d3461-8d73-440b-9f29-055b99d33e5f", "comment": "Malware payload (Dridex)", "value": "c510940dd043a3b3d79ae1d9e87fcdfb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869219, "uuid": "91394871-dbf0-42f0-9dc0-76c0bf680a33", "comment": "Malware payload (Dridex)", "value": "225dfdef02b4056bee455131660624e873b51687956a7d564746dd597772fa27", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869219, "uuid": "60df215e-56f1-419d-859f-80ca8a0b798a", "comment": "Malware payload (Dridex)", "value": "41cfd203407e10dd4b6078f53a2f5178821d48a6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869219, "uuid": "1003b0ca-f29e-47ac-a45f-e1c3c0bb954f", "comment": "Malware payload (Dridex)", "value": "63a52770e6953bd4bd895ccba625afa34a8129bca3edac9b9cba70a3561716f5daef78fe0d35eef65ae8d297e0bcfe44", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869219, "uuid": "da937dba-291a-4b30-83b0-b4913928d61a", "value": "T1FAC3DFDA3526DA5CD43D027C25EFAFB73BB49F9403524706127CF94C6F224E7AA08269", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869219, "uuid": "de006664-d415-4a78-a0e2-6aab5e0d1829", "value": "3072:oUq+X1hpo5n1ja7SWV2uIi63LD6z2qoaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaD:oUdo5ndY/V2uh67Moaaaaaaaaaaaaaa9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869219, "uuid": "4cb5ab23-03ae-44e2-9b25-6a66e115e1e8", "value": 121170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869219, "uuid": "4d1f5c6d-3983-499e-95fb-8e4b974c23ea", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869219, "uuid": "245acc13-f942-49ce-9a42-11b403565893", "value": "Details-62128_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eae34855-0572-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629875166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629875166, "uuid": "08f8948a-f526-42bc-b62d-273503b91c66", "comment": "Malware payload (Loki)", "value": "f2c7ddb7849268f6050d36dc6805d2d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629875166, "uuid": "80258267-10e6-4b04-a7ee-9e1b8bcb3a6d", "comment": "Malware payload (Loki)", "value": "22e000371d0aa1f86f89fdab265d33fcbfbf4165e0365eed73d1bb2c1737f586", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629875166, "uuid": "4a9b7729-196e-4c68-8751-423573f16dd9", "comment": "Malware payload (Loki)", "value": "b77ca556f5ce2dd27c7b5086d156fad669be96b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629875166, "uuid": "a67fba17-f0ca-449b-8e7c-495f39b1e267", "comment": "Malware payload (Loki)", "value": "3c268b5dec9569bc419e9abd6970640d82e4e307da806b86da34312040375e2bd88cce8f608cb22b56714e5fa1a711d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629875166, "uuid": "4546a6fc-0ac5-4742-a2d7-dfb4e799252b", "value": "T121F4D43D1AF91637D1B5C365EBE58423F149985FB411AE6A6CDE03A7030BA8734C722E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629875166, "uuid": "d5e9e750-f84e-4a4e-9e44-affe256369cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629875166, "uuid": "4624802e-1650-4cba-a892-6c67fd1a3791", "value": "12288:+A1TGGFIdm0qhKGdRht1m7YVQeOQkzNvm2NXWheaBlA:+AZFIY02K08Y1r1eWH7A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629875166, "uuid": "d8eb1838-1aa5-4c9c-a63f-8578c59fd6d5", "value": 758272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629875166, "uuid": "4429eab1-a24f-4949-82f2-1cbdb337ad8b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629875166, "uuid": "faa72d96-4613-4f28-9b02-f3568f325c00", "value": "OC_H950172483.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab81a5d7-0564-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869047, "uuid": "11e628ce-f685-4875-b38f-d4052f9c8ace", "comment": "Malware payload (Dridex)", "value": "6c7a8b242f83acfc0ebf4ebc4a10f357", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869047, "uuid": "b8d970a2-bf87-41c9-9c5a-7fb525312c47", "comment": "Malware payload (Dridex)", "value": "22f9965daac610851cceab322a116a85f7325ff8fba869107e365fbf15ee10ae", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869047, "uuid": "16d3ea83-2571-4725-8d85-3e5da25f8e58", "comment": "Malware payload (Dridex)", "value": "3cdb6027fbafe8894f28e1a6394889e6089317a4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869047, "uuid": "eec5243b-9370-4f61-8582-477c41b070d0", "comment": "Malware payload (Dridex)", "value": "7745c4be0201d56171da34b62fd56fb47eb8b88861d8a7018deb8f7df3d939324edcc487d825e51b6b3f3ae36f7bca7c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869047, "uuid": "976cd694-4e0d-469c-87d0-e9f0b71795a5", "value": "T13684126C8665C81CC84F813F92EB4FB1DB616606B6C17B1F85B0E2186F07C3E4B6E599", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869047, "uuid": "30176e7a-bb88-498c-994d-94220bcb7a10", "value": "6144:oQxp+qCWHPlu6gJTwX2LohOGYw6CC5jTT453mjEIbWiGVAKSLFN+YInSCRvuPsxp:/lVHcPlnL2OGY/TTy2jEIJc6FNu3uPmp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869047, "uuid": "31fda40b-e795-42d3-97b4-2a59478a42ff", "value": 382822, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869047, "uuid": "07ee741c-423a-47ae-896f-e3654051a117", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869047, "uuid": "6047493c-809f-4f7b-9ef8-67a6cb045737", "value": "EoY_TAX_Document-7286114_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dee476f0-0578-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629877723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629877723, "uuid": "08737fe7-7665-46c3-9527-31b63f38fbe8", "comment": "Malware payload (AgentTesla)", "value": "7e51798b2099b3d4fa5aa09567036ff6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629877723, "uuid": "b726f031-26de-4102-a5e9-4414fe768c90", "comment": "Malware payload (AgentTesla)", "value": "23add7ace4e76093f438fa8df4de7af055f20a6fe89fbb6815b47f92df283aa1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629877723, "uuid": "64139123-987c-4f04-a3c5-339467a1dc0b", "comment": "Malware payload (AgentTesla)", "value": "ff384c8951bc5bab3bc2524cdf5752080b33a825", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629877723, "uuid": "f5918368-0c8d-45fd-a48b-309d41a1143f", "comment": "Malware payload (AgentTesla)", "value": "304e69ff69ddf8f4b518c7aa8414d33b1f9e189ef3304703b6593b87ddc13f1e4da152bedbb72f41437782923b1af084", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629877723, "uuid": "af2532ff-54f8-4de2-b2af-1b1ddc392caa", "value": "T1B926BFF876047DE6266F576BDA96ACDC03B616739ACBA4CC4064BBC305A3375EE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629877723, "uuid": "22d31610-7fda-45bd-b0a9-bb8755da9cab", "value": "24576:rBjwsXGr/I3CMAN2B48uxZQmklnOMEwKUq8LbYGh15usOdVZFv/z+1Zyp/u/y+wY:rBKc9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629877723, "uuid": "d441307b-18cd-4ba4-a706-f5f005946851", "value": 4811425, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629877723, "uuid": "af9dc30d-7c93-46e7-a0bc-c9b4bbcbbf21", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629877723, "uuid": "7f2f72e3-fb4a-470c-8fee-9f9aee3a60f7", "value": "PORe-Conform.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c2ceb66-056d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629872699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872699, "uuid": "c3968f8d-e32c-4e7a-9d17-678ad59dce9a", "comment": "Malware payload (Mirai)", "value": "590f9ab5a10f0dec374ae83d7c4353d0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872699, "uuid": "a574442a-ff77-4c11-ace8-1db931a03683", "comment": "Malware payload (Mirai)", "value": "23b5cf8d75da2dcaeac1a1273b484f194b997d8d84fde3567930348a55133795", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872699, "uuid": "14ddf65e-131e-499d-a24b-f10c9cc7ed37", "comment": "Malware payload (Mirai)", "value": "d7569c1629decc0fc07659d67de66aac155d3dd7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872699, "uuid": "76d36492-0bc2-4c4a-885d-1b23916bff3d", "comment": "Malware payload (Mirai)", "value": "4dc9491fa27e7f042b8840336865b7309f8c505dcb1da98d74e4da337bb91b1ea2a7c149b4e7d0ebd9942238c005b617", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629872699, "uuid": "6143f2f1-e44f-4e22-ba04-528c0b8916a8", "value": "T11533F141F19B8CA58F304D72642A8DA979C8E7FE907DAA9313405F9AACD314643BFC52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629872699, "uuid": "35963dd1-321a-40e7-9e85-89cbcf5e236c", "value": "768:+wMw2Ijkj6go0GcDKScWHXkmt6JC68LxImiC7p8YgcL5RUKxSRYHN/vd9q3UELl1:EVIwemGu5XkmSCZxIvwDT7HNgLf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629872699, "uuid": "c8804e07-7d01-4136-b62c-14ce1062de8b", "value": 51152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629872699, "uuid": "31548058-353c-4213-8342-168c3ddb1b28", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629872699, "uuid": "8a399554-9e03-479c-8d95-a99212d0f436", "value": "590f9ab5a10f0dec374ae83d7c4353d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9d0196a-05b5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629903941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629903941, "uuid": "43d423ca-9219-4065-8e62-50c395989f60", "comment": "Malware payload (Loki)", "value": "61d4b8cc54596921d5cbed6d4209377f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629903941, "uuid": "e8774888-4f5c-4c50-90ae-4b8063da026d", "comment": "Malware payload (Loki)", "value": "243dee23b179d34c88b6494be767a9cafcb36a57ffeef9f21ebbd463d1220b24", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629903941, "uuid": "bd6cb6ef-e6a0-4e44-9cee-239ffee19226", "comment": "Malware payload (Loki)", "value": "289f44709525eaa8e782b91e257b857d1a3f676f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629903941, "uuid": "c8039e9e-a02d-45b0-92ad-d512b7ed61d7", "comment": "Malware payload (Loki)", "value": "1475329e6c1ce0d94fe86078a23249919f2a0a4498dfd57e45f86ad9b6765cb62805eec3372e1dcec9b5ec76c9cb2575", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629903941, "uuid": "8dfa97e5-92e3-4905-a136-40332c7c444d", "value": "T1A13401F402ABC24CE66100714A4D7A3BA7BE2D83273840DFB4587A2995FD8F55FA711E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629903941, "uuid": "8ff7276e-bc68-4364-9e88-8b0d4fe26d56", "value": "439ff53323e9506db8654c0d8af9cf37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629903941, "uuid": "d7bf3b63-35bc-4206-9f98-4193799575a2", "value": "6144:EDZ5OoVH+VtU0vc/C4Fg2fY6bQVlhIt0yGHuBuRpY:CsoeUlT0bhu0uF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629903941, "uuid": "dd6c5de9-b031-4fad-8d03-b945b521cb71", "value": 232792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629903941, "uuid": "02f8cea1-8392-49d5-8a92-ce565e6aff1f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629903941, "uuid": "a95aa8e2-2f31-4360-b1da-aa1273ed34f1", "value": "61d4b8cc54596921d5cbed6d4209377f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85b44cdb-059b-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629892606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892606, "uuid": "badc43b8-ad07-470c-9a48-f372fd868f47", "comment": "Malware payload", "value": "9c31ab99d5a46da81c1bf7560cd9689b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892606, "uuid": "3ad17562-8d31-45c6-be78-6c26c8bb72e6", "comment": "Malware payload", "value": "24a70ff1e2e0d87ef1e98fd44d6729999cb45183733126e315fbd108707b1a36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892606, "uuid": "c4b6238a-4468-4420-92af-f1eed4509ea0", "comment": "Malware payload", "value": "8ea0156170faeed9779a7e03043c1c027e58724d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892606, "uuid": "e97dcfca-7a78-4026-b9dd-6ad88c26cf11", "comment": "Malware payload", "value": "73aae1e6f0ba01abd42c4f7d2b82db45283548d807c76d5adaf41aa8544a8ae44ec9e7f32162d1f7a09c9a3c36b97df0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892606, "uuid": "428b663b-eb7d-4310-acf2-7be52b23169d", "value": "T18D64AF20B6A0C139E0F711F4597DA7A8692D7DF06B2451C772D236EE96372E4EC30A87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892606, "uuid": "2a308ace-c0e5-47e2-94c8-4c4597cdce17", "value": "ad1c5bf15a899fcfef408e3485448e67", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892606, "uuid": "3f1748be-8e3a-485d-834b-78b455308365", "value": "6144:rTqJDRgmKXMsO5F7fW+8kLujlBN+lkwIgDCBHcCTL2clNp/27PzX:GDRgmQMsI7X8kLuJjQicC/28/27bX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629892606, "uuid": "3e125ad2-ebee-41ce-9fa1-0247ef5c7c7b", "value": 331264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629892606, "uuid": "b26fc807-7682-40aa-b164-ee9e34e4a12f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892606, "uuid": "0d96dc2c-bce6-43f9-86ea-90e724da5ee1", "value": "24a70ff1e2e0d87ef1e98fd44d6729999cb45183733126e315fbd108707b1a36", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9b3d6f2-05eb-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CoinMiner)", "timestamp": 1629927080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629927080, "uuid": "940b2760-afca-4b30-a792-d85040744dca", "comment": "Malware payload (CoinMiner)", "value": "ca8ed36764b826bde1321643b68f439f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629927080, "uuid": "ef18f92d-a8fc-4f56-b866-e011c9ecc57d", "comment": "Malware payload (CoinMiner)", "value": "24b35ddd2195133e968aeed816c92367a47413f58506138e75441446be1524de", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629927080, "uuid": "86a5efcb-79c8-4db1-8419-adcdfdec230f", "comment": "Malware payload (CoinMiner)", "value": "ffa4b9296d7d07ffc2eb1af8228d28f991c91b45", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629927080, "uuid": "b519dd32-ac68-48f3-8931-63a54fc21acc", "comment": "Malware payload (CoinMiner)", "value": "6bf3ca3f6b29bae3ecdb6b00758bcaaa5b4b7524a8c3a9e5140a5f6559ba8247a6e394cb66d883734ab5dd1b18bd0872", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629927080, "uuid": "b1d2e300-cc07-4c7f-b889-2e3a5dc8bfad", "value": "T173A533DD6756051ECEBC46355EA3D6CE15380DDCAA0E552D33B6EA5ECE3208808E72F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629927080, "uuid": "ea110d76-27b4-486b-b5fa-cfdadaee6aa4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629927080, "uuid": "53c262af-05cc-4735-b415-dd3aeb9d7d20", "value": "49152:VsMx5jlN8T8AEPiKaNpr6tfepn8bh4S4YFuLM9:OMb8T8AAaNYt2hAfL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629927080, "uuid": "faf0c280-7128-42e8-ad28-a58de8d97004", "value": 2187264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629927080, "uuid": "a16cf5dd-bfb3-4030-84bc-96e57cd88aa3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629927080, "uuid": "84368aa1-67c0-4bda-8897-55b807d402b1", "value": "ca8ed36764b826bde1321643b68f439f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a7b6606-0565-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869233, "uuid": "d9fb7f3a-1bb9-4140-bb8b-8432fcf9a0bb", "comment": "Malware payload (Dridex)", "value": "6aee35f7dc851e1c70ac7e4cfdb30317", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869233, "uuid": "7636a97e-5c2a-4928-958d-2a971008bd86", "comment": "Malware payload (Dridex)", "value": "24be2bb2ea0488e54bde52927a811188fd458168926e367ab11f67bef189252c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869233, "uuid": "0c950af8-698a-431e-9f4d-bc24c3777d37", "comment": "Malware payload (Dridex)", "value": "b499a932a14f808a8a1baa315230a77ad87890b9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869233, "uuid": "8ccd81a9-feda-4700-a6c7-9e0cfaf777ff", "comment": "Malware payload (Dridex)", "value": "6c737368b5fcb172b77743b64c35c9297b770f68277105aa4e69ac827de3ab01708cb5e24c91dc743e9fa47814e66a86", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869233, "uuid": "ef2b03df-c757-4b18-a901-4f593f95ba6a", "value": "T11B74122DC9B3D87ACE970CFF8C7814D153AB8633C19086DA88C571EC2E5217E465AAD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869233, "uuid": "a5dcdd06-1844-458a-ad58-b30681b24cda", "value": "6144:onPMuQvMXO/J6t/VYfASkKTzZYwPMPFde/Qxx2u+OA+NT5Aa:gEVvMX7ifASkKTzSwkPFduQx0uD+a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869233, "uuid": "6a0ad5f1-7426-46ef-8786-be1ca71a21aa", "value": 345531, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869233, "uuid": "aed6ef59-8817-4377-81e9-4682f8b653c2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869233, "uuid": "289e222a-ccba-4d4f-9286-2e4044cbf65e", "value": "Scan-417529_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09112947-0584-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ServHelper)", "timestamp": 1629882518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629882518, "uuid": "ad4fa94c-d3e0-472f-88f0-b434480040e1", "comment": "Malware payload (ServHelper)", "value": "aa60c9b3f5a92c74504875fbcf1bd773", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629882518, "uuid": "90fdc837-e4a6-4431-a0a9-c867f0e4eb50", "comment": "Malware payload (ServHelper)", "value": "255141a430ed2bbda653b5ab18acdd8dcca5a39cf8c2d1fa938445e31ecf38e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629882518, "uuid": "98fa3dca-9727-425c-9c2a-6446919e6f2b", "comment": "Malware payload (ServHelper)", "value": "57fa1ba882a2b1941cf27a8fbdceb7b369004cba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629882518, "uuid": "669929e0-640e-42e8-9aa9-8493b404e494", "comment": "Malware payload (ServHelper)", "value": "ebf5cadb1277b7327a881cceec3feffb9f698ee3abb7ac73f0462d29e119c6374765f1f7a0a31c3c5fab5481cdba2a50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629882518, "uuid": "783ccac7-bf71-4d6d-a629-0f86891a1d91", "value": "T16E56F117BC9464B9C9E9C232897592A23731B489073977C32F55A6BE2F777C40E393A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629882518, "uuid": "a8d1961e-b26b-4cf0-8509-d41b16375f94", "value": "c7269d59926fa4252270f407e4dab043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629882518, "uuid": "1b2eca61-996e-451c-8360-c94fe782c422", "value": "49152:AwptF+Srb/TkvO90dL3BmAFd4A64nsfJ9KB5ehpylOePliwQkCkGDIyKSh2KHl5+:AwNxKUmAQQQQQQQQQQQQQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629882518, "uuid": "2e0631ea-8223-41e1-8a58-74d3ba474d09", "value": 6203392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629882518, "uuid": "5de6b317-f753-46d5-b97c-535f234816be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629882518, "uuid": "fc61ed32-0079-4f7f-aa56-189c5f85036e", "value": "aa60c9b3f5a92c74504875fbcf1bd773", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebc79466-0564-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869155, "uuid": "2e887715-75dd-4128-93aa-c14402a7a35a", "comment": "Malware payload (Dridex)", "value": "d8251372d563adc146f9a79720c03a7b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869155, "uuid": "8e1913fc-4d5f-4751-a665-3d5d65930762", "comment": "Malware payload (Dridex)", "value": "25c3b793439f12d9240fb9d1d09dfed0122c74e3370d08d98a45a6302ba2906c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869155, "uuid": "ecbae297-64ec-4dfa-bd61-a6cc8fce90c9", "comment": "Malware payload (Dridex)", "value": "a048d146a5ea68985f35560e5f8e9da6cc329e2b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869155, "uuid": "d1cf43a8-f7cf-4bf6-997c-9449bc45e795", "comment": "Malware payload (Dridex)", "value": "da4dc432272475f82b020dc9cf8faa4d5a9d480b258fbc3e5370f6fddeb5e1dbf5d26164b98d52af4755715a9160c705", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869155, "uuid": "40362516-0344-42cb-9e50-cd06985327f4", "value": "T17EC3D0AA3526CD59C12E633C81DF5FB36BB98B5517B247062229F41C6F23AE3DF44218", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869155, "uuid": "7b5a772b-f1f2-42ee-aa96-c1c676d1d7b5", "value": "3072:oUIqcfRc2RFRRSxiEtZphmi8i63LD6z2qoaaaaaaaaaaaaaaaaaaaaaaaaaaaaaZ:oTfRfFODt67MoaaaaaaaaaaaaaaaaaaO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869155, "uuid": "fab157dc-bc20-44c9-b7ee-d286e68b7e64", "value": 118238, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869155, "uuid": "03aa3a3b-b2e0-4700-86ad-53485acd3159", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869155, "uuid": "12c06e59-313a-4634-b278-d15d34ac5f1a", "value": "Invoice-2965174900_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df1d1177-0566-11ec-8fa1-42010a9c0011", "comment": "Malware payload (TrickBot)", "timestamp": 1629869992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869992, "uuid": "3f60d49a-369b-41ea-9143-a5a99d63b7a8", "comment": "Malware payload (TrickBot)", "value": "0da24dd2fb861e8f4af863278e94f87c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "top119", "colour": "#8EB001", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869992, "uuid": "5f7e7901-cf1a-4676-a6eb-44a49edabfc3", "comment": "Malware payload (TrickBot)", "value": "2634add718388ef78f53bb550b64fc29266df01ea09c96823f0e47bc85260e40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "top119", "colour": "#8EB001", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869992, "uuid": "aa5be238-bb89-44aa-a60a-83ae9e831fed", "comment": "Malware payload (TrickBot)", "value": "b3bf6d9f0e29e53b1a1a998f2e82c7bfd67aeb50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "top119", "colour": "#8EB001", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869992, "uuid": "e3b6e7fd-5c2d-46f2-b39a-ae76c5a015cf", "comment": "Malware payload (TrickBot)", "value": "186575829f74224183ee34fea9840ded25bc4f6789b4ce79cecf9bd443a639046ff6deaecfc835092423989304076d23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "top119", "colour": "#8EB001", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869992, "uuid": "72393091-f128-481d-b2ad-e2bb6bf47ea8", "value": "T1680519D0634CCA7FD6C33130F3A61633D2538B4E1AAB919BEB58F59AA86E5467413307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869992, "uuid": "ef96d89c-6665-425d-918a-0bab3beb7861", "value": "884c251bdbb51e23564add248435ff5c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869992, "uuid": "34cd5b01-b51b-4a21-932b-8d549d106beb", "value": "12288:QFuLe4nHJm79H5L751MKd3GydYLMcOCWvnJi7:QFF4nHJoLZbnJc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869992, "uuid": "78e10099-c6fd-43dd-b758-3dbe5fd51268", "value": 839733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869992, "uuid": "8043d80a-5f33-4318-8ba8-72ed6d47d107", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869992, "uuid": "bc2b1216-4196-4c18-bf4f-ea7b11c03c89", "value": "0da24dd2fb861e8f4af863278e94f87c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae47dcb7-0564-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869052, "uuid": "2048d520-5b2d-4fa9-801b-a2dcd6420bf7", "comment": "Malware payload (Dridex)", "value": "e1a517cccb0156d9effac26d7a063524", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869052, "uuid": "2935c89a-ae3b-43f2-b152-2c08c77d0036", "comment": "Malware payload (Dridex)", "value": "2646e0b7f4010fc3f87c6f6823a50b8b3f3177e1c18510cac83768c8a3783ac2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869052, "uuid": "c8d8e99d-f390-4b66-b783-37a12f21918b", "comment": "Malware payload (Dridex)", "value": "81043b6907ee9579d4388fdb9bf9feca65b40f11", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869052, "uuid": "e5733f07-34df-4588-9b05-eb3025430b03", "comment": "Malware payload (Dridex)", "value": "3ac7a850e12a468be314a03704c1ad26c87e6f772985c66bb45431a903f566d454adc1df3b5b626ba87ec194bf9d3de3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869052, "uuid": "7a530aef-9d91-4369-93b6-89053e691852", "value": "T15CD3E1AE6236DE8DC028837D52FE1E7267B89B1152B245171278FC386F634EBDF44209", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869052, "uuid": "0cb9e216-e976-4c65-ae8b-4c9b9233d59b", "value": "3072:oU1cNMFiqNQctE7/GBrCCni63LD6z2qoaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaah:oi+cbQc6/GBGCi67Moaaaaaaaaaaaaaf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869052, "uuid": "4a3f7c01-2aa8-4230-8079-c4896e5397e2", "value": 141260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869052, "uuid": "78512ec8-3573-4ab8-9d48-fea95ba29aaf", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869052, "uuid": "e7c5137e-273c-4697-9b14-b8dbecb9e39a", "value": "Scan-2348_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acfaaa70-0564-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869049, "uuid": "d08bbed7-d159-4324-9d77-579c6c001d01", "comment": "Malware payload (Dridex)", "value": "899faf739088c467107ed0b2fbf370ec", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869049, "uuid": "f8af9c81-c976-4770-b49a-a41db845deb5", "comment": "Malware payload (Dridex)", "value": "2704310ba04a4bc97a519782afc926079e9e588a7ea0829436e00aa9c2d20c23", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869049, "uuid": "8bca95f9-30b1-472b-8864-1fbbf6460cec", "comment": "Malware payload (Dridex)", "value": "f7d3c6a5b2cf14c7d018c4e8ed64d24d1629f33c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869049, "uuid": "1bfabaeb-c78e-4a9d-9631-dd1d036671ba", "comment": "Malware payload (Dridex)", "value": "647557dcb886078a9d71338ac175ad39f2e4f5095395c5ee3c815fa19901080b9ecbceb0b3a11dde193a88f006b07495", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869049, "uuid": "8024c8cb-d616-4771-831b-50650f87cf5a", "value": "T19784126896B2CC1CC48F413E51E74F72D7B12602F6D17B1FA1B1A21D6B0387E4AAB19D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869049, "uuid": "a7eafaa4-2b7c-4511-9aab-780ed0d0d35d", "value": "6144:oe1a/NTNBgy+ZQ2LohOGYw6CC5jTT453mjEIbWiGVAKSLFN+YInSCRvuPsxNe:v1a/PuNL2OGY/TTy2jEIJc6FNu3uPmNe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869049, "uuid": "a6e0f365-9fa2-42e0-8625-00929816cf59", "value": 377765, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869049, "uuid": "714869f3-ab05-4f0b-946a-03b360cdbff6", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869049, "uuid": "d1d06066-7d7c-4e8c-949a-4e387ce7586c", "value": "EoY_TAX_Export-9558580_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6d09caf-0576-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629876904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629876904, "uuid": "3360877e-a0bd-4265-aca6-1286fdd9ab1e", "comment": "Malware payload (Formbook)", "value": "9252f18e3fc6023d7b7bd67f094bce01", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629876904, "uuid": "ecf12d0a-a22e-43a0-a957-273b8a858fbe", "comment": "Malware payload (Formbook)", "value": "273f8137fbe63ffef8f64fa9efad27fac451ffec71edaf1a4a7769a277a2379f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629876904, "uuid": "2bc119d6-aa49-45b5-b450-997cbe972a0a", "comment": "Malware payload (Formbook)", "value": "4c9a04c321089590ae4c9877aa8ad049c7318bf0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629876904, "uuid": "9576f587-f640-4385-a1bc-32be2edfaa13", "comment": "Malware payload (Formbook)", "value": "68f6069ccdf86d12d496aee49bad95a16d14856c5ff0ade9e0f34ce4d99df876a75401128b53ebc5e6091cc84cbe0fb0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629876904, "uuid": "0918d284-2aa2-45a9-a99d-7d063b6dd961", "value": "T1723413120709C41AC445EBB278C75AE07D063E90974466F76AA779CCB477BC72932BE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629876904, "uuid": "9316d06b-b3ad-4cf9-a66e-9f58578217af", "value": "439ff53323e9506db8654c0d8af9cf37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629876904, "uuid": "33784a34-a844-44a0-b71f-e469d2ea49fe", "value": "6144:b0a3LC+PRKGdhbaMtVtjIIBmZBnWD3Wzvy85hlPCWnl5la0TJ:TLRIGCMnmIBmcQvYq1J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629876904, "uuid": "d221b1ab-bd2a-4e6d-a4df-755a0742e6fe", "value": 232412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629876904, "uuid": "df5d6ec5-b2d0-4f24-94a8-15e37e3276eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629876904, "uuid": "cb163ab1-d467-4c9a-bd53-bb87a1175985", "value": "9252f18e3fc6023d7b7bd67f094bce01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1679d341-0565-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869226, "uuid": "64510390-fb4a-485e-bb9d-1a632fb2bb03", "comment": "Malware payload (Dridex)", "value": "bf3b6215c6671e4074df687964db7043", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869226, "uuid": "29b68e59-1fd8-4ada-8c0e-0d11a2b36932", "comment": "Malware payload (Dridex)", "value": "28dfcb4fedf6a37bd0fde6db10a1332a4d6c71a28a07ef36f5fd388ebb11c816", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869226, "uuid": "c2821f47-cc3a-4d65-bbf0-0680ae7b8227", "comment": "Malware payload (Dridex)", "value": "41f9b039883f9b44978f1b7e5a7fa0620a8718a7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869226, "uuid": "bb36db91-110f-473b-b532-f50f5b3315d3", "comment": "Malware payload (Dridex)", "value": "59699ccb42f5fccde5ab379bcbfa632796f30127db58ca3966c1d89662c31736cb3a42c3a787b58fdaee28476ca8c5d8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869226, "uuid": "a4351c12-544b-4756-9e46-aa8198b55f3d", "value": "T18E641219C5B3D57ADE870CFF4DB814E2A3E78A33C18189C588D571AC1F6217A0299EDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869226, "uuid": "ae6fd417-ebe9-4088-b60a-3db1c03507cc", "value": "6144:oAIYdDaSJmk6NXO/J6t/VYfASkKTzZYwPMPFde/Qxx2u+OA+NT5A7:6+aSJwX7ifASkKTzSwkPFduQx0uD+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869226, "uuid": "1bad1c5f-c5e3-4483-a974-95972e32baff", "value": 320571, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869226, "uuid": "6351b6b6-2772-4504-998c-2b838e48d1e8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869226, "uuid": "46231c71-9012-485b-add0-ad83e3c1dae8", "value": "Invoice-7396_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6be9ece4-058e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629886979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629886979, "uuid": "a22d297d-8bc7-41ab-b07a-1e6ab161ca2f", "comment": "Malware payload (AgentTesla)", "value": "4340dd05fa435e96369c882d3cea2587", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629886979, "uuid": "52308b59-dafa-4aaf-b5f5-86067f16f5cf", "comment": "Malware payload (AgentTesla)", "value": "29a8a708880ca187202112de47bed915bf9fd0e64cab0d08a839b7ede6c16506", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629886979, "uuid": "800e3ce3-875d-46a5-85c0-308b550aa4e3", "comment": "Malware payload (AgentTesla)", "value": "de3f2ad93c4274e4473562a1886b3dd431d23432", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629886979, "uuid": "7f493d4c-7c87-4a38-85be-eb6a18cbefc3", "comment": "Malware payload (AgentTesla)", "value": "f30c125fd1ae2825e498073dcd7cd1e604610241b514a540aaa078a389ab4348883a78d9293ee0543578d6186c33f49b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629886979, "uuid": "cd07b4b1-d62f-45dd-8f34-9f2333e5fcb7", "value": "T11A941266B98CCC5BF716B3345092D729363AEE114C568BC8F1A4BF6FBC712453881CA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629886979, "uuid": "2f21356b-fb14-413d-aa79-0e9544c956bc", "value": "ef471c0edf1877cd5a881a6a8bf647b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629886979, "uuid": "250f3bc8-adce-477b-8b8d-0cda4ab1ab21", "value": "12288:VXe9PPlowWX0t6mOQwg1Qd15CcYk0We1KI:chloDX0XOf4EI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629886979, "uuid": "979a0283-6812-43ca-9586-db5fd6365d84", "value": 420864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629886979, "uuid": "2bf0f9cc-ab46-43f3-b993-79c29526e64d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629886979, "uuid": "146b7941-9645-420c-af89-9e71f88c867a", "value": "chii.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f677e78-058d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629886636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629886636, "uuid": "0471495f-d3f6-410c-985e-83370349ebab", "comment": "Malware payload (Formbook)", "value": "f4689766d507f4eb2f206cf8ea3e237d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629886636, "uuid": "f959339b-4954-49b5-b0f9-bb151121ce44", "comment": "Malware payload (Formbook)", "value": "2ab54e46be8e8a1b7e66be9bed5492e2cb5c4112e548442e209954affc2dc374", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629886636, "uuid": "7b726bca-dc31-46be-a234-7b2965e8993f", "comment": "Malware payload (Formbook)", "value": "d85b7cf1d1544fb02c50f0ae8fdf24e85adb86b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629886636, "uuid": "a2a5cb8b-cd65-438c-a7f7-eb931baa2081", "comment": "Malware payload (Formbook)", "value": "413d5ca6ac1f0aad2a40ca993464ec752a9d474e4afe38c3def17d096401b9746890d3c7c8b4a67481889780f0ebbfae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629886636, "uuid": "1cf40694-48f3-4bd1-943e-265d56a41f9f", "value": "T10F34127E54A709B8DE28003306FFCBF87A50AC39C3A42AEE90D57215ADB1AE77047755", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629886636, "uuid": "464ca577-bf47-4888-90d0-a4c3bcccc0a9", "value": "35807dcde258f88fa3ce5c21adc607fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629886636, "uuid": "35856b1e-de32-49df-80a9-1aea79d06087", "value": "6144:JwX/EDsssssssssssssvxx02JKflFxLav6qGJyogGzssG5O5POJKf:J4/EDsssssssssssssJ7YtF9eGO6ssGa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629886636, "uuid": "9cac3a4c-62ae-4f79-a786-6cab68f63f4f", "value": 235130, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629886636, "uuid": "498cc9e8-d359-4e66-95b9-6fbd477b1b36", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629886636, "uuid": "43ddc47d-2438-43e8-9fd0-99db6621b55f", "value": "SecuriteInfo.com.Trojan.PWS.Stealer.23680.7194.31659", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8ab4313-0564-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869096, "uuid": "acb820f2-468b-4332-b258-7d0fd602cbdb", "comment": "Malware payload (Dridex)", "value": "aec46d8da7a1c5e06d6ceadb8691dbe3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869096, "uuid": "1a55503d-04e7-4adf-8dca-984145f6538f", "comment": "Malware payload (Dridex)", "value": "2b1206d427d4676f608ce841f7e847fd9949ab8457d66a3071e9408321e86434", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869096, "uuid": "f8ad7b16-169d-4ab8-91de-f57fd5541b00", "comment": "Malware payload (Dridex)", "value": "477a896c207c3b1ebc866f9862aa481bcf8c001c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869096, "uuid": "cf2d6639-7fcd-48c2-a77c-de699a4d7196", "comment": "Malware payload (Dridex)", "value": "d4679adaef145006e0ae0fa9b038de29c652f255404e020fe5d166fb86f444090a2a21437c87fd332f3b454f923b58fb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869096, "uuid": "f3f79d32-0b74-4bad-a5fe-2748f73bd032", "value": "T184C3DFAA7572CB48C03D437D1AEF0EF62BF49B8116A29B1A522CE55C5F225F7DF40128", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869096, "uuid": "2033b326-b228-42b4-ba5d-2ddcb3402df7", "value": "3072:oUanAhD3TysKYZM8i63LD6z2qoaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa3RY3/:oDAh3PKYo67Moaaaaaaaaaaaaaaaaaal", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869096, "uuid": "b3c087fb-85bc-4d5d-80b1-03d367cfb3a6", "value": 119359, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869096, "uuid": "74a03160-6311-42a3-a1f9-c030f1687ee5", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869096, "uuid": "1dbb21ed-3064-45cc-b540-3f41e38d99d4", "value": "Scan-4176799655_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccadb663-0585-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629883276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629883276, "uuid": "b735deda-c66e-451f-b31c-390cb8793573", "comment": "Malware payload (RaccoonStealer)", "value": "2839552af0239f311dd533af4b3ab41c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629883276, "uuid": "b9720315-5659-473f-8ad8-c7a60fe15446", "comment": "Malware payload (RaccoonStealer)", "value": "2c5e072991f8a964fa681278f0fb3370d4908b0b7ee945eccf88ee6224f3ffe3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629883276, "uuid": "14180a76-f5cf-49cf-8b1f-1af1f4b2122d", "comment": "Malware payload (RaccoonStealer)", "value": "c7c790db73cda7157dd1f1ddf426320b8ae6319d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629883276, "uuid": "cac02d7f-672e-4a38-83db-5ac0f93d6f4f", "comment": "Malware payload (RaccoonStealer)", "value": "8bccc632ada3b8789bfd458e724eb9a2d22a4131ad307127b4c266e65559d4581a71e8f3ad258dcd57916db2a6de3634", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629883276, "uuid": "f5e57b39-5e6c-46cf-b2a9-e726319b62ea", "value": "T18DB4D030AA91C034F4B312F859BA83ADB53E7AB16B7450CB53D526ED46346E8EC3174B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629883276, "uuid": "5e30f668-5a12-4467-abe2-b669be1d61c3", "value": "35372ade599ee63db174ac99307517b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629883276, "uuid": "2cf846bc-3cd8-42e1-bf23-659e8d68a504", "value": "12288:5bugfC3NKMvHaAtHgZ255SRIGkjHOEpjx:rfC8a+25NT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629883276, "uuid": "4379aeb2-3017-4aad-998d-8b84fce53724", "value": 533504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629883276, "uuid": "aa7e9ba2-9f33-45cf-b14b-365101083bf6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629883276, "uuid": "71ff2d05-1a03-4d1f-9deb-dc0aa06591a2", "value": "2839552af0239f311dd533af4b3ab41c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c486e691-05cf-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1629915045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629915045, "uuid": "343d2be1-0760-488e-a97c-f1accd3a9495", "comment": "Malware payload (Smoke Loader)", "value": "0aff9c5e774ab054fe3d75a025022946", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629915045, "uuid": "a988a628-4534-4214-8fd9-c4d2fe2ac846", "comment": "Malware payload (Smoke Loader)", "value": "2c835a908ce2e7c313393fe2689a36f087794f35583766076a0e3d842b01aee8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629915045, "uuid": "db43ffda-0c64-4ed1-a9fd-6ed9fe156ad8", "comment": "Malware payload (Smoke Loader)", "value": "2686eea24d393796fd6d9b95be9363face6454bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629915045, "uuid": "2995cf62-6fba-47f3-98a2-c2885f478834", "comment": "Malware payload (Smoke Loader)", "value": "7eff8e4dbc77df817974ca8908ae381f25a3a00213dbfe3b89814a7e921e1b8dbc67778a3e6d4aa68b95f79c4f78d054", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629915045, "uuid": "40445995-15fc-45d4-954c-542f604af3ec", "value": "T13F548D30AA91C035F5B212F855B683BCB93A7AB16B3450CF53D526EE06346E5EC30B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629915045, "uuid": "3ec4d85c-08de-42df-879e-e96e1649a0f2", "value": "1d03ad9b9e9a9068c266e5f5e715b4b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629915045, "uuid": "c247d493-56a4-4652-aab5-b8b36a3c9174", "value": "6144:6iU4PGC3yFFaL80QV7j4xKTmVtpsbiVM:aTC3yfa2V7j4Em5sGa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629915045, "uuid": "78b872e8-1587-4ecf-8b2f-faee64a1b99b", "value": 279040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629915045, "uuid": "96ac3ae9-4547-4780-861c-0f72b1dd696b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629915045, "uuid": "63cdfb73-a2be-4f15-a8dc-d757b8eee01f", "value": "0aff9c5e774ab054fe3d75a025022946.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ad8e3f8-05f2-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629929873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629929873, "uuid": "8bff8017-2c6c-40ef-9380-53b315c2514e", "comment": "Malware payload", "value": "74f2a577ff603134382ff997f61c4ab3", "object_relation": "md5", "Tag": [ { "name": "Beacon", "colour": "#3CE751", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629929873, "uuid": "1b96ee29-be61-406b-9060-044c529af4dc", "comment": "Malware payload", "value": "2d3df290ce089705fa77ab9a6d7ec4ef491aa83f087040b4e1ef41785931e7f5", "object_relation": "sha256", "Tag": [ { "name": "Beacon", "colour": "#3CE751", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629929873, "uuid": "4e408fe4-acba-46b0-b6e3-b96069a04567", "comment": "Malware payload", "value": "cd49688fa20d98a91cfb0ccd4032965664073016", "object_relation": "sha1", "Tag": [ { "name": "Beacon", "colour": "#3CE751", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629929873, "uuid": "ae2b0a08-2507-42b3-b373-024790a79651", "comment": "Malware payload", "value": "5df1769f1272e81e9715ce6bb39e5d03a4e60bb7d3da598a39d30853b72ba2ab1b30689821471d2f6adbb44e03101415", "object_relation": "sha3-384", "Tag": [ { "name": "Beacon", "colour": "#3CE751", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629929873, "uuid": "355bc05b-5368-43d7-8468-0354da7d2edc", "value": "T13614E0E02C25DD452AF3D0B7DC2F50BE7F19D74CEF16AAA5940CB06E4AF580B1B88A54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629929873, "uuid": "69531ea8-f84f-4647-84a4-56ae5e72f91a", "value": "6144:ve8ao6Zjm5W96ZoCyCZHj0SEGvgGvWxNhoHhy:vvcjIuCyC5IbTxNhShy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629929873, "uuid": "051143fb-0cd0-4897-ab9c-147beb8cafd9", "value": 208448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629929873, "uuid": "0170cc58-dc50-47d1-bb64-b146ce3feb69", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629929873, "uuid": "8997db19-b5c3-4aef-9d31-e5833a3836df", "value": "x86_beacon", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15125449-0565-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869224, "uuid": "e76836ba-2be0-41f9-8b5d-8c664c83148d", "comment": "Malware payload (Dridex)", "value": "619042eb733c261e0a05d72cb8fd472e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869224, "uuid": "e1a34126-1b09-4e40-897f-df6ca6b82e49", "comment": "Malware payload (Dridex)", "value": "2dbe63d884a8824086009ae22311d1e8a2e51079b51599ee5d56e5b6c3f337e0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869224, "uuid": "e4fca351-ef51-4be9-9c1b-cecaf06afdf0", "comment": "Malware payload (Dridex)", "value": "6d0995f4b9881f56d5f5e28d71cc9ff0b41e054e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869224, "uuid": "47a8d18c-ff98-4c5d-b6f3-691f31cf3ea8", "comment": "Malware payload (Dridex)", "value": "d9ad52871f1a54b692474ac4f0276d0cc402ae6075447c17bb7b1110b5226b3ca1c2767b55e05c06c320609e32ffad1d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869224, "uuid": "ee99c503-5dc8-48d0-8740-7dd2a75cc8d2", "value": "T174D3D0EB7526D98DC129923C40FF6E775BB89B4166A24327236CF42C2F534EBDB44218", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869224, "uuid": "e4b366b7-f5aa-4568-9a14-17d0bb88fbea", "value": "3072:oUtDtwX5C60XGR3DJ70r11CTCSCIYWwyi63LD6z2qoaaaaaaaaaaaaaaaaaaaaaT:ogwJC602RTJ70ZQTdeD67MoaaaaaaaaM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869224, "uuid": "00dc0131-a227-4112-a1ae-bdadd7a94dca", "value": 139128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869224, "uuid": "3d5180a9-95af-4369-96ef-1a8a6c6a0aea", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869224, "uuid": "47dd1aac-684c-41ae-80da-4283420988b8", "value": "Scan-9780_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "347bd4b7-0543-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ZLoader)", "timestamp": 1629854674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629854674, "uuid": "f991d619-8d8b-4526-8807-bd99d642505c", "comment": "Malware payload (ZLoader)", "value": "ec52b067ed8964ce618c74bd0d313887", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Malsmoke", "colour": "#F9A941", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629854674, "uuid": "267d5636-670f-4b37-81d6-e02791649e04", "comment": "Malware payload (ZLoader)", "value": "2de2a7fcfec9bc215dff22c89320b5467ce640c885c125fefed6a4884349b4e8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Malsmoke", "colour": "#F9A941", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629854674, "uuid": "a55df2c1-4f58-4853-af88-4dbc87240afe", "comment": "Malware payload (ZLoader)", "value": "efaad278aeb7f0d9ad17cd3d0e05472eb6a0185c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Malsmoke", "colour": "#F9A941", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629854674, "uuid": "66a3610b-0d8f-4035-9166-6d72f90a912b", "comment": "Malware payload (ZLoader)", "value": "e5e51b09800bd9ad586777032cef59760c0560a2d5fc3c454365064f72ebdf6283f017f1a9a656a7c28b1cc235622c42", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Malsmoke", "colour": "#F9A941", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629854674, "uuid": "eca9a35d-c0f8-460b-bbc5-b2758fce1b87", "value": "T131F30191557483EBF09254F9ABA20E51823D8F714315806FCDAEBEAC27F78D4A0126F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629854674, "uuid": "bee0a4a5-3d8a-4e07-a76d-c9a6065f3ee9", "value": "6e35f627be0dfa00368e9a9c687701df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629854674, "uuid": "e6290453-7be9-4578-8539-d947ef0c0413", "value": "3072:rOnpcT8o9jCNF+5dloZto7aiN7HiZ3TbemaGg2iN3sOwc3jI:ryWT7j/d4tgliZjamincOwcz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629854674, "uuid": "ab5a852b-1eb9-4264-8217-1db8121eff65", "value": 162816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629854674, "uuid": "7ec21b15-33d4-4dec-be37-491bf02092c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629854674, "uuid": "856793ea-f3b1-4911-8eee-f7eea2a6c580", "value": "tim.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b02a0f1-05d0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1629915163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629915163, "uuid": "d490026b-9f16-47bd-841b-15159ff37329", "comment": "Malware payload (Smoke Loader)", "value": "c2b79f67176c24ccdccf2572812949c2", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629915163, "uuid": "c2b30404-7820-4f07-b92b-d71fad34fe63", "comment": "Malware payload (Smoke Loader)", "value": "2e2c3b22a461a389674c11303509a42746fd20a8c91b3e468bee71f28500f7c6", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629915163, "uuid": "c533b135-1b0b-426d-ae06-d2e9799a3d36", "comment": "Malware payload (Smoke Loader)", "value": "5fd3e2a20b5dc790ab748dbd41131defdec13ca9", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629915163, "uuid": "720d2a67-4f3e-4228-8ed9-f60d591f3726", "comment": "Malware payload (Smoke Loader)", "value": "76666f0f5d6aa24fc3937259cc7252a0a14b51eccd1a901454171956d7c9e83efae3bad0d184bf3f499a3eb8870482ec", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629915163, "uuid": "2fbc8810-3842-4d55-a755-d5d711cb7a9b", "value": "T10C449C30AA91C035F5F252F855BA83BCA53A7AB16B3450CF53E126EE06346E5EC30B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629915163, "uuid": "217fc346-cdd6-4265-8fa6-de7333b5b686", "value": "1d03ad9b9e9a9068c266e5f5e715b4b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629915163, "uuid": "26a09d81-f02c-4cd2-9611-f6fe0406f3ae", "value": "6144:vtO4bGUx6mXZy0GYs82f5fmNoT67iKy7Xf:ELUx6CZqYs82BmKu3y7Xf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629915163, "uuid": "652342d6-11d6-490b-a726-869ddbba29b7", "value": 278528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629915163, "uuid": "7b74180f-2e82-4578-8f11-7df702d207f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629915163, "uuid": "e3003cc9-e22d-43b0-9b84-f565e3254b67", "value": "c2b79f67176c24ccdccf2572812949c2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d08f0491-05ab-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1629899603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629899603, "uuid": "f626e0c3-dce5-47c1-9b7c-ab5a3ccc3f9c", "comment": "Malware payload (SnakeKeylogger)", "value": "fa8f303de71f03f604ae542ee85e74d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629899603, "uuid": "ea765089-5ac2-4a6c-b0c8-4d291ec0aaa9", "comment": "Malware payload (SnakeKeylogger)", "value": "2e8f6a93437ca35d664074db818fe342c7ba0aeb167d2b4a0d25b5bdc9e41e9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629899603, "uuid": "3dc34910-a01a-461b-ac13-c2ff4060244a", "comment": "Malware payload (SnakeKeylogger)", "value": "8e581a8b4908dcb992d534a9ad90839eb5cf1590", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629899603, "uuid": "7b374d55-9f55-4232-bbd0-5187009320b3", "comment": "Malware payload (SnakeKeylogger)", "value": "de7e2ceda3b7f74be7d864c88a6086d4127d3c4d746ace8cec4a291037c413037f44507beb98b211b24733d42faa3f9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629899603, "uuid": "a6bb81c4-f5a9-4598-84c7-d10019c3511c", "value": "T16984029AA15A75F0C5BB0F71DB35EE00453ABCD44CAAF60E3511B0932AB70D13261BEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629899603, "uuid": "07142b99-1857-4b39-a4a0-9609d69fcd1d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629899603, "uuid": "32202d39-74ea-45c6-a57e-1b1a5827c99f", "value": "6144:Q3xtvJ/xa/c5d/hgQ8u3FWb6LcCPn+A2BL1uhqJq8zTjMjbVrq8IRJh0:AjFxVZhHQ6JPOBL1uhqNzfMonXh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629899603, "uuid": "ce4bf9ec-c772-4236-8ddf-868a0b0c2247", "value": 372224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629899603, "uuid": "7c043f98-fbdc-4bb2-8e8d-c9214f9a9a17", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629899603, "uuid": "2b55f095-3a82-4d35-af56-4c1191a1e2d0", "value": "Remittance Form Payu.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3a2a062-059e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629894079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629894079, "uuid": "f32a07a6-3367-4bb8-8a7f-e1cf6e8b1920", "comment": "Malware payload (Loki)", "value": "4a8b287eb2eebfbd1760621d5d22c216", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629894079, "uuid": "463cad02-4e0e-4e19-bd07-9a680765b89f", "comment": "Malware payload (Loki)", "value": "310865fb85de92745ce769785539d1196ec72f62810b42a12942b1997be69016", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629894079, "uuid": "8c75ca86-195d-4744-85d5-a9af92742e72", "comment": "Malware payload (Loki)", "value": "cf95a44eaeb2e1512a0ea67bb1b95045ed057efd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629894079, "uuid": "e38b2c0e-fb86-49b3-9251-7296bea81fc8", "comment": "Malware payload (Loki)", "value": "2568de33e48e06ca81f0168e2d6f301abf047831491992f870558a75f93e5d6aa5626eebb890d40302b2acf24407b959", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629894079, "uuid": "d9d82edd-7aa0-4205-8bcd-80ddacf230c1", "value": "T1E8057C7063C9C284EC1A8FF0167CFB9002F275E7B6C4CD6A16DA714CCE5A9D12A1769B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629894079, "uuid": "20a7b15c-ed24-4d9d-95f2-f7700ac12901", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629894079, "uuid": "7609671a-def1-4b57-99f1-8288d8a07d08", "value": "12288:N9csGI/cfxl+Gjr4ZjMSZeZZeiG+T5BDaZSa2/Ok8Miml6HnqwHdH2EObbUi:NAD+GH4HZeZIiGjZSaJj0AqwHh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629894079, "uuid": "56c79f8d-b994-462f-bf28-b318a6ceba29", "value": 872448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629894079, "uuid": "012b8641-558f-41c5-9f1e-85cff1a33a32", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629894079, "uuid": "bb530b7a-dc74-4243-868b-157470077326", "value": "AssemblyNa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "240ca91e-0565-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869249, "uuid": "538a75ca-7b94-4161-a53f-82cd33862f5b", "comment": "Malware payload (Dridex)", "value": "e6e19f59f414cfe3c767ce6e2dfc2497", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869249, "uuid": "7272fff7-cb9c-45a6-a485-42aefa1c2d06", "comment": "Malware payload (Dridex)", "value": "316e19fe0222dfaaffb7acc37c7df2944258d7851ccbb32ecc6c7b1ad9623689", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869249, "uuid": "b264db72-81a5-47f0-8335-3f0d6a80b769", "comment": "Malware payload (Dridex)", "value": "dbf6874ed2f70e609aff455d417a67d7e77251cc", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869249, "uuid": "f0e3ae55-36e9-4751-b888-026c6d0c1fa4", "comment": "Malware payload (Dridex)", "value": "9fb6cbd82cdf0457ae013152a2295f82050b2a19920059161ba7c01b93f3360a1233cb6e25b8471cc33b6b74ec56ae94", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869249, "uuid": "13805f70-65a4-4d11-8c2a-6c9167fd689a", "value": "T19474133892F0C80CD90E413F61D70FB1E7736A46A6827F1ED6B1B3195B03A7D8B96199", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869249, "uuid": "89352232-75eb-4f5a-aea6-7cdc2fb0a956", "value": "6144:oHuVON2hK32LohOGYw6CC5jTT453mjEIbWiGVAKSLFN+YInSCRvuPsxNe:WUON2htL2OGY/TTy2jEIJc6FNu3uPmNe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869249, "uuid": "b3df6b69-ea77-43b6-9163-eeafff26d7a9", "value": 365975, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869249, "uuid": "b1928260-794b-4269-9f47-9adbfe78283d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869249, "uuid": "9554ac6d-aef7-4e2c-aab5-5dfe78e8e38e", "value": "EoY_TAX_Notificaion-764656742_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56db9fbb-05b5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CobaltStrike)", "timestamp": 1629903694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629903694, "uuid": "f875d7b1-ff29-4818-854c-68d62aca22d9", "comment": "Malware payload (CobaltStrike)", "value": "f22083e11a7c34c3ddd3726f65fb3939", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629903694, "uuid": "c17026e9-a48a-483d-89f4-bad4d7867b9f", "comment": "Malware payload (CobaltStrike)", "value": "316f938abb63266eb410087f7f4b20e987cb9a8be1e385e95c420d96c9ac6f76", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629903694, "uuid": "ece69065-3961-443c-b05e-4b41b56eae66", "comment": "Malware payload (CobaltStrike)", "value": "1d529d5f0e330f5fc485699f3bc67c918619da67", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629903694, "uuid": "988f4ffa-8fee-4a93-bb5e-6746184b8386", "comment": "Malware payload (CobaltStrike)", "value": "3510f7731a363058e5180d11131137f35e2cd94d376b4099ffcaf342674423855c8e3ead13827c6bad9f83f441a433b0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629903694, "uuid": "1a692bec-0d70-4b8d-afd1-d1437efec79b", "value": "T1B3740160EBEA6555F5F77731A93A0721572E7D82A838F50C871042CE8A71AA5CDB0F33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629903694, "uuid": "77403457-5b94-4773-a6be-ac653cfcc7c6", "value": "e218f655f036f569d7a87ccfa333d177", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629903694, "uuid": "a11def6e-64cc-44cb-befc-11d79af7fe3c", "value": "6144:/61FoHY1j12PbimfGsE6m4FtWfAvpofL0tJ1PDi7wfaZwln/6kgUB9Z5Dr5kCvjb:Zcj12PGYEgvIE9Di7orlikjOCvjbD0vT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629903694, "uuid": "3961d3f5-9385-4dad-a879-eb4f1259e8a6", "value": 364544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629903694, "uuid": "d21f2c6c-508a-490f-a8ff-8d2941c7628b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629903694, "uuid": "1bb22168-1779-49a0-b60e-e26da36549d6", "value": "f22083e11a7c34c3ddd3726f65fb3939", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09d2c7ad-05f2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629929764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629929764, "uuid": "a7fcfe6f-b959-4c09-8059-acbc47843e3d", "comment": "Malware payload (RaccoonStealer)", "value": "56d9fc73f8c68a338727a732f28d6385", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629929764, "uuid": "25e9ffe0-e195-440b-85d3-2dcd9602a3d0", "comment": "Malware payload (RaccoonStealer)", "value": "31b79299519390edb96a85ce119c8e78dd4f5e5cd1a0d111553a89d4d974059f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629929764, "uuid": "6f0a035b-50dc-4751-916c-b44b13b94bec", "comment": "Malware payload (RaccoonStealer)", "value": "3b563b5cb77c1cb4fa04b6120987b7bc8f38602a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629929764, "uuid": "a86a0b82-85b8-42a9-a249-778b1ded6e25", "comment": "Malware payload (RaccoonStealer)", "value": "8a4bf98067c418f5d6e5d403675d8a5eccd162d4e300032730eaa98a7085804303eb2b267742ca35ecc1b4ef3157da8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629929764, "uuid": "cc1381aa-87ca-49d5-bd58-ac976eca87cb", "value": "T142B4E030AAA1C034E1B321F855B683BCA53E7AB16B7440CF52E526ED5B346E5EC3174B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629929764, "uuid": "a9075a7d-4385-42e6-b111-0ade5a28362a", "value": "f6ee633166e72a1d10f4f54440093ac0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629929764, "uuid": "0a62ad97-2539-42ed-84ad-fa9539118fc9", "value": "12288:uLdQ1ivp3gmXl0VoGwKVaAfojqTaKLOjHJo0lVWTHC:GPvp3gctj9jq+KWJ1lVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629929764, "uuid": "93a24714-6a8f-467e-8a11-e5d015722e81", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629929764, "uuid": "e1ac4b12-c214-4f43-baa9-7d09dbd7b9fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629929764, "uuid": "808c02f1-a501-4cbd-857a-c94b3865046b", "value": "56d9fc73f8c68a338727a732f28d6385.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f7f95b7-05f2-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629929881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629929881, "uuid": "927d4127-4d9a-40c0-9214-01f07c567186", "comment": "Malware payload", "value": "6c70e421df6fecaf6ff10d56d1fd2843", "object_relation": "md5", "Tag": [ { "name": "Beacon", "colour": "#3CE751", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629929881, "uuid": "ee75cbe1-d412-4dbf-8e9e-d37c37faad6f", "comment": "Malware payload", "value": "326f9e129d2b314604217e5dce39999db5d788ed644ad5a39d68c4feed710096", "object_relation": "sha256", "Tag": [ { "name": "Beacon", "colour": "#3CE751", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629929881, "uuid": "e418c40f-1c10-4de5-9eed-b2b74fde702d", "comment": "Malware payload", "value": "5e183dd73ec95bb224c290dddc910f3722e43064", "object_relation": "sha1", "Tag": [ { "name": "Beacon", "colour": "#3CE751", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629929881, "uuid": "f8b432f0-88b0-41c0-b0ef-2c2abfa4debd", "comment": "Malware payload", "value": "1ea5d5a4997dcef093214786a170baca64f29b749fc41b6f20493eb95999eb7f97f4dd14d7fd7c2a9cebfebeda9f070d", "object_relation": "sha3-384", "Tag": [ { "name": "Beacon", "colour": "#3CE751", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629929881, "uuid": "bf2f2ce6-a3f7-45e6-8993-0414912cfd3b", "value": "T1D444CE735363DB10D580EE5D0257C80AA3A7994DEF8534933ADFAAF5FA4921C04EB2D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629929881, "uuid": "e33f297e-3e14-4d01-aef9-97c5f55c5010", "value": "6144:uwGbUGFlgGovr+X9FuEbs6EmyLBhn4QjSoiSjRH4CLyynLcvni8:uwGbU6lgGovrgFds6mLvbWajx4CLyYgn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629929881, "uuid": "4116fcef-7176-4330-84f5-7e75ee4b589e", "value": 261703, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629929881, "uuid": "76bc53de-111a-4ba0-b118-9624b735ae98", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629929881, "uuid": "a222edee-c864-4f26-bcb5-08516a663c3e", "value": "x64_beacon", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99ce5c51-0571-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629874601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629874601, "uuid": "235a7335-e58c-4349-832c-dff323516881", "comment": "Malware payload (RaccoonStealer)", "value": "6cbabf7e2b9baec8f43058d571eb1b5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629874601, "uuid": "8c62fd09-4541-4f8a-98e8-38b77759fe0b", "comment": "Malware payload (RaccoonStealer)", "value": "335331f8cb4fe7e15164289ae62645b31653cf563c61fe45591b5246479903b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629874601, "uuid": "40d12c3e-92d7-40ef-b56f-18aaa6af5e43", "comment": "Malware payload (RaccoonStealer)", "value": "b53821cada479e047e7fd78d02437f60f949b888", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629874601, "uuid": "82fea24a-8449-402f-9e66-05e6cd528ad9", "comment": "Malware payload (RaccoonStealer)", "value": "03aeed570eace58992eb6eab3911e6984139996d8244cf9577da4919b3bc57f0b515838ba650b6186cee165fb4ea3946", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629874601, "uuid": "302f1728-6918-445e-b57a-545ad2c19837", "value": "T152B4D030AAA1C438F5B611F84ABA83B8753979B16B3440CF93E516FE16386E5EC30757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629874601, "uuid": "484b3d1f-c7f9-4b0b-ac5f-4d6f7bb910f7", "value": "b1f244737f482f7370a4248faac2bcb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629874601, "uuid": "45c661dc-7245-4ff0-8bc7-77c7b8426a35", "value": "12288:1KwUAfYaaPuhajGSTMn6gYmOVg9goeBl45SoqFeLvq85Og26PU:xYaaly4ZUdev43qCS85q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629874601, "uuid": "76446b5d-316d-4baa-bb5f-eaba305064ee", "value": 540160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629874601, "uuid": "d15bc3d6-1d86-4a39-b20d-d83485030253", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629874601, "uuid": "3d21e8e8-7faa-4876-863f-fe0e7edd63bc", "value": "6cbabf7e2b9baec8f43058d571eb1b5b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b8f19ed-05d0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629915272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629915272, "uuid": "23f37228-16d7-4232-9fbb-9f52b7c66fac", "comment": "Malware payload (RedLineStealer)", "value": "00c906d0d6994e9d0dfc5b7b3dad5a56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629915272, "uuid": "8c7852f3-c5cd-42f5-8b44-daecc85ce118", "comment": "Malware payload (RedLineStealer)", "value": "33d742eb4befb411b0ce2be7f7de5850792f7f57ce3c7b1fdaab9ceb68a8f633", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629915272, "uuid": "82676725-7f42-4553-accd-53b8de9156c7", "comment": "Malware payload (RedLineStealer)", "value": "1af3e52d75d1889999df479a0241342b13e10b63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629915272, "uuid": "a0c6c684-5988-4e64-877a-d9163e11da5a", "comment": "Malware payload (RedLineStealer)", "value": "267a7b5c0abd3bfac7260856ddc69a187bbf75f3a4224352df7cbd17f70714ce49f9f37965ae0d41b1211291c44480dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629915272, "uuid": "83c255fc-bf49-4371-9268-0e570728b40f", "value": "T1C074BE30A690C035F5F312F855BA97B8B83E7EF16B3450CB92E526EA16356E4AC30747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629915272, "uuid": "40a6bd4b-a337-4067-9c7a-cbf0c9555479", "value": "61341387e3ce2ad06f049c03ebf5f67d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629915272, "uuid": "3c7c8527-7a87-4b34-a03e-7e797ec2509e", "value": "6144:gOr4eNG1j6/IPXsHuYHZXtvyyh9j2f9+zRVr4er3x5q5WNmWOZv5Mp2Rwe:hXij6APX3YHZXt6yLaA3rPYWgWsv57Rf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629915272, "uuid": "95734621-9ad4-4a4e-9888-c888704a205a", "value": 356944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629915272, "uuid": "fd0af807-0652-464a-a072-824e2c0e6678", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629915272, "uuid": "f24920a0-3dfd-4d28-ab1b-84bd550ae201", "value": "00c906d0d6994e9d0dfc5b7b3dad5a56.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc483dd6-05bd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Cerberus)", "timestamp": 1629907408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629907408, "uuid": "cf87f37c-fd8f-407b-b2b4-970169f9fd4e", "comment": "Malware payload (Cerberus)", "value": "b7638ff22370a672f8da8ce79d5da97b", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629907408, "uuid": "7eb5b3c6-f77c-4251-a3ef-e176c54f2e16", "comment": "Malware payload (Cerberus)", "value": "34285952e2dc998f9e94dc41228c6b74c3777b403e57fc239a362cc1e4e7cb71", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629907408, "uuid": "fea6f188-f566-4389-b464-fe32738d19c8", "comment": "Malware payload (Cerberus)", "value": "0f970d5c3c1d04740528a988a92ee72f4b3f5a81", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629907408, "uuid": "356963d4-7d44-4766-af48-2ea49c5be0d7", "comment": "Malware payload (Cerberus)", "value": "46477e0f878dda115fab478485ec5d2a0c3b09e8263773dbe23d57a569beb88facf0bde0d8977b9f3dfaf59851852880", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629907408, "uuid": "226f3d1f-274c-4756-87d4-496c8596acb1", "value": "T10AE5336B9753F418C60312310113621B9AD1B97D98E5E93F4037049BAAEFEC89A1BCBD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629907408, "uuid": "4c9d54bc-6aec-4f63-9808-67e5eb2963f9", "value": "98304:k/GrGuxWqpC50FKdLWI0GHzoJuft+o5L2pFFvC:k/GiSY50+WI/Toq15ip7vC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629907408, "uuid": "4c5012af-6056-49b7-8af2-63db4fc918da", "value": 3173424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629907408, "uuid": "ffa76ca5-8280-4e8c-b339-ad36b7c7421a", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629907408, "uuid": "c6adafa7-96ce-477f-b93a-cbb513b651b4", "value": "Yerli_Gizli_Cekim_Ifsa_VIdeolar.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2d67309-0564-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869086, "uuid": "9f7d36a3-fe18-44ae-9c37-fccfee314f4b", "comment": "Malware payload (Dridex)", "value": "c5e068c0ab35bf603fdbab891c10638c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869086, "uuid": "0dad2565-5298-46b3-b724-151b6d39b78d", "comment": "Malware payload (Dridex)", "value": "34b1ae97e90558de2261b9b9f5108b5747dcefaec75b9d5ff40d463d6de07c71", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869086, "uuid": "5e4fe8df-1303-4a4e-b8f3-7a4e834c3ba9", "comment": "Malware payload (Dridex)", "value": "9fbbf97c6a3da7dfb930327863ed576c1966c404", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869086, "uuid": "9f37cf36-d27e-464b-8215-50dd023dd0df", "comment": "Malware payload (Dridex)", "value": "57f166f6f76c9f9fe8ccca0350dd50cdfd7a1e2ccb9b8527b02992ac97740d451df4e567396acc5c5b5133358988abb6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869086, "uuid": "f3b42f5e-4c09-49bf-9be4-c297d6bcbd50", "value": "T1B5C3D0AA3572DA5CD52C933C11CF2FB6ABB49F8216A34B06523DF91DAF120EBDE50105", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869086, "uuid": "04babc01-63ac-4b1c-b4af-2c3558aa1b67", "value": "3072:oUtiO0tKw/IJ9vVwi63LD6z2qoaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa3RY3u:o4i3tFGVP67Moaaaaaaaaaaaaaaaaaao", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869086, "uuid": "acf6ceda-07e7-4ccb-a196-74a4b65bd7f6", "value": 124586, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869086, "uuid": "56a43ae7-88c6-4bbe-a2bf-d5e6cf326057", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869086, "uuid": "aacbc3b6-4bfb-496c-ad29-aa230b78f823", "value": "Invoice-32707677_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d66e1731-0564-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869119, "uuid": "7feb1323-109a-4bec-9f2f-85ba2f1f0ecb", "comment": "Malware payload (Dridex)", "value": "fadd22bf47bd1d1323d2eee65d469429", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869119, "uuid": "7e0b65a1-18a0-4ff3-b8ea-06da929dd599", "comment": "Malware payload (Dridex)", "value": "34b7091e57e91881530b0fee7a73e9cbcbfb32acffab0edfe1ef6f617b9b298a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869119, "uuid": "0be15960-fc20-44a2-b3f6-13d4aca4d437", "comment": "Malware payload (Dridex)", "value": "dd61e188a11a7c9addf97ca12ccdfcf45064297d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869119, "uuid": "568ed920-3e2d-4d66-bf71-71b94f3d3080", "comment": "Malware payload (Dridex)", "value": "8d290c54eaabda932b20c81c276c903123e2e2dbb4264fcb3f470e91229535ee980013268e492f1b989b38d271453d78", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869119, "uuid": "3f2b6393-b9de-408a-a4bf-ef100df8effc", "value": "T1BB640219C5B7E93ECF860CFF8DB814D263A78A33D19189C6888571EC1F9203A4249ED7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869119, "uuid": "234c64f7-a410-4687-8ea6-b1d1b93b718e", "value": "6144:oiLGOsHTiidXO/J6t/VYfASkKTzZYwPMPFde/Qxx2u+OA+NT5Ad:sTi8X7ifASkKTzSwkPFduQx0uD+d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869119, "uuid": "8052699d-0fc2-42de-b283-c7e388d61175", "value": 327970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869119, "uuid": "25e780da-6498-4a47-849e-c6d940d205ff", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869119, "uuid": "79aa5d49-7164-4771-831c-876efba50307", "value": "Invoice-08938979_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "589e3636-0574-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629875780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629875780, "uuid": "bd25a86f-41fc-4c3d-b91a-560adfa71c8b", "comment": "Malware payload (RaccoonStealer)", "value": "f01851ea050f82906d3b3c97fb7e3b6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629875780, "uuid": "31043790-d468-4f17-8f33-6fc1db57a65f", "comment": "Malware payload (RaccoonStealer)", "value": "37a00ba7c6cafe06ee8e908a1a954a7b1669b75255975289105845a81901ea71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629875780, "uuid": "e445eddc-ba5c-4b34-ae45-e505f155563a", "comment": "Malware payload (RaccoonStealer)", "value": "b46b97077a32d7ca799db127cd6b100c2c775b31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629875780, "uuid": "89a31564-8b3c-47dc-8800-48af24e1aa60", "comment": "Malware payload (RaccoonStealer)", "value": "0e70e601abb4c74917e56e0180ea49f936219927c738a2f2c0a2c01253328cbe39bc85981acd48dfc1aafa1a1c7d5886", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629875780, "uuid": "b678c89b-efb3-4426-be66-a0be8b8636db", "value": "T12FA41240B5A2CC73F96942774C91C250EB7D799029F44243FBE59BAE6F293D03A1B2C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629875780, "uuid": "dd9ffd61-b545-406b-ba7a-ff160eda231c", "value": "bd3c9edf948deca79ee5e78523f1a042", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629875780, "uuid": "162ca48b-4ce0-410f-8daf-20cfb0b71517", "value": "6144:jVvldIZKPOVHEikXWg4DW1BAaj+A/bT7j6J0H62Oi9OVtkWCnfM2cCck2cxb:jCTHVW1qm+6Tf6Jw62ObVGfMocvcF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629875780, "uuid": "3b486b74-0597-4a34-a218-e303fcfea766", "value": 467456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629875780, "uuid": "12d9c5a1-a1f6-420d-9e05-0b8bcebdf30f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629875780, "uuid": "fd23e7f8-8b59-46e7-b46c-de4613e500b8", "value": "f01851ea050f82906d3b3c97fb7e3b6b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "894aa5b4-0599-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629891753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629891753, "uuid": "f98c15d4-3ff1-4547-a55b-b092fbb287b6", "comment": "Malware payload (Loki)", "value": "24132300c3dd5c89ed3af803aea3191f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629891753, "uuid": "4b8d8c36-3ef8-47de-8c91-8a0f4820de6c", "comment": "Malware payload (Loki)", "value": "37fc32834534585e428b56470b36be2b234b9813bf6d82cea9c1446fd72bc50c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629891753, "uuid": "f51ef0ae-5592-4fa8-ad24-808c486cd5b6", "comment": "Malware payload (Loki)", "value": "64a67c1e6b804455dbaf21b6b8fa9025065fbbb1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629891753, "uuid": "d19d2baa-a5ef-4e65-9e9d-06d2ee12a813", "comment": "Malware payload (Loki)", "value": "0f01903cccc76da29872212ab23d231079370c3bb07d9dea8a4142fcb71610badbe023bdd6bf77d7d477f0c7ce132179", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629891753, "uuid": "4547ece5-a5f3-4363-a88f-2f0ef17c780c", "value": "T1E724027D52BEA2D3F42D993800F94ED2C37EEC86B25C6AC3149375980837178A6B5379", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629891753, "uuid": "f62e5ce3-03eb-4c0a-9d8f-38dd9cbb562f", "value": "35807dcde258f88fa3ce5c21adc607fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629891753, "uuid": "1a8a90be-aabb-4901-9afe-342e3f84d813", "value": "6144:bnZ2dLknnFzF0+SAmiMV+YLSEPyqZxLhU15z:bZmknnw+5B+y2+z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629891753, "uuid": "5e65b5b6-0770-4b24-8f46-33d5975247e6", "value": 230164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629891753, "uuid": "66e203ed-edb0-465c-b09a-a32566d3a6ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629891753, "uuid": "748e6b27-6ad4-4342-90cb-e781633269e5", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "323d3dc4-056c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629872279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872279, "uuid": "83878492-3061-44d1-9f13-b4cfc4b93cb6", "comment": "Malware payload (Mirai)", "value": "208f4b05983a25ef991af6126c892d0e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872279, "uuid": "f2912f0b-3c2a-4ebe-9262-d6ce176e5042", "comment": "Malware payload (Mirai)", "value": "387253221b728f7fa7370692e4306de527ea60a69b39a7a3ed2622622334e587", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872279, "uuid": "19810338-4dbb-4ff1-a235-c5e361d94b24", "comment": "Malware payload (Mirai)", "value": "ddda99d746dc5d22cd0c008764c7b5abe0869063", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872279, "uuid": "68dd412b-ae83-4709-8698-cc93a9596513", "comment": "Malware payload (Mirai)", "value": "9f58e08a718602fb6e2b95a635262a24b0f6f3e14840d48d3cd516c882239574b2036d247faa5b1b08b4ea0755acbc73", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629872279, "uuid": "93893466-fa42-4cbf-af88-861cc01a7907", "value": "T17503F18180605F95990EC3346DCA3A1FCD40C76D306AD9ECC9DEA8A5BD87F9136681DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629872279, "uuid": "13581ae6-020c-41b6-b5ff-22a1706e2d79", "value": "768:ZUTA2O9xyK5Nm5JeC9++0X7K02mGFEJ3lhwjzFnbcuyD7UHQRjm:ZUToDyiUP8rAmGCxXwjzFnouy8Hyq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629872279, "uuid": "9e015416-312a-41d7-bef9-29d2f4c9a1e0", "value": 40184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629872279, "uuid": "a4127166-df45-4388-8b35-df2a230a8253", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629872279, "uuid": "3fb3deea-c982-4f6b-8cc5-33e90a6ccff5", "value": "208f4b05983a25ef991af6126c892d0e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5e06d75-0566-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629869896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869896, "uuid": "d7b10a3a-535a-4f8f-aad5-e0f4c1e60ad9", "comment": "Malware payload (RedLineStealer)", "value": "5eb1fa7b7ee51c18dacb23db4bf48534", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869896, "uuid": "747882c6-071e-4e13-b825-69ee53238dde", "comment": "Malware payload (RedLineStealer)", "value": "3876a548e36a745410a195c08674cde58fa6901a1f80fa4767ab8ac2c42072b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869896, "uuid": "e102f6fa-5aca-48f0-81e8-012b66bf65c9", "comment": "Malware payload (RedLineStealer)", "value": "efa036d220f3b7679cd45d51ef07042ba5bcd861", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869896, "uuid": "5e8d9bce-06fd-43f6-b866-c4ebe832b9bb", "comment": "Malware payload (RedLineStealer)", "value": "96f14310965eb1203f02cd60a3e27a961fc3788fdda9a75c75defc5f9c979271e9d1b970a515b1cd4f770a040f098b14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869896, "uuid": "2219eb7e-2035-44b7-a028-a538b094a372", "value": "T169D412113274C2B7C4A504B104C5CB90DF3EF9716EB5958326E9DB5E2E322F07A393AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869896, "uuid": "12e11935-9ae1-42c3-91e2-8e89c58993c1", "value": "3bdc58d7d3add14fdfc74404aa032a2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869896, "uuid": "26026028-ff6b-43db-93c7-b8ca49887f41", "value": "12288:JuJuQSsjgWFdVKLMHSG+Q6XlosvINf4GxcCV6IVilNIe4hLOSbWcFk:JAKAyGGvvIhjrwIVif+0ik", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869896, "uuid": "f5113b30-aaf4-405f-b90a-f674a3a2abea", "value": 610304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869896, "uuid": "47b337a1-78e4-4141-b441-03b1e21298cf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869896, "uuid": "3abce3cb-46b8-404e-b2a5-13ccca2ecaf8", "value": "5eb1fa7b7ee51c18dacb23db4bf48534.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60d6daf7-059d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ParallaxRAT)", "timestamp": 1629893403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629893403, "uuid": "faad9e05-d07b-4432-955a-78d188f958e1", "comment": "Malware payload (ParallaxRAT)", "value": "415c3aa31822921311e2f080b3814924", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Special Floors ApS", "colour": "#36FC1D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629893403, "uuid": "0af94cc4-378f-4996-a5f8-bee4a8049d91", "comment": "Malware payload (ParallaxRAT)", "value": "389c556e30252966f34f1bc23348e182af2c0883771f9c8abe299a8ba54b1f6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Special Floors ApS", "colour": "#36FC1D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629893403, "uuid": "e8d7d064-01d6-45ff-a38a-8d556fe27af8", "comment": "Malware payload (ParallaxRAT)", "value": "796231aacfe6bf73ac73e95f1f061307f6c3ae68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Special Floors ApS", "colour": "#36FC1D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629893403, "uuid": "bf35d271-0a67-4027-9468-962abf1685fe", "comment": "Malware payload (ParallaxRAT)", "value": "885421162dba26bf50941901d423299586bf8ef6fd9b290e9cd73248ceae921d357639ad6a7c76400f0f31033ee16e81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Special Floors ApS", "colour": "#36FC1D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629893403, "uuid": "a59f009c-da1f-4b97-8365-21a283083dba", "value": "T124E6333BF294A13EC5AF1B3205B39360557BBA65A90A8C1B03FC350CDF765611E3EA46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629893403, "uuid": "b8d6ff47-5bc1-4785-b7b3-779fa04cceff", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629893403, "uuid": "356e820d-3a65-4e03-a6ea-48ea5937120d", "value": "393216:TeA/ly6FTl79SxeT1/SV2VvI9CmowsGaW8oc0a:M6h3SwT5f1zXk8o8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629893403, "uuid": "89e3dddd-203b-4048-b8cb-452460dbd7e6", "value": 14279368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629893403, "uuid": "0de46cf1-45c0-470d-a33c-541c58242521", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629893403, "uuid": "1f3895b6-6ac2-4ddf-8fea-59569c3dfeae", "value": "389c556e30252966f34f1bc23348e182af2c0883771f9c8abe299a8ba54b1f6a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6b00039-056c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629872475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872475, "uuid": "b9d0e19c-9d62-4488-9408-88906265f718", "comment": "Malware payload (RaccoonStealer)", "value": "49f795e8fb7f49e37f7de8f9facbbcd1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872475, "uuid": "e78dcbfd-623b-46a7-8c16-893949f98853", "comment": "Malware payload (RaccoonStealer)", "value": "38a76a38586847bd27410508db3542adfdc2b0db18935c6fd0ea592f6072a846", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872475, "uuid": "e2e32b88-c55c-4f5e-895a-25e09512df91", "comment": "Malware payload (RaccoonStealer)", "value": "e1de3cf0f000ac7ac5bceed442e9de81f435dd63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872475, "uuid": "a65ab456-6a49-4582-be82-7fa6b306fb1e", "comment": "Malware payload (RaccoonStealer)", "value": "913cadf01dec6af7c429457b711002eb5ab06b25c1fe600f2d9ab6adb0bdbce7fc2e872401c0027384f0835043aee285", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629872475, "uuid": "399b3e94-0bda-41d7-8482-523bd1890359", "value": "T163B4E031A691C035E8F212F495BA83A9B5393EB05B3550CF63E62AED53346E4EC30797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629872475, "uuid": "bce96f14-054d-4af9-b7fe-fd0d50266376", "value": "ddbb3eef631957f988f10b48742f9549", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629872475, "uuid": "528d872a-9e42-4f1a-bbcd-2a87a06fe9de", "value": "12288:mu62iMQ60Py4gxm0b1xPiRjnmC5cPoYly6SVZ4n3gMMXsCyM2:RQ60g1VicACZSVc3FGsdz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629872475, "uuid": "54d159f3-0b97-4d24-9709-8cdd649e9015", "value": 539648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629872475, "uuid": "5d0e6bef-6efe-411f-8d9e-abe19890501d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629872475, "uuid": "72f05123-4130-42c0-8ef3-f0656dda5403", "value": "49f795e8fb7f49e37f7de8f9facbbcd1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05eb6d77-0565-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869199, "uuid": "c0e40a11-6327-4c57-bb4b-5795baaaf982", "comment": "Malware payload (Dridex)", "value": "54b76e5f1465538f75f338d22b2e6f88", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869199, "uuid": "4770a390-733f-4c55-b32e-5240f809704e", "comment": "Malware payload (Dridex)", "value": "394ec5e07720ee6efbf8b39acc29d36728b33eebedc9c11498c09f1b4e2db01f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869199, "uuid": "b9a32ab8-a1ae-4359-bfad-cd4d84788de2", "comment": "Malware payload (Dridex)", "value": "018faa460004340632063b86af8b668ade0d6443", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869199, "uuid": "0e3d9af1-0967-449c-bc05-b3f03a240944", "comment": "Malware payload (Dridex)", "value": "2761e883f42e6746cb8909087bd76fd198d24ac0e7e9a9ac97d2f070d52777086b45badf6c3f5504a8e64766af325733", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869199, "uuid": "275e6252-1b6f-4660-b51e-c74dbbc4e179", "value": "T141741278D2A1C81CC94E413F51D70FB2DB721A05A681A71E96F1B30D6B02D7E8B6B1ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869199, "uuid": "2239ed7a-e24b-4693-86c6-5f48c96679f0", "value": "6144:oNtkis2LohOGYw6CC5jTT453mjEIbWiGVAKSLFN+YInSCRvuPsxNd:etpTL2OGY/TTy2jEIJc6FNu3uPmNd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869199, "uuid": "2383d57a-6644-4234-a7e4-08cac1dd4515", "value": 353611, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869199, "uuid": "16956a2f-8897-4e20-a6fb-70605ae5f610", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869199, "uuid": "50674809-7412-4a9d-a1c8-1378dbb7c344", "value": "EoY_TAX_Document-8652654913_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47a657cd-05f1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629929438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629929438, "uuid": "fe0a133b-20e9-4250-a097-f131f4b68071", "comment": "Malware payload (RaccoonStealer)", "value": "80a9f23ae009637f9a72454549bc72e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629929438, "uuid": "a542a1ed-e041-4e0d-97e4-5267bf9006e3", "comment": "Malware payload (RaccoonStealer)", "value": "39afa9cd2e3a495d315207dc7b245187fc60a5708dedbfcc3a53393325bc29ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629929438, "uuid": "131b0ff4-13fc-4229-8fe3-319ba47f507c", "comment": "Malware payload (RaccoonStealer)", "value": "9a147756cf9f8ea4a322f5faaca6e3a15b5189fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629929438, "uuid": "a53df71f-f752-463c-8ac7-07e40f14ea7f", "comment": "Malware payload (RaccoonStealer)", "value": "a5b65da56b87e2bc0a61e7e808ac93a869971b09d30206ac9109bdc95fe3b699f31888876c0d554aa9ec78fb5ea9257a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629929438, "uuid": "57f85208-b633-4304-b9b8-9d7aee5a2597", "value": "T1D5B4E030AAA1C035F1F322F856BA83BCB53A7AB1673450CF52D416ED4A346E5AD30797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629929438, "uuid": "a4117330-b9b9-4b7e-8326-c6040cffa54a", "value": "f6ee633166e72a1d10f4f54440093ac0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629929438, "uuid": "d78b318a-ccd7-4f37-be4e-67013009b2a3", "value": "12288:20XQM/XzCj9CKbLwaO9zb2sxzPxVWc57A3H6LtixjDYsL1b0V:VnXzkQfxlj3AQsjFM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629929438, "uuid": "63368952-2ee1-485f-b4eb-1849d37eb339", "value": 537088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629929438, "uuid": "052355ee-cc3a-4e60-b824-4eeb2a4112f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629929438, "uuid": "afd66e67-1a4b-4877-a392-b923479e4251", "value": "80a9f23ae009637f9a72454549bc72e6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2884c3c3-056c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629872263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872263, "uuid": "7f86bdbb-c571-4bc3-b17c-91b199fe33da", "comment": "Malware payload (Mirai)", "value": "e26513ac14d2031d6e826e4bfa4eea13", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872263, "uuid": "de23eff8-1e21-4f0b-a457-f6c20cbd24a3", "comment": "Malware payload (Mirai)", "value": "39cdb2cb232ea48644ef8e1496f0365eb50051909ed85ff4dfce712d0db4b7e5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872263, "uuid": "ecdde3a5-2f5a-4a21-aa28-93719ee0eacb", "comment": "Malware payload (Mirai)", "value": "9cee506e02c9e1acf95be4b8af22af3742fb33dd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872263, "uuid": "7adc8d13-11f4-42b4-a580-261ed7b9b4c9", "comment": "Malware payload (Mirai)", "value": "9e19670e6123535721af0600ca5d442796018c5c8d1606b83ae79410f8e7e328ccd7a8244ab2a9b992aae0bcc85f2d48", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629872263, "uuid": "9d0485ad-2272-4e1a-8ed6-759bb2ddc9f2", "value": "T1B503F195C1746B4AD488D1396DEE7E6F8F18862E30B1D479C4ECE5908C82F823B958DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629872263, "uuid": "83248092-0f77-4556-847c-de7abadba394", "value": "768:QUTA2O9xyK5Nm5JeC9++KeumXPhjQsZ96Vd9gDoymGByXx49nbcuyD7UHQRj6:QUToDyiUPSeNfKsG2DoymGByXxcnouyA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629872263, "uuid": "238a46cb-bf27-447d-8742-6b617c64edea", "value": 40176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629872263, "uuid": "763848d4-1181-465b-980b-9b3f924a7b88", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629872263, "uuid": "604cef9f-8332-47fc-8904-7b8d8d646911", "value": "e26513ac14d2031d6e826e4bfa4eea13", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4a2dd76-05b8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629905220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629905220, "uuid": "c04005db-697e-4ddb-b708-7a00bced9e7c", "comment": "Malware payload (Dridex)", "value": "1104b59f5a1069fe6496fa98e2fe5f1c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629905220, "uuid": "f5173c4b-f1ef-46cf-8de1-6f086a491882", "comment": "Malware payload (Dridex)", "value": "3b101aae2d5e4b8656a27cb994e3b6e9909730763f472b60bf715d897ddc24cd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629905220, "uuid": "87b77072-2fa8-4d6d-af36-1c410d6b4a4a", "comment": "Malware payload (Dridex)", "value": "61b4a45647498f91edb84b44f4d2635ed6a5f597", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629905220, "uuid": "8a0380cd-2c53-4f89-946d-ea15a792b04c", "comment": "Malware payload (Dridex)", "value": "d5dd200982eaa395395e3180d37f04cb2599f39dd390724309621110aaffb673da2d80b9b5dc218743a1dda0795cd151", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629905220, "uuid": "95f0cbd2-7d67-46c8-9185-c783274ff23e", "value": "T15714D082CD9F46F9C21B167139F531BE21E80605A769CC2BCADAD2FBF47D300D46261A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629905220, "uuid": "289bb25d-529c-4a43-97ab-8f8031b15dca", "value": "15d931f2533164c416970d03fa5b5c88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629905220, "uuid": "80580008-8de8-4db0-a778-e64a0437cce0", "value": "3072:XH0uyjZqEpAK+Gf78TBdrXkTM5vhRg9Esf0DwvtyMpVnpA+z6tX8sxKViWL7dU:XUua/Pv7YNhRIEZDeXVpAxtMsxK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629905220, "uuid": "e2e4d1a3-761a-471e-9399-6a7af6990ca9", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629905220, "uuid": "bba1c23a-9f18-4313-bc4c-9c2f63f31d60", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629905220, "uuid": "4fa48867-e514-493a-ba7c-aed821e0c25c", "value": "1104b59f5a1069fe6496fa98e2fe5f1c.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcfa65ee-0564-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869130, "uuid": "5d983377-6c2b-4a13-b408-4a356de45c51", "comment": "Malware payload (Dridex)", "value": "84ac93478b912474fde1b71b46c839b6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869130, "uuid": "71f775e3-342b-4b58-84b4-2919c28b6135", "comment": "Malware payload (Dridex)", "value": "3bca20378998570595aaab0b5cd32f5b47e7c21a48724f722be4d7fcdf99398d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869130, "uuid": "9006812f-14b5-4a64-9f94-700a3cb97ba4", "comment": "Malware payload (Dridex)", "value": "ba6e506fd920bee8ba69e2b29646b9412b74a6f8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869130, "uuid": "2314ff70-7ec3-402c-b8f5-263751f9593f", "comment": "Malware payload (Dridex)", "value": "75d68d81dc92d066e1c64314bb4ac15835130ccefa0499a9465d5cef40d3d6a6050b7840fe3f55663686f0c9f9d05b5c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869130, "uuid": "c000c052-8dda-4534-8ba5-9c64c3d921b0", "value": "T1E9B3D0B932B3CA9CC01D827C96DB9FBA7B744B8595539706421DF82CAF125E7CB84218", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869130, "uuid": "0d254e00-e3c2-497a-ac8b-212dcf1e2cc5", "value": "3072:oU190gZ4g3xQj3i63LD6z2qoaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa3RY3PaU:oeOUQe67Moaaaaaaaaaaaaaaaaaaaaa+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869130, "uuid": "de401a6c-bd8a-4bc3-b084-8a7885a9173d", "value": 114162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869130, "uuid": "71083a39-5258-421d-bd24-a8a43a518b6f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869130, "uuid": "25db336b-dece-46a4-9304-c17323ea2a8a", "value": "Scan-7631927_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea8dc9fd-0597-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629891057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629891057, "uuid": "5605539c-016f-4e71-a7b0-559ee4b8f892", "comment": "Malware payload (AgentTesla)", "value": "8be55df55ea3539922ccffc92786ff1d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629891057, "uuid": "e5907307-1cd7-4186-9737-8164231da9b2", "comment": "Malware payload (AgentTesla)", "value": "3c42ad47ce02dd4dc002eba2fd6714df6b0dbdf78d2c300433acc430942f0aa5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629891057, "uuid": "4c2eb727-9eda-417c-9400-622c7c8279b4", "comment": "Malware payload (AgentTesla)", "value": "77291db0590e246101a46315bdaae14b4b1ac61b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629891057, "uuid": "372592d1-ed75-480d-9225-cc5aeb282952", "comment": "Malware payload (AgentTesla)", "value": "885cf0ea17907fe20c01dbc4db879a0e004d8677c54453c9f63058e5883884ac1e15e530cb16b7d8530c5faca5e88764", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629891057, "uuid": "275cc851-775f-4327-b0f9-686e1ecb6063", "value": "T164D45C9C3650B5EFC857C876CEA82C64EA50747B930BD243A01716ADAE0DA9BDF114F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629891057, "uuid": "8f0b9e39-f888-4f0a-9c73-8c94115af7a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629891057, "uuid": "c95aa5ab-8742-4210-a374-ccee72ee8f64", "value": "12288:94aN0T/6Gloep1ZxBV2JOMSEWXa0zbWUImcQizwx7Rpjmxc3aiAvzM2WZv1XNV0:n09oeHzd/vq0ziUNc7Ex7/p0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629891057, "uuid": "6d2811f2-0be3-4295-8815-7a6a8b992ff7", "value": 615936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629891057, "uuid": "432d357c-ae20-43f4-a9b8-6adf4fedad69", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629891057, "uuid": "de966cab-8dff-4e97-a7b4-8c2a03f0d035", "value": "8be55df55ea3539922ccffc92786ff1d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d731a62d-0587-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629884153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629884153, "uuid": "02c6a859-d0d9-4d75-9774-f50cdd3b373d", "comment": "Malware payload (AgentTesla)", "value": "f504e8f2ed3a2445c9be47d0e9368f4d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629884153, "uuid": "2828f246-f6c7-440c-ae12-10b3221c63d1", "comment": "Malware payload (AgentTesla)", "value": "3c5f46528e27f157573bb910e9537e55d8c2082befcc7ccda978ae61beb88f53", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629884153, "uuid": "bfec5274-b397-4590-97c0-3008682999c6", "comment": "Malware payload (AgentTesla)", "value": "7c926b7e7d68422971dc5e13449869164b8b0e83", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629884153, "uuid": "82c56e03-ba2b-4092-bffc-2cc828e51dae", "comment": "Malware payload (AgentTesla)", "value": "5207d8546fc89acd4a1490cfeda0bac16da99a6c4d392c3b7f2a6b01c791e795dfd65ed234978d917deaa0fe6adcb36f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629884153, "uuid": "ab4d3d64-17c3-402d-8688-7c6f2af52b3e", "value": "T123F402187A00E78EC57F8E3B9D451C00ABB0F6665707E7476CD311ED5A8F29F8A221E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629884153, "uuid": "9f151581-71eb-42ea-91d5-3b3dd6e18e41", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629884153, "uuid": "a502c819-fa36-4390-9997-a4baf8ff37d8", "value": "12288:lnwRDhyy7NnY/fp1e1ePGGJdmPiF4Reva6758ze+T+imxRXlgUy4Ni8XsDIFKqFV:lnwRDoy7NnEh01AbZ48yepa+ieVN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629884153, "uuid": "2bf5d345-5a74-4b29-b8f6-9c15c3409c9b", "value": 746496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629884153, "uuid": "3279ce1c-1267-46a0-9e2d-6067b3b605dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629884153, "uuid": "75228488-bcbf-47ca-a72b-87550375cafe", "value": "OC_U7902516384.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75fd2513-059c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (a310Logger)", "timestamp": 1629893009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629893009, "uuid": "9bcc515e-7732-4a75-bbae-746130504512", "comment": "Malware payload (a310Logger)", "value": "2f0371b67af65b2a8fda288280ce7f52", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629893009, "uuid": "0500ad59-e774-4a3c-ba8a-45d9406b333e", "comment": "Malware payload (a310Logger)", "value": "3c60a213817ebd39736a7697167aa4c1acedb10d1a8656662b70b2f1fc327ad7", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629893009, "uuid": "0725912d-c927-41e1-9e82-8b600cc10c82", "comment": "Malware payload (a310Logger)", "value": "0a8e6bde57853650285675fb4dc6ad3ecdd464c3", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629893009, "uuid": "4a50e060-9c15-43ba-8efb-84434e040852", "comment": "Malware payload (a310Logger)", "value": "a28148aad0bf9642df198668b2ade40e25628fc59f410c89f35f133ebf6296530fb8137d32ec1d07ba94290852b912ce", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629893009, "uuid": "d167d3b6-7a1a-4a32-add9-bb751c8332c3", "value": "T11284124548C5CCF6E71AB374D0B3CE9819657832CCD56B689358EA2EB870203B953A6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629893009, "uuid": "8e0e14b0-2344-4273-81f7-8b8950afb181", "value": "ef471c0edf1877cd5a881a6a8bf647b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629893009, "uuid": "7b78c51e-fe22-498b-a78e-9d4f8670781e", "value": "6144:04XrK9PX7Fp6Gh2wWRGl0EDDf1PisZQ5rAGQwg1QtP1f4paaYlsdcaMJEdbI0Pzv:LXe9PPlowWX0t6mOQwg1Qd15CcYk0We/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629893009, "uuid": "3db8c94d-4ee6-4391-b940-105b626e2b63", "value": 376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629893009, "uuid": "fd403c2e-f6e2-4015-b546-36a75d2b0dbb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629893009, "uuid": "93b74221-3a9e-4d1b-b822-29abb9670451", "value": "2f0371b67af65b2a8fda288280ce7f52.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db819091-0578-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629877717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629877717, "uuid": "66af4e20-c8c8-471b-9a94-b6893a6ed05b", "comment": "Malware payload (AgentTesla)", "value": "da80d5001aa61165e385a535fa53c606", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629877717, "uuid": "42c376cc-7c8e-4d25-99be-06c92cb34c58", "comment": "Malware payload (AgentTesla)", "value": "3d1342d93c5f1ea3a33ac9f4c0398bb06595a307d53dae9fefcaa0d48540d179", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629877717, "uuid": "4c41a7ea-75f8-4d0f-a7c0-ed572478f57e", "comment": "Malware payload (AgentTesla)", "value": "a58bbd78c944ed6df65ad4b0b7e046220ebd3e1d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629877717, "uuid": "40434bff-01b8-47dd-b915-b7ded7dd628d", "comment": "Malware payload (AgentTesla)", "value": "4e3d04a8a143ad0ddb8293294de53995ab5ea9d5fad278f666006b95bc2afb2537588bc4f64efe6f6b418d6b0cdcd2db", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629877717, "uuid": "6484d12b-ba74-4002-b405-45442ee58eeb", "value": "T10D932AADC4AB06A4CF8187785B2BBF85124C775CFB849632327C977127E0D39816693C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629877717, "uuid": "9331c154-f04e-4d25-ba73-8f58c726a16e", "value": "384:BuHHZ1Ql1fehUoAF4EmVP+XEHrt2vdz3HQYhErDDx:BAQl1fehFAF4EmVPGJZCrnx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629877717, "uuid": "c4db7020-4d7d-4546-a334-24476e6729c5", "value": 89666, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629877717, "uuid": "8baac54f-4053-4419-ad81-e7c040c8ff59", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629877717, "uuid": "c5878696-a1d0-41a2-8461-604764691a05", "value": "Quotation 1.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "520420a0-056d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629872762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872762, "uuid": "3ba47e83-426e-4639-8ae7-e734aecaa15f", "comment": "Malware payload (RaccoonStealer)", "value": "6debd9b30e95b5fdbdd450ded0277df3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872762, "uuid": "edc09a74-0f47-43e5-a07d-41b2462e43ea", "comment": "Malware payload (RaccoonStealer)", "value": "3d2f500c151a2c013853be91deec80c5d6e52970eb1373581cda1ce33d111639", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872762, "uuid": "13815678-7a27-4bf3-ac33-66b60428e6bb", "comment": "Malware payload (RaccoonStealer)", "value": "4c6d7a468b9c852dbd73b9ae8f23f90faf837e15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872762, "uuid": "cb037ca4-ba65-4070-ad0e-e4a1c3859bc5", "comment": "Malware payload (RaccoonStealer)", "value": "ffa4b9f2e745b27a46c53c2710bca76b11eeb58346633ae80a5d5c8db237065987d27b56929aaa2b4b87b216da28460f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629872762, "uuid": "b88d85a7-58d7-4a8b-bd24-c602077cdbb7", "value": "T167B4E130A692C434E5B715F819BA83B9B4393A726B3580CF53E51AFD1638AE4EC30757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629872762, "uuid": "9ca566d0-60d3-4718-b25d-3b8b002efd45", "value": "d5cdc30877a202456bbe03f8e48575f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629872762, "uuid": "4ed1c8ac-6ac3-4c40-ad21-d3ad3463bf39", "value": "12288:HBQHf7M3BSvKRVnPmi84qMAr4liEdjn7BZrTzA:c7M3rmi84qM44QM7j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629872762, "uuid": "038d6e98-4bae-4bae-897f-d6b541ff2ae4", "value": 539648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629872762, "uuid": "72f03a53-d91c-4207-935c-55163d69321f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629872762, "uuid": "4391adc9-d86c-4d7d-bc79-ca738f38464c", "value": "6debd9b30e95b5fdbdd450ded0277df3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b1d32d9-0599-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1629891783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629891783, "uuid": "8b81a5f2-f625-403f-8def-fac17fd3b92e", "comment": "Malware payload (AsyncRAT)", "value": "1f45cbeb24a4359830bd57dedd9a6023", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629891783, "uuid": "ca176afd-13a6-4d07-ae07-be4b18488c6c", "comment": "Malware payload (AsyncRAT)", "value": "3d43a7c8ec3cca79b99b59a1352cff58e381d29c04d434083af766325aa08007", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629891783, "uuid": "35be1efe-06a4-4deb-a09e-e45b61e30e1e", "comment": "Malware payload (AsyncRAT)", "value": "8a10179ed54ad090ccbccc481252b7ce32e202b9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629891783, "uuid": "a020b688-54c4-4d2a-9faf-f9be2c44ee23", "comment": "Malware payload (AsyncRAT)", "value": "99c497f80e1b662d405f981f06352497a07392c4b4bcfae744086bb1392c35174256722a5900f10e6f63e71d7d609a78", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629891783, "uuid": "526655d6-b998-4b5e-ac2e-e9fb35a49adf", "value": "T143B443396EEA902FB273FF7196E47687DA9EFB733501984D1442028A8423E86DDD043D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629891783, "uuid": "cc3faa48-6514-4084-b959-d32b3b0267b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629891783, "uuid": "e864d7e0-98f2-4d41-8904-1e0c81caa409", "value": "12288:miXhnvA7hB7V6n4zexn8ILg6qDwoMwIgtoHZ:miXhnv4cxndwwHZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629891783, "uuid": "03e9fc82-019e-4cd3-b9af-f3af5307f82e", "value": 521216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629891783, "uuid": "daa01b35-daba-47f7-b3b9-506483498628", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629891783, "uuid": "83772464-0808-4d92-a9f8-6ebe851b9ce7", "value": "1f45cbeb24a4359830bd57dedd9a6023", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa37cf67-0587-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629884211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629884211, "uuid": "cc464707-760d-43ef-96f7-701a85cd86ff", "comment": "Malware payload (RaccoonStealer)", "value": "65ba41988d2fcb782ba7b5b95a69056e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629884211, "uuid": "664345b7-934c-4e73-b76c-c08e82c0ff54", "comment": "Malware payload (RaccoonStealer)", "value": "3ef380341b22283b448c8064e5d37ba3445134173950c200778461d724d5a060", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629884211, "uuid": "86aed0de-6f1f-4f35-bc00-09fdecd03473", "comment": "Malware payload (RaccoonStealer)", "value": "7b8f9714c850bb45c6a3c3c8f57dbbf52d647c7f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629884211, "uuid": "5d38b181-8744-4142-8058-13b5b54acdff", "comment": "Malware payload (RaccoonStealer)", "value": "c2961c4b57945dac29fd86868443656db52ed397f19f0e97de880bef2494f3461910e9a1b913e1cc9590f5470e271c81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629884211, "uuid": "2cb740c9-cfd3-4936-b9a4-24615d8f0f73", "value": "T180B4E030AA91C039E4F712F855BA83BCB53E7AB15B3450CF52E526EE52345E8EC3135A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629884211, "uuid": "79edf059-e1de-411a-ae1d-2fddf185a5ff", "value": "35372ade599ee63db174ac99307517b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629884211, "uuid": "729ebf77-5f29-4f1d-afdf-c64a84db15c9", "value": "12288:GCGxx1qlbYUV8P+Ov5/H5Wt9AUT/HSlzAlrBx5EYQ:Qx1qlBK4taO/H8zG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629884211, "uuid": "83cba7ff-ff77-40d2-834e-23e89869439d", "value": 532992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629884211, "uuid": "69d18124-5af5-4b96-b6ea-9944d66229e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629884211, "uuid": "08c36748-88dd-4531-aa4f-eff05e696a8f", "value": "65ba41988d2fcb782ba7b5b95a69056e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec19a6be-0578-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629877745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629877745, "uuid": "ab47be29-40fe-4b2c-a5e5-92d48c6f8325", "comment": "Malware payload", "value": "3ab529a240675cbdcd0557a9eb2f2f1c", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629877745, "uuid": "8c3c9fd3-c696-423d-ba90-3d22e1e477a6", "comment": "Malware payload", "value": "3f145e6eb89b9f7f01080d21b89ea423b288eaa00c8d760e5cb40b6ef5e0b366", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629877745, "uuid": "2866ddee-4043-4c8e-a26c-e8f8e9f4a590", "comment": "Malware payload", "value": "bdf7825ed98d64dcae2269d9f91d51b9ccb3a582", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629877745, "uuid": "989716fe-cf15-4540-bd2d-735f3f46c4ab", "comment": "Malware payload", "value": "a8bbaab22383f094d13b9286232eaa6d59bb62e39f9f3639cf66462af6f765f24b8bf3dba9680eaa9f1887c8e7fb8d72", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629877745, "uuid": "17523a62-aeac-4e7a-87b9-e313eab40ecd", "value": "T191267C13B685963FD06B1B3A482BA6949D3F7B6179268C4F67F018CC4F356803D3A64B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629877745, "uuid": "5f3b1222-6239-4296-901a-363b68a90250", "value": "98304:8R9RCwpCWaP+pLkO2BOg4yPJ9LMP1fwOY2A:8kwppBNPKLMdo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629877745, "uuid": "9e9d9676-6557-40a4-bbe3-4782e527e9ee", "value": 4780032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629877745, "uuid": "58d12eb6-d915-493f-afbe-2a753ca1e7e2", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629877745, "uuid": "5d4f4f05-9e96-48ea-8ed4-b9714a5be17e", "value": "vencida_auscjffsf.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "928f6d30-05c9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (GuLoader)", "timestamp": 1629912384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629912384, "uuid": "36bab6f2-9f7f-438b-8f9b-13cddb4f114a", "comment": "Malware payload (GuLoader)", "value": "ed80e4460b3d2e1b818f307bf5a629f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629912384, "uuid": "3c359144-f1c2-4b0c-827d-313212884e2c", "comment": "Malware payload (GuLoader)", "value": "407da066b56d8c792547a82e039b6d258eba85fe6f7b5dd3656813ca5c2870b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629912384, "uuid": "84aa2377-acd0-441f-b30b-1835d480d1d5", "comment": "Malware payload (GuLoader)", "value": "5c27566f0bff763160bdfc4522a99cb3a4884730", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629912384, "uuid": "ba86655a-66aa-4bda-a295-04d25293a434", "comment": "Malware payload (GuLoader)", "value": "3c969752b32fd083cd3e4babe74824f7688acfff59b77af683b8dbe756054c8e610c95adec4725bdfddd992577a737cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629912384, "uuid": "11aee0d9-b365-4e9e-bdd3-666abed1102f", "value": "T1B9348DF320D76967E523827530EADB3C47423A59D22D1AEAB0D576354AFF3428039B4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629912384, "uuid": "d4ceae49-9fe7-48e5-a250-973491666ee1", "value": "6923c8ee86140e5fe91a6ff4f0a9d1b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629912384, "uuid": "9a21157f-bede-46f0-9596-cad03e9ce241", "value": "6144:16svF7BBdIuodGBoTdNO0snobD4oFbZBBdIuoMFO6s:16yB0dKxuD4qbB0L6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629912384, "uuid": "2f529c00-05c1-4e27-a748-4048898e7867", "value": 249856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629912384, "uuid": "a7edb138-0665-4599-b4aa-db33e9dd14bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629912384, "uuid": "7c19d88d-d1a5-4d2d-b536-9e058ada2865", "value": "SKM_Ref_MT103_23-08-2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ce7d809-057e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629880028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629880028, "uuid": "9e8dae3a-ddf4-417e-8658-33289bbae983", "comment": "Malware payload (RaccoonStealer)", "value": "9f29d81d7d0a675884122317509d006a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629880028, "uuid": "014f4511-576a-48c5-b299-a2e6cadced68", "comment": "Malware payload (RaccoonStealer)", "value": "409814dbfa9612022be53df29a336865b7ca8b5dad0befe8a452d240c51815d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629880028, "uuid": "63314651-7be6-4156-93c7-8736087fc083", "comment": "Malware payload (RaccoonStealer)", "value": "7d24570a96e9c3be7076b2a9b834a02082356b82", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629880028, "uuid": "81db7b8f-7938-4bd6-bb40-592e86b62ecc", "comment": "Malware payload (RaccoonStealer)", "value": "1c97a36230b170f9c6f63c7427774d51325f9348b9ca35359f66a9941f5d5fc9e84a4f22ec4dc85b29aaa4a0d74a682d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629880028, "uuid": "e039b5e8-8a4c-4642-bda2-b0d8de329647", "value": "T101B4D030AA91C035E4B311F885BA86BDB53E7AB16B7450CB92D51AED43386F9EC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629880028, "uuid": "91008d22-8526-4caa-a1d1-a909862875d0", "value": "2d1e5013dd6b871ca263ffc72a0f89a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629880028, "uuid": "e6762fe6-7a2d-407f-ad8c-27ed42d332f4", "value": "12288:pgwqRU7PhlsOoamh2QDyiBilToH2QqTtd:6U75y2QWDuH47", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629880028, "uuid": "0825a7b3-f772-4fd7-8f35-ae35fc9bfa50", "value": 533504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629880028, "uuid": "8d4286ce-8354-48e2-8610-42a63a471cf7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629880028, "uuid": "ebb9332e-0951-4fe3-9a46-b8fe0ba8675e", "value": "9f29d81d7d0a675884122317509d006a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51f3e2cf-05b3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629902827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629902827, "uuid": "a1e86954-0b6f-4cb7-911b-3d3bb5509c19", "comment": "Malware payload (RedLineStealer)", "value": "cb91f8052839d8c58cbfb6dc39e88bb8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629902827, "uuid": "bf83e071-0f04-4216-92b3-987460d75d1f", "comment": "Malware payload (RedLineStealer)", "value": "40c104c6094a998efa758c6d7f2a2501597b9e748ac84027dfa1dcb3936196d6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629902827, "uuid": "bd2e0790-c491-4eea-bba1-955f980c65ec", "comment": "Malware payload (RedLineStealer)", "value": "3b97432aafe31684767ef0f18fe5af624462911c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629902827, "uuid": "7cfabe0f-b52b-490f-a69a-f6a5ac149e0e", "comment": "Malware payload (RedLineStealer)", "value": "12de9e4f6a6722dd558e94f79cb69ccc3019e3d76855a30317430ff67f464a66e0eb63ead33ca5dc9213e332ce651e4e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629902827, "uuid": "08b10797-b340-4a73-8091-4d71ad523f33", "value": "T168A53385E725D1CCE90450B498DC7ECB7AF882B4E37A8594D2DC9A1B3A9C347911EE33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629902827, "uuid": "bbddec5f-d1b2-4617-bb34-922fb7e93ebb", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629902827, "uuid": "2e06cdb4-ad73-4697-acf8-b2d2c1bf1a74", "value": "49152:1WEpokElR6gUS4qbU/xqWEEAyC1QNa/kpLyZALU:1WEkKgbYIWEFWNa/HGLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629902827, "uuid": "df393048-dc6a-4832-96f0-5a55d8c5054b", "value": 2181504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629902827, "uuid": "346af885-5736-4981-bbed-74f376e22b7b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629902827, "uuid": "d71a6a92-7c3b-465a-93e5-ff311806735f", "value": "cb91f8052839d8c58cbfb6dc39e88bb8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03431b7f-05b9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1629905272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629905272, "uuid": "75515c90-5ed9-4de9-8553-6944b317a394", "comment": "Malware payload (DanaBot)", "value": "bb874cb4d90e2708e614bd89ca7df3fd", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629905272, "uuid": "8975fd95-f2fc-4281-b3a0-c5555881a6f9", "comment": "Malware payload (DanaBot)", "value": "423d9cfa5ac46d2ebb867f1b51dc844f4b823c4404c82b16ba611a1032040bf8", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629905272, "uuid": "cbe17a09-c6bc-41ec-b4f5-7adebbb08f61", "comment": "Malware payload (DanaBot)", "value": "3ab2c92ee7f00e03e267d7899227bed3f9010834", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629905272, "uuid": "0afd6c5f-11dd-489a-aaf4-1242dd912efa", "comment": "Malware payload (DanaBot)", "value": "f8550eb860a9ec430cb7dbd1698d182583f370c28718058c18ce89ef545cca23949c2534698af39d4f833b0566ca0242", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629905272, "uuid": "dd2f4ed3-ee4b-4235-8662-924c206e9203", "value": "T182450230AA91C035F4E306F855BA4278B43E7AB1AB3491CB93D526EE17386E5EC31747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629905272, "uuid": "9946d172-ac4e-42d7-be7c-4b815e9f0cb7", "value": "535d66f0a9f5169be6dcc4e55997b651", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629905272, "uuid": "178fbfe6-1fd6-46f4-b91a-15a9e6e27d0b", "value": "24576:hJEjs8qjMhtRZMeLOl8Yy7GZoCFvrTh6v326TQv:0s8TMYOXOGiCFvrT4+j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629905272, "uuid": "7c0a1108-5cd1-4668-bcce-76b6ac1b8931", "value": 1184256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629905272, "uuid": "09667d1a-46cc-4553-b7b7-c15d7f011ffb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629905272, "uuid": "b080f3c2-ebbd-484e-b64e-a50aa90f625b", "value": "bb874cb4d90e2708e614bd89ca7df3fd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de1dc943-059b-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629892754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892754, "uuid": "db00ed23-1787-4136-a59f-c7739c1c4041", "comment": "Malware payload", "value": "e17fceb786cb0c72fd84c8d6288419b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892754, "uuid": "e0cc54cf-1904-4a2c-b585-c043985aeda1", "comment": "Malware payload", "value": "42558fcc272a61a5591ec5c26fae058427b0a31dfcd06f0afb490c25c2ac975c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892754, "uuid": "90a13265-0336-4d8a-b316-396943a96776", "comment": "Malware payload", "value": "efb97e18514a1aa4641dd14517802c360fcf0240", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892754, "uuid": "6cf3b2ad-90f1-4542-acf7-65964902c564", "comment": "Malware payload", "value": "355722ee27ddaa2c1b6505cdf58ee51b8cfacb1246331677cb46f5a061c00aac526c6bed71016ac59afde1098cc6d86e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892754, "uuid": "3c4ce757-e3c6-4e3f-9e74-d3688e4c37e4", "value": "T1D5F48D7433DE199DE2A150324930EA58BA7ACCBE7A43872E21DA1D2FB4E7058C3D515E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892754, "uuid": "49506d76-240b-46b2-9f62-91df4bbce0a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892754, "uuid": "48f7999b-0fd1-49d1-bbd9-54a9fd6c784e", "value": "12288:e1VL0denef5+G9I1sQc2iNF2iNi4QissaMJcR/V:eny1j1esId", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629892754, "uuid": "516d11cd-8a33-4384-92d1-8703f0da30f6", "value": 774144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629892754, "uuid": "c2e6431f-7f35-425e-a96b-72315bfae246", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892754, "uuid": "91ee4a9b-3847-4d49-8d23-b06c8405d413", "value": "e17fceb786cb0c72fd84c8d6288419b7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7044ad8b-05ce-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1629914474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629914474, "uuid": "f96c5d75-4986-4770-af11-7ffc14950062", "comment": "Malware payload (AsyncRAT)", "value": "0b42884d755f89f90ed432aea25533d5", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629914474, "uuid": "2e5429bf-da7e-4acb-aa45-cea75198f735", "comment": "Malware payload (AsyncRAT)", "value": "4275ffb3b25d191fc223b959165dcc6a13d9aa080124c2f3be10f230de6da2f9", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629914474, "uuid": "49ee852f-f3de-4a49-8d57-4185eed79b50", "comment": "Malware payload (AsyncRAT)", "value": "f11821195a72f50d08c0df8d9caa9c2eb806b500", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629914474, "uuid": "6c820c57-19b1-4fe9-90da-e66ebad761b7", "comment": "Malware payload (AsyncRAT)", "value": "80db1dbc5041eccc5a32a382486450fea0baa22bafef0a1f1dbd267d4c6d2079061d8e6f05b9b8f41222c5eca1edb1ea", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629914474, "uuid": "1fde8605-1f07-4259-9ac6-e17511634134", "value": "T111229D513B1D1B35C99AC733A736F0BA5B8571368ACBCB85711CBB100B5AA85E2D3C81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629914474, "uuid": "9e8850b4-970f-4c1b-97bd-60ef91fbbc7c", "value": "192:OLh1quAeteuRhc5DOJ7LHDoMmP8XXbi7x/jKgE+7t0d/Jq3kk+P9KcMEQm:iqupEQhPHDoxnd30d/6+KLEQm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629914474, "uuid": "8254843a-59c5-479a-9f92-f43075d85e7a", "value": 10291, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629914474, "uuid": "03f6327e-22ed-4906-a462-5f01282aeefd", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629914474, "uuid": "8e12320e-6bc5-4b6a-b256-6e910b3fffe1", "value": "Fancourier 25.08.2021.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "577d9138-05cf-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629914862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629914862, "uuid": "6d4eb801-6c1b-4b89-967c-89c399d6261a", "comment": "Malware payload (Loki)", "value": "60ad1a2397b679861b324460d96bba56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629914862, "uuid": "a14649c2-d5ab-4516-a9a7-2036b90dd117", "comment": "Malware payload (Loki)", "value": "42dff3b3fb6effeeb3a6c4ff8049cc698689d3a2bcb4544931593374d9b43501", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629914862, "uuid": "9769375d-a3bd-4c8b-a98d-8aa55935d22f", "comment": "Malware payload (Loki)", "value": "36d96fd1c92497e227d21916717e083b757c4174", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629914862, "uuid": "8eb77918-1321-4c38-aa6d-b56bfeee473a", "comment": "Malware payload (Loki)", "value": "59a7560642fb7f67eec92e87bbd395244002bf8576201cfd7b08df0951a781081472aeeeacb92b6b9019407a1999703c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629914862, "uuid": "d42b1686-e0bb-4e27-9c9c-731feeaa46a2", "value": "T128F4817E1ABDA22781B5C2B5EBE75417F0409B5F3410AC2576C203664232A7BB5F732E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629914862, "uuid": "a21fc76a-5e32-4a68-bda8-f039ef58cadf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629914862, "uuid": "559435c6-163c-41a3-9b22-11b56e5cd2b3", "value": "6144:iatDFlmC6TzN1lf9y2XZ3NHFkAZyVjdnpSeLzN8NotjPtSlgDN7Go2HyFxI:TtD6LnNHvXZ3NHFeVR5zN8Wtjl3/zFK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629914862, "uuid": "d9148348-b305-4ef2-b345-d0e27ad85275", "value": 776192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629914862, "uuid": "1560b626-542e-41d3-8f81-745c3af1a641", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629914862, "uuid": "7f3153df-bd2f-46f5-8dcd-2183804476d1", "value": "Detalles del banco.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f780113-05ce-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629914473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629914473, "uuid": "9ffabb21-559a-4e05-a7e1-5a5f2c7065bf", "comment": "Malware payload (AgentTesla)", "value": "0504ad342c1632cf221b1c9978fc6a95", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629914473, "uuid": "fd3dba55-5b89-497f-acdb-cab38c94e83a", "comment": "Malware payload (AgentTesla)", "value": "432e0271b03dc444f267d927330b6593a3a20a62243f9825b46e6c72b4f623ca", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629914473, "uuid": "5abf5e03-ab2f-4606-b0b1-545160b544ab", "comment": "Malware payload (AgentTesla)", "value": "37d9cc6fb91085b3459a061b594bba0d213846d1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629914473, "uuid": "9a6c7bed-96e1-427a-a1c0-5aa1b9ccce34", "comment": "Malware payload (AgentTesla)", "value": "2d5bc3886c6c176e54b040a42e338285b5b6750952f4f83a346c89f65cce32822a21e10946c8b99b8814d0458d380c2f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629914473, "uuid": "9d9f8d9a-984a-4916-a99b-3eef5ea593a4", "value": "T129A3FBACC45706948F8AA7B82B1F5F85018CBA2EF788A632767C173517E6D3A5013D7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629914473, "uuid": "cded58cc-02c6-4964-8908-391eae2fbe26", "value": "192:EzTvldQSy83Hxsegl2ebvqQrxPEGD8w2wFiWudIEn5M5ydXhOZag:4NdR+e62ejd8wbiWGL5M5ythOZb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629914473, "uuid": "c69929c5-7373-4f41-8529-4900a496018e", "value": 97995, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629914473, "uuid": "9ec49cc8-f5c2-4380-8f33-86931c358a41", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629914473, "uuid": "d79fa248-6eff-4ac5-8f99-e5f15a7ffb7b", "value": "PO 3313856742.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eafeffc9-05cf-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629915110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629915110, "uuid": "02961d82-15e7-40b5-95f9-063a83000a7f", "comment": "Malware payload (RedLineStealer)", "value": "ba5199b37d013a27f8b20ae1d19545ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629915110, "uuid": "e6fe7653-e96e-4006-9342-219c22679d6d", "comment": "Malware payload (RedLineStealer)", "value": "434c9b4e79700ccfe8bb71a24861eeb3d24869b7ee9c0a4ebb83e5ea144a8873", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629915110, "uuid": "35ce9cbc-713b-4309-912d-df2b106b5adc", "comment": "Malware payload (RedLineStealer)", "value": "0efffdb7b735cf3e6d68dbe927c6f94ab5c5deff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629915110, "uuid": "09028bcd-f9e9-472c-97b0-8f21e19200a1", "comment": "Malware payload (RedLineStealer)", "value": "8dcb085b1ef2e7874a05c46706e0471c6a7c96bb01f95b63f90e36bac20876344a26dcc17f6f5cac829dc009ac2bc549", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629915110, "uuid": "8ed26918-f1e4-425e-9f28-baecd1b72e56", "value": "T14255B3289C6571CC742EB18D4E3245E8539EFDA620A2EE2376DD5B328557D9CEBF3800", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629915110, "uuid": "370762a4-c9c6-4688-bc7b-bd6a429bfc23", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629915110, "uuid": "8904abb7-cb7d-4b61-a623-b88a9e76dadc", "value": "6144:ei5HqF/lHOX1JYUDSa5NiqzMA/rx0U4rreGlNRh1JP2x0NI6MoyHpR1X3Xb2ZMXD:eOF0V2qEoe1X3Xb2ZMXFY7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629915110, "uuid": "ea387532-6669-4344-8400-39b64fe914d4", "value": 1302016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629915110, "uuid": "fbc79cb0-a5d0-4647-ad74-4b8a6fd31c9c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629915110, "uuid": "0f5301b3-9ea9-4372-a69d-9db35664d18a", "value": "dock.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "257e919f-0577-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629876982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629876982, "uuid": "92ef7812-dda3-425a-aeb2-1b5f503b5da8", "comment": "Malware payload (RaccoonStealer)", "value": "d6cbd1aa38a5740e5193c56333af4892", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629876982, "uuid": "e7a3ff68-a058-4cfe-a623-084d160c34b5", "comment": "Malware payload (RaccoonStealer)", "value": "445308d32bb054d994e64af2cf8dd5012ab6de2101ff73fb056a693f8cabb7f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629876982, "uuid": "c003e0bf-f3f1-436f-b8f1-bcb5d5bad3a6", "comment": "Malware payload (RaccoonStealer)", "value": "5dd3e70f51c6adb24091cc0a090d5d6db3a42381", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629876982, "uuid": "49403e5a-ad5c-4903-8ba2-f4053d03d8ce", "comment": "Malware payload (RaccoonStealer)", "value": "1fa825715f0b7cf83c085b0100b4d3b42a836dbcf037bf4f9988f2a79dca7210549b755fc001ab5731372eb63a449cc0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629876982, "uuid": "9e6f9bda-7bcc-441b-842a-5e8200cdf032", "value": "T148B4E030AAA1C035E9F211F855BA8379B53D7EB1AB3150CF52E51AF902386E5EC30797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629876982, "uuid": "42d2fc54-f731-413f-932c-c67070e7c389", "value": "b1f244737f482f7370a4248faac2bcb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629876982, "uuid": "9c9f3353-bf8d-491d-8d4e-02781a8594fb", "value": "12288:D7d1AtmUtlaXLHpSdh+o1t1v1vKNWasl17im4AVRh+Q:KmUtTJnv1vGWasbx4ARB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629876982, "uuid": "7cbce12c-977b-4404-93e6-50e4b00c8fed", "value": 540160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629876982, "uuid": "033c4993-4b63-4bf2-a650-6d30ad67592d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629876982, "uuid": "cc22efb6-b33d-4747-a3ac-f315bdc0d64e", "value": "d6cbd1aa38a5740e5193c56333af4892.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7e2c2ed-0537-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629849740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629849740, "uuid": "d4e2eeff-ffe3-4d90-a255-e0e37c53442a", "comment": "Malware payload (Mirai)", "value": "7a293d4c99c3fbc049b3e2b49c173e5b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629849740, "uuid": "abda337c-b814-4447-8539-21e4cf9077ad", "comment": "Malware payload (Mirai)", "value": "44c707d82f1d25301bf777392cebca317114c4abaa82a0ad15387a957655fe83", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629849740, "uuid": "6906ccf0-f35f-4791-8634-7b42d627be3b", "comment": "Malware payload (Mirai)", "value": "b5e488b6febb3cc693fea5da17e6edea7609b2b6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629849740, "uuid": "92511410-989b-4db0-aa4f-da3cb1b5c275", "comment": "Malware payload (Mirai)", "value": "d0148cb18a2a0b6935a03951142917ea096086b873cf50af98f76bf75845435ee79004a1067f34b28957ef7f493fb152", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629849740, "uuid": "a793f01e-ae9b-471e-883c-caad4d73562e", "value": "T154233A427359094BE2571EB5393F0BC1A3AFEE8021E1F184B99FDB4A8231E331546E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629849740, "uuid": "12d0c977-53af-4c33-b3a1-36675750969c", "value": "768:B7ccqIracxbbfu+qkvQJWP+yOSePapYhOj8VNLpzbFI+NILl/GFLtoW:MI2cQf9PdPaOAjYBbLNIBGFLtoW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629849740, "uuid": "8ae64f60-9b4f-4710-9f6d-30ab0b4f23cc", "value": 47008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629849740, "uuid": "7dee0875-808a-4671-8dae-02937d10b8e1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629849740, "uuid": "275b3f9f-87f7-4bf9-94ca-d020bec83b22", "value": "7a293d4c99c3fbc049b3e2b49c173e5b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c8b26ab-05a5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629896859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629896859, "uuid": "997b133a-c955-4d37-872f-e1685eb42423", "comment": "Malware payload (RedLineStealer)", "value": "a8a411c6c696fd4419ece1989de507c1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629896859, "uuid": "d8637c84-a595-4f36-82d0-049a512bf592", "comment": "Malware payload (RedLineStealer)", "value": "454502a482ab39089110794df0396bcaf031fe9dd4dbc38ab7a9e45244756b04", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629896859, "uuid": "5b43e1f5-bdca-49dc-9255-3df6a9d7b125", "comment": "Malware payload (RedLineStealer)", "value": "501d6dc6f3fdc7a9b9c1eb49015e74d9f667bf11", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629896859, "uuid": "a747259e-a030-492f-83e5-b30ffef666a0", "comment": "Malware payload (RedLineStealer)", "value": "0607f9615502d0b29c56e96a8293d7813311bd77c3a365f556909ec351cfbe62d7652615af180ca6c9a292becb63bb00", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629896859, "uuid": "d12d6b23-4342-4441-b676-208222eaf01e", "value": "T12474BE30AAA1C035F4B712F845B583BCB93A7AF16B3450CF92E526ED46346E5AC3174B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629896859, "uuid": "ed0be365-7b1c-43fa-aaad-a7b86d15a2cd", "value": "35372ade599ee63db174ac99307517b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629896859, "uuid": "8f2b876f-d6bf-4101-b95a-eabf0e44fb50", "value": "6144:QCV496OVPDuzlaH0zU8Bf3Uss+wBYJ0rUlvVDN1pORx80vgyzF7+:3pqP2lTzU8B8Z+arSdrIYH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629896859, "uuid": "2a90b13e-2987-4adc-bc06-0632d7025214", "value": 355688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629896859, "uuid": "7582dc67-ce89-411e-94cf-295bd9139273", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629896859, "uuid": "ba08aefa-727b-440d-97e4-4df0e07374ab", "value": "a8a411c6c696fd4419ece1989de507c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05fbddb0-05be-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Hydra)", "timestamp": 1629907424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629907424, "uuid": "5576a7bd-ed92-4730-8a11-46dbe62aa5b2", "comment": "Malware payload (Hydra)", "value": "804a18c229614c92d0be806056ff8fe6", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629907424, "uuid": "2e39c31f-5692-46d0-98de-5a90c7456fe8", "comment": "Malware payload (Hydra)", "value": "45598745a90bac7335e21583bb5ee09e72a5beb47ab1d45f0ba3fdd0ddf2868b", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629907424, "uuid": "8077a2ff-945f-4176-bdc7-d6af04f85481", "comment": "Malware payload (Hydra)", "value": "c91f728bed9faa15223744e3e8bb859d9c6f624a", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629907424, "uuid": "ae6fbbcc-1faf-4de5-9b50-88893916d07b", "comment": "Malware payload (Hydra)", "value": "8674d2c008ff50b3ec47dd74154a8df0f416fd894dffd540dcc8c2731b6d1d0bf6a45d0e6cace7a56de9c7f180f0f86a", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629907424, "uuid": "5356121e-47b9-4210-9d2f-3a88fd984bf0", "value": "T1CAF533D6EAD2852DE18F8C3906DAF8A6D4035341580DF41F542005AF6DCBF3E1A67DEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629907424, "uuid": "724779ac-50c7-49db-84eb-4fa03da8675c", "value": "98304:xEGhv1Jw1viCDMe0Y+0ivDDTrXDwufSQ3W38:x1h9JwhID3nfb3R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629907424, "uuid": "ea4c6573-4f40-4afb-93ba-0248e1c50061", "value": 3367537, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629907424, "uuid": "6988574f-a4fd-4510-bb2d-d2091ca6bace", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629907424, "uuid": "83790438-d2eb-42f0-a255-154cd6b1eba4", "value": "19756_Video_Oynat\u0131c\u0131.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b5a1be9-05a5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629896937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629896937, "uuid": "570ccb03-098e-4d4c-91b5-df1902765597", "comment": "Malware payload (Dridex)", "value": "25d874573154be6d3d14ae6e97426536", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629896937, "uuid": "61aefd54-5809-4dce-a4a6-c310d9b67bc9", "comment": "Malware payload (Dridex)", "value": "4583e87b6fc0bc83030af01bdfb800be4d3ee3807b22b28e263447ea2f863a36", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629896937, "uuid": "5c2aabdb-98ed-4a62-88c9-31294ac2a3bd", "comment": "Malware payload (Dridex)", "value": "b1d9b15f13c242d449104978d9fa8541cb233188", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629896937, "uuid": "e7e79820-4740-4d14-9900-bcb0ad1eff19", "comment": "Malware payload (Dridex)", "value": "ebf26f4fe5eda1583d9975032c0a89dd985af88146fff35a6104e44bea9c77386dd89ce0e3d3041d2fe2fb92dfda8d68", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629896937, "uuid": "87ab3194-a1af-40cc-98fe-81b488194fa5", "value": "T1C875D0126AE887CFC4376433582461B4F2DAB91784BC8F94DB86C30B5EEEAD4EC449D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629896937, "uuid": "1e30690e-12fc-401d-a8be-d3fae2fc64a3", "value": "fda3a22e2f2e36b962ee2cf265556e81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629896937, "uuid": "3a487844-31ed-495c-b42d-5ea20f10282a", "value": "12288:cwYQM2lWq8d6pwkoGnfwK0LkH7/umY06KrzzWUU3VACBET:RYgWRR0w74bbvIVAC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629896937, "uuid": "0239fff9-26ab-4c8b-80e0-275397b53b8e", "value": 1613824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629896937, "uuid": "6142c5fb-66c0-4eef-a15e-8ea65b7ac87b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629896937, "uuid": "36ef9a23-d956-47e1-b7e2-ef21fb699bef", "value": "4583e87b6fc0bc83030af01bdfb800be4d3ee3807b22b28e263447ea2f863a36.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8fb80c6-0564-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869123, "uuid": "a4a59357-45e3-41e5-b66a-5f51f8d901ff", "comment": "Malware payload (Dridex)", "value": "5dec2fd17c61bd9664f52620395618b3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869123, "uuid": "398d218e-9943-482f-818f-835e406a337f", "comment": "Malware payload (Dridex)", "value": "45a7d49bb0e6703786cfb825dc1b56628a3f4460d77f3eec0404e4c7abc49599", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869123, "uuid": "aec0f715-978f-40df-97e0-255ada118b84", "comment": "Malware payload (Dridex)", "value": "d56a70853b5d819cdfe56388f6571b146ccd3495", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869123, "uuid": "281fb0eb-9870-44eb-8afb-7feb20e0851c", "comment": "Malware payload (Dridex)", "value": "08abbc2b2c74c54fc853c77b0d2c543fb3f8cb07a3382e4cea4af1c0783e607e6aac0c6cc79ab319f894a42f9c0b18b1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869123, "uuid": "811a151c-ab4e-46f2-b52f-9e72f7426db4", "value": "T1ADD3E0DB6577CE4CD02D833C45EE1FB22F74DB5562E26616212CE8287F234EACB45219", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869123, "uuid": "20e078d7-cec1-4916-805c-a49f32d4e6b1", "value": "3072:oUu3w3JJZBFkTVTk/X+2ozTwoAQZXi63LD6z2qoaaaaaaaaaaaaaaaaaaaaaaaax:oJA3J/BFkTNk/Ohz7xA67MoaaaaaaaaB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869123, "uuid": "0b00666c-167e-447d-a884-44dadf782135", "value": 138760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869123, "uuid": "a2a5b183-aa4b-4325-839a-4eb7d0e70099", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869123, "uuid": "197c3cc1-ee6b-478d-b8f8-78e07e5fdeb0", "value": "Scan-471771243_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e23cad3-05be-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629907572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629907572, "uuid": "3fd238cf-2172-4ed1-8dfc-5bfd47519330", "comment": "Malware payload (Dridex)", "value": "a16edf648683d332fd82900741bb69cc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629907572, "uuid": "af6b82fa-4376-4c17-8481-e07ab0892b69", "comment": "Malware payload (Dridex)", "value": "4623c6e89423682821cc725e052909efc7705493ab3626d49cdd40f95a0fbe18", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629907572, "uuid": "708250fd-0b70-41af-893f-d5ca74253bf1", "comment": "Malware payload (Dridex)", "value": "d66f878fc0fe1f0429f7385663203c15c0a45fbc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629907572, "uuid": "d92d0703-c631-4856-bdc3-378b161233dd", "comment": "Malware payload (Dridex)", "value": "0fe485aed2a0cc8e9f4e4a08e3656fb29f6669e54002f07db728a8c35147da75e404042051d8720636a948730fbe66f5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629907572, "uuid": "63694918-5b8c-4e2c-92ad-4f76518ad615", "value": "T1FA14DF82CD9F46F9C21B167139F531BE21E80645A769CC2BCADAD2FBF47D300D46261A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629907572, "uuid": "e26e2c9f-0c7a-4769-b88f-9d0dfa147db4", "value": "15d931f2533164c416970d03fa5b5c88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629907572, "uuid": "6b05ac1f-9482-4be4-816b-83cb47ce58ac", "value": "3072:pH0uyjZqEpAK+Gf78TBdrXkTM5vhRg9Esf0DwvtyMpVnpA+z6tX8sxKViWe7dU:pUua/Pv7YNhRIEZDeXVpAxtMsxK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629907572, "uuid": "8a4683bb-5c15-4423-9d98-f8aa77269dde", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629907572, "uuid": "ed695f4b-377b-416c-ba31-f487a5b75196", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629907572, "uuid": "6b0a1625-fbe8-4ff0-a7db-d6b9d78e4868", "value": "a16edf648683d332fd82900741bb69cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e878baf-0586-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629883494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629883494, "uuid": "2d87f38d-d2b0-45bc-8ef3-5341251a16ff", "comment": "Malware payload (AgentTesla)", "value": "a803d6ca253630ad1c7d2d23623ce731", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629883494, "uuid": "47c3ac29-ab4d-4c06-a93b-86784ef602c8", "comment": "Malware payload (AgentTesla)", "value": "46959d4314645da51a2b56b9da0f5ce4dcd67a4f3867530ad16b99ae719223bc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629883494, "uuid": "27472056-5a8d-4b0d-a218-9a334b35c753", "comment": "Malware payload (AgentTesla)", "value": "07dc5ed1f4165fb28348f56f8708d5a8a1fb6326", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629883494, "uuid": "3852ec64-34bc-4fd2-9f35-25f3ef020eca", "comment": "Malware payload (AgentTesla)", "value": "a6b1370f9d9995c01ed4bdd3ec42e7e1ce799195997a2f89f752442a6e8e242487f0eee1e5305455a130ec7fb195f4be", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629883494, "uuid": "c9113394-9665-487f-b7ec-5d2c81ed3705", "value": "T1F7359D287380B7D6D8A50FF24823358893F3E5076635F75F28D966D82D31A1B8F2B652", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629883494, "uuid": "7093a66a-9711-4591-a6c3-16d45609883b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629883494, "uuid": "50ada396-50a7-45ca-9cfa-4ea5c336e667", "value": "12288:1UB41LVmEpD3BgNLbQsLhBN9aTom5Ou2nel++mOVIxQz0TG2hwgE:1UB4ltgThf9aTXEu2v+fexQz0iUa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629883494, "uuid": "04bbbdb3-4358-4943-9eb4-fd5d1a602c51", "value": 1138176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629883494, "uuid": "8f6e4cd9-a285-47b4-ac00-bbbc26f5c49e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629883494, "uuid": "58ff4551-9f21-48f1-ada7-1db00e2dd36d", "value": "a803d6ca253630ad1c7d2d23623ce731", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d00afe23-0566-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1629869967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869967, "uuid": "499a3756-f8a6-4636-96ae-ea1057442aec", "comment": "Malware payload (Smoke Loader)", "value": "2189f14cbddfbb78dcaf7abc7f6d325d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869967, "uuid": "71fd4d32-8634-4903-8448-9d454d4a08fb", "comment": "Malware payload (Smoke Loader)", "value": "46e3758472b1f7b3d2b13da7a5d1c2f9c5c4bd5cb1e70a04a0094c379673d241", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869967, "uuid": "caa9c869-8d72-484b-99d5-2f1fed19a5f0", "comment": "Malware payload (Smoke Loader)", "value": "ea5d0c344ae31d7762aa9d6ba83c15395d74c0e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869967, "uuid": "9422eba5-205c-4927-8ba1-0a226f9f6c9c", "comment": "Malware payload (Smoke Loader)", "value": "3a201904f99ed913855ba6bab25fbc9ac50a24cf7e3e42a1f8c0e8513003fb33b08c99c41fd89a085827da2558ecca54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869967, "uuid": "8cb6e3d5-1e2d-4b46-a43b-dd5970f1aa3f", "value": "T18104CE0035A0C6F3D166447128D1CBB0E6AAB9756EA4460377E9EB6F6F391C0772E387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869967, "uuid": "4719b95b-7f51-49fb-8fd2-6c89989df09d", "value": "bd3c9edf948deca79ee5e78523f1a042", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869967, "uuid": "0f28c607-d8af-4071-aba9-a1ced949ae4a", "value": "3072:yMdNi+zHZD/TjN5Ef14TCgMdZafD4UA1b:yMpzHZD/XEGCb4cxb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869967, "uuid": "1b74ba40-1a13-4770-914c-ce46d2ba7c7e", "value": 181248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869967, "uuid": "62436196-459d-4b12-a033-487a1bd51ba4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869967, "uuid": "124ea2d6-6587-41a3-ba22-195551599195", "value": "2189f14cbddfbb78dcaf7abc7f6d325d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65113f06-0592-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629888686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629888686, "uuid": "4b725ede-2df7-4c70-81a0-b37ae56fcf23", "comment": "Malware payload", "value": "f4c674d714c887756a31fb750e356343", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629888686, "uuid": "b34cf705-e9d3-4afc-a799-5136a5b4b370", "comment": "Malware payload", "value": "46e5a875fd60664bb74edaf8fcca22bd49f2e0c6b845a8cc30bfffb0a4d4922e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629888686, "uuid": "7f4f66d0-2cc4-431b-afa2-c9f6090e9427", "comment": "Malware payload", "value": "ed4a0f3ef8fa6ddb987682620c19f39988fad14b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629888686, "uuid": "b9b8b742-1df8-475a-bec7-c4d955ee102d", "comment": "Malware payload", "value": "221c6b893b11490806471555e9a1e7b7419d9b0b6933341900f2b68c4c5ba7ae58fd5afa5a51efd9012dcda9eb0f4bd8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629888686, "uuid": "136fc89e-1906-43ba-ae54-ffbe7ec541cb", "value": "T1C624397E97BF7CA6DE1632F5A46205864734AE1513D6D7261039B8AACD30393DE0A0CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629888686, "uuid": "a6018e13-47cd-4dc3-89d7-bcd2b513c6cc", "value": "3072:ljm/u82ITVB1m2fnOxXGxzaaV1iwX3Juv:BP+nERWxzaUn4v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629888686, "uuid": "d8950876-694c-4f42-9472-45c719d0ed3d", "value": 216064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629888686, "uuid": "b81a01ef-8964-448f-be20-33bf938c0e84", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629888686, "uuid": "963d5a4d-1cd3-4bd4-8b60-8cf987b1b3aa", "value": "f4c674d714c887756a31fb750e356343", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "533cffc9-056d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629872764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872764, "uuid": "314a7faf-be91-44ed-a3b0-fa4c6586e8a2", "comment": "Malware payload (RaccoonStealer)", "value": "e68c9ab1e33cdd359db792ffd8ea81c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872764, "uuid": "338e1e08-20cb-4c5d-83fc-37ffe33c7a09", "comment": "Malware payload (RaccoonStealer)", "value": "47c68a4ebf7caa03be816b483ff6b037bf6a75e2a40dee3cdd3a58bdec4e7a59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872764, "uuid": "54c51406-01d0-47f0-9faf-1209f24767cc", "comment": "Malware payload (RaccoonStealer)", "value": "4f99c15f5b773964900a7120feb48c3651434601", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872764, "uuid": "22ec45f7-2ad6-48c0-968a-7973ed88959b", "comment": "Malware payload (RaccoonStealer)", "value": "c6253eb92adb5418072809e3ec6cc0d9dcba375124aa8927e105e78a412d1f7b4e18de74a86bbff86f052b0ac265555f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629872764, "uuid": "bb8bd880-b043-4194-861f-58a65a12bd94", "value": "T1F8A412C0BBA4C873C42A46738CD2DEB5923DB5515A7042833BF8DF5E5F656E03A2B285", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629872764, "uuid": "f21abf9c-3d62-44b3-b889-8ee21643f76f", "value": "bd3c9edf948deca79ee5e78523f1a042", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629872764, "uuid": "da50e6a1-2f3c-4914-9068-a335905ca128", "value": "6144:DFPldAboZU94Nj75jEoHD2TNzmShaHrcduO56LKwDu6o/mB12TQjFhooZy+k2cxb:D66dp7jD2ZzmShaHr7LKPhm32yn3vcF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629872764, "uuid": "9c704a7c-384c-4e74-97f3-cd2ce2d7d685", "value": 467456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629872764, "uuid": "e8805744-b1ab-4499-b89a-f575420fc19c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629872764, "uuid": "b161523e-d60d-4556-a6fe-6950490efdb4", "value": "e68c9ab1e33cdd359db792ffd8ea81c6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "259b18a2-0570-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629873976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629873976, "uuid": "1f251bd6-38dc-43f5-a310-7f5e3d36c2da", "comment": "Malware payload (RaccoonStealer)", "value": "03fd31222d4b73f3c8a62ac31d928596", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629873976, "uuid": "9b527cf1-71b0-4a0e-8659-076739de6f4b", "comment": "Malware payload (RaccoonStealer)", "value": "47e0d99ecad391a79c496c5cb42d6576c24642bd9bfa12fa59ab946277d26a10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629873976, "uuid": "53350356-75b2-4c99-909b-f49b84e3de2e", "comment": "Malware payload (RaccoonStealer)", "value": "fa3332722b6ba54b4945743e62a9fcc21aad8a2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629873976, "uuid": "b75540b5-ea4a-41dc-961c-f00b1c385c66", "comment": "Malware payload (RaccoonStealer)", "value": "027ff6def0bcd16ea5bdf1d6b1dfd7778746661c110e14762337b2ca3d6407f81f8f4905cac2a939d4c5034d798e729b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629873976, "uuid": "3ff6ca12-fd1a-4ab2-b10e-7b18e5a8d87e", "value": "T17E84BE30AA91C034F9B211F895BA83B9B52D7EB06B7540CF53E516FA1634AE4EC30797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629873976, "uuid": "b0b2516d-e7d7-405b-b702-2d3803520009", "value": "ddbb3eef631957f988f10b48742f9549", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629873976, "uuid": "6072b6e1-f86a-410e-9c6a-de067626c02b", "value": "6144:s5eS4PYivjHJIAlgBmGDgCDHpzb9k5GORkfUW0VOSbljzF/2GxYpuE/3:PSeYiLpIGFGDgCDBb7mkfRSbj20YAM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629873976, "uuid": "538f8eae-3e95-4e47-a719-e6575832fdad", "value": 384000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629873976, "uuid": "97fdc0e7-0e10-4509-916c-6f59c6bf1416", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629873976, "uuid": "d75d56e4-0c99-419f-98e5-de9ac58c6838", "value": "47e0d99ecad391a79c496c5cb42d6576c24642bd9bfa1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b398c596-059b-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629892683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892683, "uuid": "061f9e15-c0e3-4ad5-a20b-2c354f8b03f6", "comment": "Malware payload", "value": "0ec75bed31ac00f5f5ba7dca981bf84f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892683, "uuid": "3159f1c7-fc49-495e-9373-8e95212be261", "comment": "Malware payload", "value": "482fc5bb5920b1700089ecc4c3257dad41d1726240fc40bb94ff7629d9ef0b96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892683, "uuid": "787848ac-8208-4727-bd2e-f1aae7a03322", "comment": "Malware payload", "value": "ad724033c7da713c259b8b4ef41813c1a645bdb5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892683, "uuid": "39731594-daf3-4726-99cc-e5bd913a5f13", "comment": "Malware payload", "value": "752323d3d507ea5686cdbc730288dd9891979c4fb3eeee627be03aaadf1524202646f4904cd8eb6cb1e4000bc98feca3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892683, "uuid": "06fd768a-3121-4ad8-8aac-73a9ea70fefe", "value": "T190250130B6E1C034E9F715F485AA83B8A53D3A715FB440CF52E52AEA52346E1EC3179A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892683, "uuid": "cfd03fc6-f8c4-4adb-b949-34b7ac2d4885", "value": "b1f244737f482f7370a4248faac2bcb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892683, "uuid": "c372c3c7-9d3f-44b3-8cec-df0220664deb", "value": "24576:61u7VDE3EYhanCyuoT3MYERV+u3m943mH4cH3bw+7sYQ:6QDyInCyf7Mx+63L43bXsYQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629892683, "uuid": "6b07782f-59e4-4211-badf-cda1c478c3a8", "value": 1007226, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629892683, "uuid": "c7e54ac6-a5b3-49f3-8cf2-e3d3652b1456", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892683, "uuid": "50a9d436-7026-4f3c-b6a1-0a41cc71276b", "value": "0ec75bed31ac00f5f5ba7dca981bf84f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c515e760-0567-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629870378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629870378, "uuid": "aeb39761-b301-4998-ba4f-244474957421", "comment": "Malware payload (AgentTesla)", "value": "7b3508760ad3f69934340180e2fc14bf", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629870378, "uuid": "9e4cef53-61b8-4de8-937b-7ade1f5c90a1", "comment": "Malware payload (AgentTesla)", "value": "48719e21246a6c5ac92ee5a01cceb54c04be68b2d1bf8f0d6f6aadf92a6e66a0", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629870378, "uuid": "fcba11f6-d395-492c-9b3a-fab3e7179504", "comment": "Malware payload (AgentTesla)", "value": "9fffd838f49730603798fa067187becdad4b608a", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629870378, "uuid": "f18a011b-2537-4e8b-bd29-a0d728cbbf5e", "comment": "Malware payload (AgentTesla)", "value": "a42ed52a997edb4b425da792cff3b2496ea3a77d4c25b9db20b6d9c729e6bc042d5b4b7557963e99299d044d6ee44aaf", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629870378, "uuid": "d5a245d7-8e42-4117-b683-ee6b5bb0bca5", "value": "T1AFD423E15B5E973E1D90A3F9B535B3ECB9279A0043FD0C3EE78C48AAB0509C9D467492", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629870378, "uuid": "9977f2ef-9c6f-41ad-bf14-31ebd0c39e02", "value": "12288:xFfFvmug/EiZxQjIgxY5FU84+eKTNh5OTburjF4rEjBMUmAsg1ke:lvmDMwxoIxUd+Lh5OTbwFF4gT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629870378, "uuid": "ea6d5590-ce0c-401a-a1a8-5128838da2b9", "value": 620439, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629870378, "uuid": "510a5a75-cf36-4700-8f27-ec7cb97e8dfe", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629870378, "uuid": "e035aa0a-f21a-4729-9c3b-5f12c5eef35d", "value": "invoice009202109374.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0495acaa-05dd-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629920736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629920736, "uuid": "f0e8d037-b058-4cd1-aef5-8267e7bbde7f", "comment": "Malware payload", "value": "b5f081a787b1db03d3d319d4327578bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629920736, "uuid": "fc128897-a872-408e-b46a-c59b9051f5ca", "comment": "Malware payload", "value": "48b2a07cdeb78aab82fcfdde2ffef02edf69d9c0a85460994e8e21c7890d2631", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629920736, "uuid": "33312670-4ec1-4477-8bfe-d5ab23c92558", "comment": "Malware payload", "value": "755a53a35415daf81a2dcc0645b535006a735d46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629920736, "uuid": "9ec19009-ebdc-430a-9b73-aa99ed9dac7f", "comment": "Malware payload", "value": "c4ca914905fb23e24dbcce8bba1aba70e6ba559f2dd9e3b4b0418c6f3154b2c35c5300f1ab259eddb52f5b99583644b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629920736, "uuid": "9c27cea7-b151-452b-a38a-0f4cc64f43f7", "value": "T1D2A523C38BD81694CDB139FEAAC6D9D5179E6E3D591018A721797AC70F30F84220AF1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629920736, "uuid": "7f204a17-a6cc-4213-b601-42e86a38490e", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629920736, "uuid": "36fe446b-053d-4011-b27b-d32657266e85", "value": "49152:pw40z/DDWlgL7t0NF+jV0aAMdmdvjg1QN9O/9KC/uNjnD:p7f61vdsgONwgC/WjnD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629920736, "uuid": "1480915e-9f6a-4e23-af20-4ff31bc1cbb2", "value": 2193408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629920736, "uuid": "d53e661b-9e72-4a9b-b2a3-d15640f29c28", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629920736, "uuid": "b44788bc-8279-4eb7-be34-6b310a1bd9c1", "value": "KRAKEN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fadd70e6-0564-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869180, "uuid": "63f2ca75-e49c-447c-a0a7-3eadd39ad167", "comment": "Malware payload (Dridex)", "value": "afc37fe99822a78b3c2b87e30c559b00", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869180, "uuid": "74884f93-3795-4144-a847-409b4bf97633", "comment": "Malware payload (Dridex)", "value": "4989949bd322678be1f9f12b399a7714d9c4df1b0b4c4374c04ed671dc507d7d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869180, "uuid": "a03197b2-f491-4fe5-9b11-442661b4ae65", "comment": "Malware payload (Dridex)", "value": "26bf8bdf3101de21c750f734c16842c8f1c48a2c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869180, "uuid": "2baf4af6-28f2-47d6-97f8-5b4a5f264023", "comment": "Malware payload (Dridex)", "value": "f4aa4b2c9c5cdf49a5f175f1864175d0fc98671b40a2a38e454ac320770be9c7e16aaffeb737ce3f5cd7bcfc69708ce6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869180, "uuid": "90310142-ea13-42e8-bf13-846f683901e8", "value": "T158B3D09A7236CA8CC02D923D51EF5FB71BB48F8901D24717622DF52CAF261E79F84219", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869180, "uuid": "d5df83ab-231f-44dc-960b-65b71b84f8a0", "value": "3072:oUqMOWM3XCF/y9ismgi63LD6z2qoaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa3R8:o1WMHxy67MoaaaaaaaaaaaaaaaaaaaaF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869180, "uuid": "fb2da520-97ee-4692-81f8-16ec938b34b8", "value": 113810, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869180, "uuid": "fbcf7aad-ff58-45a2-8391-b20d43f8a430", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869180, "uuid": "e5085a34-5f9b-4c72-8818-b1819bc50056", "value": "Scan-8737957_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74b6824a-05aa-11ec-8fa1-42010a9c0011", "comment": "Malware payload (GuLoader)", "timestamp": 1629899020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629899020, "uuid": "afeb22da-2f29-465c-aee5-0e15be7522b3", "comment": "Malware payload (GuLoader)", "value": "5073e758d55683960a41329ac32567c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629899020, "uuid": "2dada33a-b32e-40cb-92b1-2be676e5cf24", "comment": "Malware payload (GuLoader)", "value": "4c03824650c28ea39c9ad1aa2a948e730e6bb793b531847f720ff15844008f31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629899020, "uuid": "912b4e62-0699-4271-beb1-c0da7bc5df13", "comment": "Malware payload (GuLoader)", "value": "5f32800946c8b28125ce206495f116fe3f930235", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629899020, "uuid": "9c0a3609-f765-4046-90be-2fcaf18d756d", "comment": "Malware payload (GuLoader)", "value": "56f4a39c435dbbf367442043fc8475c2c39f0eef57da8a7fc9d11731a34617d059ee22e9ea88705b5c5556fe7cc7a329", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629899020, "uuid": "0b11beac-0369-4aad-9806-3dbc6e22dfce", "value": "T1B6937BD9E5D26CC2FC0898B6043E431CAE27B81D52955B57B999363F0FEBEC0AB93540", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629899020, "uuid": "28921517-b070-4981-a481-a8ea540d7b23", "value": "c30053c0cecb6f5e362eece7b268b939", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629899020, "uuid": "409a6ee2-2970-4602-8690-e69e1dfe020d", "value": "1536:GDIiqwhZfjsXaEvluYCTF9dPX2YryCNnE0K/Vx7XD:GJhTGhvlufLex/Vx7X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629899020, "uuid": "15467bec-e1d6-40cc-9bc3-304ec6fc6043", "value": 94208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629899020, "uuid": "4ef317af-5501-4fe2-a1b9-f2b5aed80504", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629899020, "uuid": "32745e8d-3098-4a8a-8a3a-eeff547f6f5b", "value": "ENERGOTEHNICA SRL - Oferta PGAOFV0042676.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6c2c5e4-0564-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869066, "uuid": "a0c06156-4a7c-4ae3-8b7a-7527e56945e6", "comment": "Malware payload (Dridex)", "value": "331247483bdb3a2dbb434075dfedf221", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869066, "uuid": "2355cfc9-4757-4458-9549-58f731589874", "comment": "Malware payload (Dridex)", "value": "4e7962e4fd8d39b1c2b06bcb960cd7f21d9fd0b51ef726a403c3f35b40ae3561", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869066, "uuid": "5e8b50d7-6ba4-4701-a65f-1821757c80c7", "comment": "Malware payload (Dridex)", "value": "3dbd6f425687f0f18b5f851a72d5cd6961460e71", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869066, "uuid": "3e12560b-a016-450b-8bfe-0ce51e7c0f55", "comment": "Malware payload (Dridex)", "value": "14decc7ff6a64c939d589216bb02e030572cb9cd6be0b86f7bcf23667a0d41dcb77164d0f833fe897db52af7e83b03df", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869066, "uuid": "335f10c8-1f98-4af7-902b-08009c6784bf", "value": "T101B3D0E97522D68CC02D823D55DE6FB36FB89B8416A34716222CF82CBF225E7DB44119", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869066, "uuid": "805faa7f-17f1-4e37-a140-fc025da01d57", "value": "3072:oUGpAccW1W9ci63LD6z2qoaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa3RY3PaaaJ:obpAD4W9N67Moaaaaaaaaaaaaaaaaaaq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869066, "uuid": "3ae43112-b9d1-44a9-8de0-be5cd57ac459", "value": 111783, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869066, "uuid": "c601dd40-a58d-47c2-9161-a83d204667d4", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869066, "uuid": "30cd0c00-2c77-47db-aa94-27a5dafeaad4", "value": "Invoice-7822_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58ad7bad-05e3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1629923454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629923454, "uuid": "366c49e2-714b-4147-83bc-6c557988ee9e", "comment": "Malware payload (njrat)", "value": "22c5be8c1c5be0029fd1979d4032e177", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629923454, "uuid": "1c62f415-dc00-4db7-b68c-426d1ad38287", "comment": "Malware payload (njrat)", "value": "4ed736782515078d2c602ae701f7b329033e5e84cfd70eb38c088100611f5332", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629923454, "uuid": "3111cd17-8187-4155-b6f4-c6ab0b0836ee", "comment": "Malware payload (njrat)", "value": "476a6ee5ed5b6174570173ab21b21be836abe0b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629923454, "uuid": "f180a501-0c22-45ba-bba5-9cf1cb7b05df", "comment": "Malware payload (njrat)", "value": "50bb79e1dd5afafff9b71fe81250a4bfdc1e1c6857b6f40eea3aefdba619430c829105e6c842c81fceb63358dc20fadc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629923454, "uuid": "4105d49c-1a39-459d-a507-4220c83f4626", "value": "T158C34B0F3B14C8E6CC2C0D3049979971E3BD7D8219538ABF6DB47B9DC9765A09A423B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629923454, "uuid": "249eeeb8-84c4-496c-907d-e4fa39f11221", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629923454, "uuid": "5519238e-f777-487c-8e90-6a15534fbf57", "value": "1536:C7GkuBRWuci8ODLlrobQuUzI95Q44SBLWfiN:WGkq0Y8OD5robQ+5Qw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629923454, "uuid": "d5b6a003-9052-4ca8-bba3-143803ac1c61", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629923454, "uuid": "4373b33c-009f-4784-8b3c-15f331d86f07", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629923454, "uuid": "efcb3cae-e90a-4071-871e-7723764694a4", "value": "4ED736782515078D2C602AE701F7B329033E5E84CFD70.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53e4854f-05b5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629903689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629903689, "uuid": "7e718c1b-3239-44cf-8b99-0e7dd0847737", "comment": "Malware payload (Dridex)", "value": "e0ed159df2bb6b451816b8b48fd77ccb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629903689, "uuid": "b7efa643-1c37-40a5-bb66-2eeb2193a0d1", "comment": "Malware payload (Dridex)", "value": "4ef740da98b7a23dc32bf94dcf2f83aa48285d2c09859e59b456a0f2025b2b35", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629903689, "uuid": "cbe760d7-807b-4b59-ae08-5a7fe750ff35", "comment": "Malware payload (Dridex)", "value": "129362088a2f298ea4bfc38bcbbbc36b629ee850", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629903689, "uuid": "cba38952-1e38-4e6d-8646-6f23b0d79e72", "comment": "Malware payload (Dridex)", "value": "c9f130ab7e96b917adda7e63bbc905f49342609e7f96b8b9efcedd85079987b8a32a1c2c6ddc49af67eb929caba3b086", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629903689, "uuid": "a60f73cd-9321-41b6-adc9-920a1d426531", "value": "T15E740160EBEA6555F5F77731A93A0721572E7D82A838F50C871042CE8A71AA5CDB0F33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629903689, "uuid": "844f947f-5046-48ae-b7d2-41785cba0d72", "value": "e218f655f036f569d7a87ccfa333d177", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629903689, "uuid": "6734883b-d89f-42cf-9d78-9f0f77b3cafc", "value": "6144:r61FoHY1j12PbimfGsE6m4FtWfAvpofL0tJ1PDi7wfaZwln/6kgUB9Z5Dr5kCvjb:lcj12PGYEgvIE9Di7orlikjOCvjbD0vL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629903689, "uuid": "4e46897a-2932-4cc1-b921-278500082a15", "value": 364544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629903689, "uuid": "791c1a63-356f-4542-b29f-6e460ec074d5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629903689, "uuid": "7e84ac41-d468-4e66-ac52-a8a2afab50dd", "value": "e0ed159df2bb6b451816b8b48fd77ccb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac8d67e5-0540-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629853587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629853587, "uuid": "119c8151-b4cb-4219-a0f3-51397b4f66f4", "comment": "Malware payload (RaccoonStealer)", "value": "c760bc60de5dc842274c6df921b9b9e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629853587, "uuid": "a5bd11c3-4525-4124-ac0c-111915ef7a7a", "comment": "Malware payload (RaccoonStealer)", "value": "50864affbe84c631e39e3998f21132f6ff361fb26adec30832ceb7e779573b21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629853587, "uuid": "6c5e8455-4637-402f-8e8d-522b632e538c", "comment": "Malware payload (RaccoonStealer)", "value": "eac1d11485d65cd680de58fc97a7f51e343a2cdf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629853587, "uuid": "21a9811e-bcca-410c-97cc-5dc7433993db", "comment": "Malware payload (RaccoonStealer)", "value": "2667f7d3e2d05f313353f7cee4624ef78683ebb4bd14dfc30a3bc9fe1f25db11f484fe5d9fcc25a3b794b2dd9e129dfd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629853587, "uuid": "7b988059-e1bb-4435-829c-e83ec9a2d217", "value": "T125B4E030B6A1C139E5F711F44A7DE3A869297D716B2040CB63C626EEA6372E4DD30793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629853587, "uuid": "46f8f0fb-cbe1-49e3-9c03-d30d671389d8", "value": "0579ae0629fc2c520498364f1f007f60", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629853587, "uuid": "3f465f27-8abf-48ed-a0f9-48d4a9a996ab", "value": "12288:TTbLpj7a3AkDHU5dlIoCyGHjQ/M7BizF:T97CAxtCySs/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629853587, "uuid": "3e6c66fb-29a2-4a3d-a913-99f495034dae", "value": 535552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629853587, "uuid": "b802c7fc-ffab-4ad6-99b8-d0a57facaa11", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629853587, "uuid": "814f17e4-1fa2-4021-8feb-db98332bfd1e", "value": "C760BC60DE5DC842274C6DF921B9B9E4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "372a12e8-056c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629872288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872288, "uuid": "e8fd210f-ff8f-4e0a-939c-d5d72a591d7a", "comment": "Malware payload (Mirai)", "value": "4f42cec9d0085629773939ea3898d5dc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872288, "uuid": "c43215ae-1c6b-4961-b125-3b7ab20a1d12", "comment": "Malware payload (Mirai)", "value": "5088e951a1b5d9f49e47746188929532d9e8bce30aeef3cd9467a7f25f8d1b3a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872288, "uuid": "aa9420e7-1e04-45c7-92d2-ee2a6c720674", "comment": "Malware payload (Mirai)", "value": "b2030eba7ee8a887707482afea0fdf752ec9a2ba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872288, "uuid": "8f812b2a-3c2d-46e6-b2c9-e8725038ffa6", "comment": "Malware payload (Mirai)", "value": "d4e4df031679ab000387d115d2039b9b9a4bfdf1cfa44b3ffe754a9d32ea08372eed8e4dba61beb0812b1382c3b3cb9e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629872288, "uuid": "d78356cc-c108-4079-a408-cb829cc6b487", "value": "T171731221FED38750CB9530398DF84986C916EEF194FE1D0C1696E7FC17DB46A299C842", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629872288, "uuid": "093c5554-0150-4da0-8c81-7e736351cf4b", "value": "1536:KBJCPJL0V9etbS594Qmd+oBiQPmgLTVgXvNizDUtji:KeIMhS5Id+oBiQpLBgXvNiz4tu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629872288, "uuid": "8c1d63b2-c98a-4f17-aab8-2ad2b11a9d41", "value": 74416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629872288, "uuid": "c05b96bc-fc09-496c-a4ae-e8f173690d3c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629872288, "uuid": "59c67586-8280-4b90-8285-1e324b737e74", "value": "4f42cec9d0085629773939ea3898d5dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2d35309-0567-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629870348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629870348, "uuid": "ac8f2004-4297-47b8-ae89-5b7d67748a2f", "comment": "Malware payload (RedLineStealer)", "value": "a258e8a5ca78f2b87caea0d498da4cb9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629870348, "uuid": "0d23e3d3-0ccb-4882-a61f-785206d68ff6", "comment": "Malware payload (RedLineStealer)", "value": "51442e324f993001dbfaa1ed17ff119b0f392f22e47a1835d89514cd1d77c027", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629870348, "uuid": "52e4a96a-e604-4433-b765-6c54c61db7f9", "comment": "Malware payload (RedLineStealer)", "value": "6caf3c3316d0986054b44390647930fc04554598", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629870348, "uuid": "12471b4c-02b5-49ba-b837-52c624a41319", "comment": "Malware payload (RedLineStealer)", "value": "349dedc473fe62a0d034dad02d5a9542132fe084e2e1cbbeea4556be6fdc2d215b1e1c3206548db99c9dd18b35be74b4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629870348, "uuid": "8694d9e7-c96f-4e94-a23e-e58e02195186", "value": "T165B33B2163DCD629EBFE0B7574B0071047F0E09B6121EB5B8EC264DB1E76B826A456F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629870348, "uuid": "cceb5dff-4525-4ae8-b877-f7e280ce8185", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629870348, "uuid": "83a03792-a223-4791-8cc8-8b877215e6d3", "value": "1536:kt9pmyFJNnOaf/dOiz02AocrCn5tjbuqGdOnMbyq+dJVndDjESG6qTaoig5:KlJNn/f1to2jHzGOnQyjdJjYfp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629870348, "uuid": "5f0b9aa1-ea9d-4b42-99d1-78793b6e8935", "value": 109568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629870348, "uuid": "890af999-a0a9-410c-a94e-e2ae147572ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629870348, "uuid": "6c13b3f9-c196-4a19-8542-285b0b2b813b", "value": "a258e8a5ca78f2b87caea0d498da4cb9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0197a399-0565-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869191, "uuid": "687173a8-edd3-4d68-9879-c6dc20968520", "comment": "Malware payload (Dridex)", "value": "7eba1a71d13f5ff17f56b41c6ca9fa64", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869191, "uuid": "628e3881-1f7d-4efe-b438-4d27d1472e11", "comment": "Malware payload (Dridex)", "value": "51b34eb567ede3e3f07bdda44434b9e29922a84c317535d661f70a648c70333b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869191, "uuid": "83e878d9-fb80-40c8-b901-04737f585844", "comment": "Malware payload (Dridex)", "value": "d5e04f5eb381311659ffcfbca84bec0b1138432a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869191, "uuid": "b0981d5e-909e-43a3-9094-035360dfdfc3", "comment": "Malware payload (Dridex)", "value": "9c8ceb290247215139da0bead254ad07e9e86fe24dbfaa03fa32b0c39b0f683ddfec588a18c5a8c9a686a1940206c6c5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869191, "uuid": "e519016e-20dd-42ad-828e-75be5adc7f21", "value": "T172D3E0987633DE58C12D623C46FE9FB65B749B4502E25337122CE86C6F231EBEB48119", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869191, "uuid": "eb957178-436b-48d2-85fa-dafb05511119", "value": "3072:oUhduwXlept08C+dnnM4kYEvT82xi63LD6z2qoaaaaaaaaaaaaaaaaaaaaaaaaa5:oCd9Gs8lDY8967Moaaaaaaaaaaaaaaar", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869191, "uuid": "26117cc6-749a-4e3d-b553-81fbd7c8cf34", "value": 139113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869191, "uuid": "f31a30c7-c3af-4551-8f7b-58bdccbae108", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869191, "uuid": "c6840ade-c4c3-4fe6-9bb3-967b86857800", "value": "Scan-2203_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5adb9bd3-05e4-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629923887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629923887, "uuid": "c04f2f04-b043-4be1-b6de-2a60790507a9", "comment": "Malware payload", "value": "18cda1978de2846695cb6751e6981ceb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629923887, "uuid": "c37e3f1d-b3c2-48f2-8d94-844cec2fd4ce", "comment": "Malware payload", "value": "51bf9ff43b1aedfebfcf03c71e5bba10a6704b2cf4503e5bbe680221652cc458", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629923887, "uuid": "3c4cd6e0-c60e-44df-8341-b4fbe9612d55", "comment": "Malware payload", "value": "fcc99897c275b6e4c7d587dccf5f160e8ec674f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629923887, "uuid": "4d7b8103-878c-4d65-9e5b-319aa1821f21", "comment": "Malware payload", "value": "da52b03040772b1abf0a26fb07d49dd49a1273a700614b83867be3561eba572e17175ce83b35bfd87440779a845effad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629923887, "uuid": "8ca73ebc-5372-4fe7-b8cb-b1e47da2e3b5", "value": "T1527533D37BA2D279E90419BA44620252C334EFF38045FF5EAD913C4A11B7B2F867476A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629923887, "uuid": "a3a37383-f3a1-49c9-bedf-14613af467ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629923887, "uuid": "5feafd30-0d82-4217-92e9-fe1d9ce36332", "value": "24576:IdLEr2xI6n9pgQoxwMTmhkVa5vIweQ3qRbYl6DLJMv4oVI1ZwF33z5hG:ja6Eg8EdQ3mb1ZGvVkZ+3l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629923887, "uuid": "d6fc923e-0ae4-41ab-bb60-a031b3fd84b4", "value": 1603584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629923887, "uuid": "4e2b4180-c1b2-45b9-b721-0d0e5357a721", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629923887, "uuid": "fe6c5f21-2447-4019-b4ed-664495114c1f", "value": "Kilorum.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "586b7934-05ea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629926460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629926460, "uuid": "0eacc334-b04e-4d3d-abb9-4a6a3c9afd6f", "comment": "Malware payload (RaccoonStealer)", "value": "0ab9a888d5864a13bd13830840d340a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629926460, "uuid": "c1b7be78-5a53-4ccb-a6a4-b21a0f6df9d9", "comment": "Malware payload (RaccoonStealer)", "value": "521c32b660ae4b7e2a21fece4da1fa11f51775985bbd5e19005880f4ca21f205", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629926460, "uuid": "e27809de-f07f-4c06-9520-0ba9586d50ff", "comment": "Malware payload (RaccoonStealer)", "value": "3d91a12b01116d9b31294d9ff65fa9ff0f4ea64b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629926460, "uuid": "ef87344c-dc97-468b-8ce5-10a1ab646fd2", "comment": "Malware payload (RaccoonStealer)", "value": "4f12cfcc301a42be637b7c6fd0d3b177705ed05da19029fce606cc667ef5b019c1d81ea81763b059cd2d50ed0cec50b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629926460, "uuid": "ae595da4-c0a0-4493-ac0d-9f9b850abd12", "value": "T17784CF30ABA0C035F5B752F885B983BCB93A7AB1673450CF52D51AED4A346E5AC3074B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629926460, "uuid": "2735c678-cd98-4edb-91dc-abe667bbce78", "value": "f6ee633166e72a1d10f4f54440093ac0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629926460, "uuid": "7e1e9e6e-e19d-4e79-9dd7-f6dd3b1fc46b", "value": "6144:1zCzE7RLYFDZX+iSRHUkcWhbswvNjXEw1l/eN3/PUrRnBpPPyAPVNQizlvE:Yzq5QDZX+fHUkcW+whHG/cr9yuc+xE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629926460, "uuid": "9617e56a-f3b0-49c5-b873-f0783329fa70", "value": 381952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629926460, "uuid": "7b18ca97-279c-4a73-8c8b-65f3530e521a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629926460, "uuid": "4eb8dc65-0801-485b-9dd5-868d1f930673", "value": "521c32b660ae4b7e2a21fece4da1fa11f51775985bbd5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7791c89-059a-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629892313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892313, "uuid": "027a23ba-bb01-482e-9ea8-775b54677994", "comment": "Malware payload", "value": "57246421e257085e5e637a30df4b9ae2", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892313, "uuid": "3574146c-dcdf-4cac-bbe8-22adca417b91", "comment": "Malware payload", "value": "52725acfbe13c0752fd45a8bfb06dae0e5d11222f8b2e6e5fe89055cea0d29dc", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892313, "uuid": "e2976bab-39ac-4643-96e6-2529d0deffb4", "comment": "Malware payload", "value": "a557042284195602f890fdc1547ef46cbd40d487", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892313, "uuid": "6e08ec85-f203-49f4-998c-6acd6c61da1d", "comment": "Malware payload", "value": "ed709fd9adc0f6fcb06e47dc3ab3e75645f97f40bbdb3a956e5dda24899352d1c119d8200d9157c348c0b20f5d3fb54d", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892313, "uuid": "cd5a4f25-c212-4182-9118-3e1e64532f87", "value": "T1BFC4F16453C00943DC27483FDDEA21F60494BCB393EAC6D1AE65B1C6167B728F6B6E09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892313, "uuid": "458c243c-2327-44c3-b923-89308e81c0a1", "value": "12288:Nd8Gek8XaWH2JR2KoxCO/9IWbFLQLIoASO3jxazisf:jXkhH2JR2KiCOFtbFcL2zjxa+sf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629892313, "uuid": "fc173454-f3d6-4366-83ed-3d2fcb314d36", "value": 553688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629892313, "uuid": "27489870-e769-4492-9d1d-1da53c24066c", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892313, "uuid": "c92b8646-2dd2-4437-b2e2-17ada59ec50b", "value": "VpskOperation_98830049.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0248add9-05be-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Cerberus)", "timestamp": 1629907418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629907418, "uuid": "1acc8e29-32e4-4da9-9699-0131805557fb", "comment": "Malware payload (Cerberus)", "value": "8d69dfc7d3b5c0287d903ab8ae77bddc", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629907418, "uuid": "93ce5197-33d1-4c9f-91da-756f20390fad", "comment": "Malware payload (Cerberus)", "value": "5315585afd6d471dbc5aeb15031c19c3735645f5ec806f87f0c91bf061bcc6f3", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629907418, "uuid": "c5cd7694-c069-430e-859a-3dc166cdc471", "comment": "Malware payload (Cerberus)", "value": "c9b79ab4ad84cd03b9f407bdf317c6016a086921", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629907418, "uuid": "67f003b9-fa85-439a-bb35-05c2d3da12ef", "comment": "Malware payload (Cerberus)", "value": "b39fe7d7b182024b8d8466bb7adeb06c123885d6389eb7e5655e4f0d429566f4b63649c4d420e377041a3943759b50c9", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629907418, "uuid": "9ec10ab5-a23b-4b98-9662-0563ae0f7b58", "value": "T174E5332DAB979968E4274373410B704737E532488485A63F49B8004E1EFBF69878FDBB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629907418, "uuid": "ec39bf45-4bed-47a8-a6ea-8be036a05a56", "value": "98304:q1QJDqWMfANx6wJ3bVUyV2IGDU/oTADeI:q1MDbMwcwJ3f2Ig+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629907418, "uuid": "c315d381-476e-4a65-95cb-6eb9fd3633c1", "value": 3170610, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629907418, "uuid": "65b1e931-ca7a-4e22-b60a-dbdf560a5067", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629907418, "uuid": "22550d75-4466-451b-a89f-60a9b4e38417", "value": "Android_11_Surumu.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11cd436e-05b9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1629905296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629905296, "uuid": "0b5e47e4-7f1f-4f4e-858b-9a0b715a414d", "comment": "Malware payload (Smoke Loader)", "value": "9a482c40f64bbe428dbe08d27bcfd6c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629905296, "uuid": "3e4c3ad8-6a54-4fdc-a2a9-da48d495bc3e", "comment": "Malware payload (Smoke Loader)", "value": "53bae18df82e9e787616370615c0b0af35fe420594843a24d0b32fef5fd6283c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629905296, "uuid": "6d6a39f5-d243-4867-b9f9-159444a339d2", "comment": "Malware payload (Smoke Loader)", "value": "3ed915904a2f712f0f532379bee49426c227c45c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629905296, "uuid": "478414eb-162f-41a5-997c-07979097693f", "comment": "Malware payload (Smoke Loader)", "value": "9b7bd0c4c2f1a6bf820cf8aad224a62e57905ead66dcd775533f4b2ef0b37eeb8014ced5acb0495c9de492c094a74c7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629905296, "uuid": "fb7e20e8-e192-4ca7-b294-f7027f187c90", "value": "T1F7448D30A691C035E4F312F859BA83B8B53E7AB16B3450CB53E626EE42346E5EC31757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629905296, "uuid": "fd380633-c7d6-41e6-9998-a36d944c578a", "value": "535d66f0a9f5169be6dcc4e55997b651", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629905296, "uuid": "dfe3aa22-12fc-4b2b-951c-78673dcc41a2", "value": "6144:yGu4u6QKMVBq0wk7ImVvDe6YR470+OVf5WMfB6zx+LKPw:G8/Mbqy7ImV7dYR40d0MQFayw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629905296, "uuid": "741cfbd9-5da8-4229-bc9e-48cb25df8323", "value": 273408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629905296, "uuid": "755768c7-5fae-409d-98a7-5a225ca0ee55", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629905296, "uuid": "07ba74a7-f845-4fe0-9a12-2d344ef90816", "value": "9a482c40f64bbe428dbe08d27bcfd6c0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23db43fe-056d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629872685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872685, "uuid": "99e9d9c2-d258-416e-a42e-af1e1923a81d", "comment": "Malware payload (Mirai)", "value": "049ba65c191c90777247ea2b2a8e392b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872685, "uuid": "720e734b-acef-4ddb-b05d-baaac09365ec", "comment": "Malware payload (Mirai)", "value": "53e73469b3b11a8dd1ae8d59639fd303cbf4c7be965cf270e3ebfab18d152b84", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872685, "uuid": "59621b8a-a84f-49e6-9dec-1e3c75ea4234", "comment": "Malware payload (Mirai)", "value": "fb5cd621f4315461ecfb4ceb3e02e23e6d15d34a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872685, "uuid": "c84c5ba7-7b8d-47a3-a793-d5c9ed2b16e7", "comment": "Malware payload (Mirai)", "value": "17d990b621298264b5f98ec9bf109003d3969968bb10dd495e94aaf9111bb84a8987e09994f30938fa47dfdccbd76924", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629872685, "uuid": "7e112261-dc45-4a86-b006-6f1fd50f3a99", "value": "T1B313F128973CA813D57413BDE9098AC62B7B97BC70EA35AF1E4A53A909D70D124B43C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629872685, "uuid": "7b5356cf-e331-481a-8a08-648dca7340e4", "value": "768:ibiIyIOiWbO0iPYD/GJVfjufVXu0L8s+0EtHknS8hFdFLPoyFcQTGOBZyCRCWyr7:iLyIOJEQaD8Ae8j0/S0/NPPNy8CWcijQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629872685, "uuid": "295abe54-04b3-4ecc-93ca-fc6cd63f8455", "value": 45316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629872685, "uuid": "f18474e9-13bc-4cb5-9f37-c38157d391ea", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629872685, "uuid": "2c34e242-7a8e-44a9-9ed4-0b8b497fb532", "value": "049ba65c191c90777247ea2b2a8e392b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abcf75c0-059b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1629892670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892670, "uuid": "0443756f-fa21-4e8d-a083-8853a91d8e5b", "comment": "Malware payload (RemcosRAT)", "value": "a63a25a03bc7b717a3421ae14c6a828e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892670, "uuid": "9c2bb2ac-45e7-4e48-836a-d0491d73b6c0", "comment": "Malware payload (RemcosRAT)", "value": "548aefb935e11a84133bd8b3d367d988b9ad2e3bde7f4c0fffcf6a94b529be72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892670, "uuid": "0644032c-e4de-46f3-afb6-d44cef3215b9", "comment": "Malware payload (RemcosRAT)", "value": "57d5591ddefb94af8ff5034711b5d09d55f6b249", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892670, "uuid": "a09474da-2052-4847-bbbb-27252a71863d", "comment": "Malware payload (RemcosRAT)", "value": "c97416a97af25addd5abf3fae725b7b0cbe88357bcf4e5ab38015a6b4ed6a9eeaf3391fd989b334115bb58d53dba18dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892670, "uuid": "ff472831-581c-4048-bc83-908e019f0107", "value": "T10AA5E4E4F82AFE47F366D4389025FA68C6D91091EB02D07EB06AF6B455B3390145EB1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892670, "uuid": "743a8d95-701f-42a4-8529-5e475fc5c436", "value": "c65aff2bab39ef464a2bad0c06b18bd1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892670, "uuid": "aeb3677e-ce57-434b-b0ba-9c4911660c46", "value": "6144:6lj1pigmcVYkJpJpJ1HHHHjHHHHGnnnnnQHHHHHZHHHHr:6Lpib9nnnnnEHHHHr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629892670, "uuid": "3217c3ba-d65f-4a36-8866-de8a06d86ca9", "value": 2220032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629892670, "uuid": "b9ce2c06-a9bf-4f6a-ab18-dc8b059cbc7e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892670, "uuid": "387b55d6-e857-4809-a66f-dfe83a54946f", "value": "a63a25a03bc7b717a3421ae14c6a828e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2aebd7e-0564-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869059, "uuid": "517452ea-09bb-4506-af82-ba9d00140b49", "comment": "Malware payload (Dridex)", "value": "27769a494737638fc8b75033bb03252e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869059, "uuid": "80b58d05-49e3-40d0-947f-4fa774ff6bbc", "comment": "Malware payload (Dridex)", "value": "558aacbcc50755ff47a4339dce681bd7158dc1c5c862fc390ded0e153edb95ae", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869059, "uuid": "f85d9979-9de4-4f6b-9008-2c14e303502d", "comment": "Malware payload (Dridex)", "value": "4a8bd03a9e3d334cc4674f0f391bfea273343f02", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869059, "uuid": "2611de45-0347-4b9d-b226-3f313e34a28e", "comment": "Malware payload (Dridex)", "value": "e3945f8794d4f7e97b12ef747e187b3f835d1421653e536b65058ef86b35adc724a754880beca1f358ab964f8a4ee982", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869059, "uuid": "f2750f66-39e0-4a4f-bb4b-38f9ab01c0d3", "value": "T1A28412AC96E5CC4CC84E813F41E70FB1D7A16609A6D12B2FC1B0E6195F06D7E8B6B19C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869059, "uuid": "671079c3-9e86-434f-9ac2-1a59b5458550", "value": "6144:oXPQ+z9ssjp/d6Ef2LohOGYw6CC5jTT453mjEIbWiGVAKSLFN+YInSCRvuPsxNR:kPQ+z9ZlmL2OGY/TTy2jEIJc6FNu3uPs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869059, "uuid": "7aceed7a-0d38-4882-8295-3c22d82db11a", "value": 379075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869059, "uuid": "b1a598a9-9803-400a-8c00-07922433c959", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869059, "uuid": "579b12ad-22d1-4b63-a415-1459eea18eb1", "value": "EoY_TAX_Document-249607367_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b22a8353-0537-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629849731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629849731, "uuid": "c50a6c6b-4e02-467f-bfa2-a4e37f64fd54", "comment": "Malware payload (Mirai)", "value": "b8b8d0f62c00896bb9d4e9233396ab08", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629849731, "uuid": "7cfa58a1-78b8-4f4a-8043-b7e340080857", "comment": "Malware payload (Mirai)", "value": "55b310ae6680f4c0a68000a9bddd4b839d317d84fcf826d029135c3436cdbb11", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629849731, "uuid": "f5031266-4911-4a0b-a41d-aa514a1befd5", "comment": "Malware payload (Mirai)", "value": "73acfcf476546cb636858d9189f773bc65292955", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629849731, "uuid": "fa87bca2-12c8-4b2f-b6dd-67bdb434f0aa", "comment": "Malware payload (Mirai)", "value": "7869f9f4eb9f855f85ca2b143525924c2a21ac4ee5d1cbab5d0b2e77117de8f7e2925e64252522bd26fdb9b5fe80a3f3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629849731, "uuid": "2697c8bb-07f5-42d1-b5b0-a09028f022d0", "value": "T174C33A46EB818F03C4D62776BA9F424633239754E3DB730659289FB83F867AE4E23505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629849731, "uuid": "139bba80-3114-4bac-8b11-8caf6a74eb20", "value": "3072:+BYUtkdgilePw7/gtytekE9FnO7dZ2Xe3m8M/9QbAG1:+BLtk6dLytekE7OyXe28M/9QbAG1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629849731, "uuid": "6f2b0550-8092-45dd-8a61-3add96b95c24", "value": 122209, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629849731, "uuid": "95aa8415-e661-4ccd-99e3-11d2c3f21863", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629849731, "uuid": "816b7892-97d8-45f8-9f4f-ede85af11a45", "value": "b8b8d0f62c00896bb9d4e9233396ab08", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc9a1dde-05b8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1629905261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629905261, "uuid": "68a0ecc3-4ae9-4e11-8b61-a099c2ab0e20", "comment": "Malware payload (Smoke Loader)", "value": "6cc2ab1b3a3f27d0fa759aa8e106ba03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629905261, "uuid": "198f1be2-955b-4493-8a3c-73a1721b7213", "comment": "Malware payload (Smoke Loader)", "value": "55d5d0ee8d13a19a6bcc3129b7fcbd032b06548feeb46b257ba1b3cbf0deb2a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629905261, "uuid": "2839490e-e01b-4a39-b7d5-1b6d33ec261c", "comment": "Malware payload (Smoke Loader)", "value": "f3fa389ffde4bb5030771119c21b019fcb6debbd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629905261, "uuid": "b78a889f-62ef-4784-a8fb-0c0f069a90fc", "comment": "Malware payload (Smoke Loader)", "value": "1bb3802393a0c29b77a959d768396e6ce8f6e7a88f12750b7501696009dfbec8d6b44d416b5deeba74807197dd976ea4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629905261, "uuid": "2b2404ec-3413-4206-89c4-cfc199a7c533", "value": "T104447C30AA91C035E4F311F859BA83BCB53E7AB16B3450CB53E526EA52346E8EC31757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629905261, "uuid": "93b238dd-f132-4e81-abad-7f04df6b7667", "value": "535d66f0a9f5169be6dcc4e55997b651", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629905261, "uuid": "f23be2f3-43d9-4f0c-af2a-d4eeff13f3e0", "value": "6144:OFS4s6yKaKyrfuwCHQsqovJA2nR57q20Jd:N6Fa5fOHQsfh7nR5e2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629905261, "uuid": "1ac140c0-a57f-4ee4-bacb-71887160113d", "value": 274432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629905261, "uuid": "c4b01d0a-6ac0-49d2-ba43-a373f3b3e896", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629905261, "uuid": "adc5ed9a-7ef3-423c-8f1c-79b73878cb4e", "value": "6cc2ab1b3a3f27d0fa759aa8e106ba03.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c49c907-0588-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1629884349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629884349, "uuid": "154651df-5870-4ab1-8eed-df850923871e", "comment": "Malware payload (SnakeKeylogger)", "value": "91d5eb02a5544e4a1d5ff75e45574a89", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629884349, "uuid": "57bd161c-54a5-4128-ad4b-77938e91efb4", "comment": "Malware payload (SnakeKeylogger)", "value": "55fbf836924235baf94148c414dbeb7d308a25787ba94d870574b8ddb25e17dd", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629884349, "uuid": "b6682f5d-9289-4f9e-9376-d87ec4a1a4b7", "comment": "Malware payload (SnakeKeylogger)", "value": "cf064dcfaa3901c51fb234818c90a4c946a56578", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629884349, "uuid": "ebf95e99-a116-424f-a577-e0f2e968f48a", "comment": "Malware payload (SnakeKeylogger)", "value": "b45041ffc2140a593a111664cbabf00b69b573686cb0da0ad1381884f9bf754da6487929187f582cad204361e1157afc", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629884349, "uuid": "d2c636cd-a30d-44e8-9679-4cf9f339956b", "value": "T152E423DE665731FFDA2204F3A66CB57487039B83BCD124BA1A84D66182FEF9B50471E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629884349, "uuid": "f95cf387-57c2-46ee-848d-81999f28f2d5", "value": "12288:hI2s1j+03UlrygWOCo8naPegEP3QknGQvC96BtcEEfsF+hnjjStj3:I1j+03Ul+gWOMuVGAknG8CmPwI+Rjjuj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629884349, "uuid": "a9b37597-cbcb-46b9-8401-94bf55cd0705", "value": 687245, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629884349, "uuid": "0b897b8e-e78e-4bd3-9016-74856b0e95a1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629884349, "uuid": "6860573a-3886-42f5-b617-360af5830902", "value": "SWIFT CONFIRMATION COPY.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ee1597d-05d0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629915197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629915197, "uuid": "9394896f-bb78-4227-abb0-648ba47b51a8", "comment": "Malware payload (Dridex)", "value": "6d7239cd98317213656a14f9994a812d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629915197, "uuid": "cba848f8-b918-4106-a59c-20a174e46688", "comment": "Malware payload (Dridex)", "value": "5630750b919ad9a611a2df7b147a1744c5a6a26257c3f40cef1cd0f612f63a7b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629915197, "uuid": "476b8417-c7f7-47a3-8b88-8f94b04f0614", "comment": "Malware payload (Dridex)", "value": "e7e3ce9422b70db77ddde0d27ce9b2c8bf67ea22", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629915197, "uuid": "0e373a3b-6f11-4dad-af6f-59c4df5e352a", "comment": "Malware payload (Dridex)", "value": "21726dd91635847d0be11bc89f4129296631c415cea2eabda31e9f666c1f0abcf2e71fde948399ce2d85bd1b783b28f8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629915197, "uuid": "4bafee43-bca2-40ca-8332-41775e8fda38", "value": "T1C114D082CD9F46F9C21B167139F531BE21E80645A769CC2BCADAD2FBF47D300D46261A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629915197, "uuid": "181484d7-05d4-4952-8f44-0ef40138a051", "value": "15d931f2533164c416970d03fa5b5c88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629915197, "uuid": "07c94737-91fd-4809-84da-9edf3e6d646c", "value": "3072:rH0uyjZqEpAK+Gf78TBdrXkTM5vhRg9Esf0DwvtyMpVnpA+z6tX8sxKViWm7dU:rUua/Pv7YNhRIEZDeXVpAxtMsxK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629915197, "uuid": "55c401f5-0a9c-46d8-b638-4bc0dbf39268", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629915197, "uuid": "7e9ec06f-7685-4b6c-a6b6-92a06ebde295", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629915197, "uuid": "c0c16110-c364-41ea-a530-b16e3186e83f", "value": "6d7239cd98317213656a14f9994a812d.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f55ed61-0560-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629867228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629867228, "uuid": "f480e3bd-8fb6-4cdd-9542-f2999d1eb512", "comment": "Malware payload (RedLineStealer)", "value": "0c0e36b959067fd86e0af98f3717d0f4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629867228, "uuid": "f12247f7-7429-44e2-8151-2730256af1e1", "comment": "Malware payload (RedLineStealer)", "value": "56538d4161a6b6e0e57759f73f81a76db0b7bf9f923791f56e719793ae10ece9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629867228, "uuid": "7afad4ce-8e21-4098-aaaf-74b4f2b6e69e", "comment": "Malware payload (RedLineStealer)", "value": "d8d9b5b6c391ca2121c588ff27db25723a12a120", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629867228, "uuid": "89d5e89f-82f1-48d7-9bce-630c0ab5ea87", "comment": "Malware payload (RedLineStealer)", "value": "33885d5a70426dc4fbb8745a7d70fdb2ca88e7cbdd023b6cd75279f9edcea1f2211b57ceb46f26fdd4b02b131e8f5e04", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629867228, "uuid": "febfcc4e-1740-4e77-b209-c52338ab0a37", "value": "T11056333AD653CB35C0524D34D84FE13232F0E9985778A8CF33C94869CD7BA895BA56E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629867228, "uuid": "9428f1a8-dae2-45dd-8cf1-188ecfcb277e", "value": "c9adc83b45e363b21cd6b11b5da0501f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629867228, "uuid": "495ca3e6-5849-4cca-b2ca-8b93ce76cf79", "value": "98304:pAI+M5d//M7JWK1jkynv/z2Y6KwUMKVL87NAME+PK55HPaYRzAWu2t75hLnSUHJr:it4nM7wEjksH6bxHA/z5xacEWRF5S+Jr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629867228, "uuid": "cb0f3a3a-e6f9-42df-b080-c032c1318cb4", "value": 6294293, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629867228, "uuid": "13daaac2-3764-4897-8819-80ef464b7941", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629867228, "uuid": "4bd4943e-61b1-4ed2-9f60-462808e7ab67", "value": "0c0e36b959067fd86e0af98f3717d0f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d953b99e-0569-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629871271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629871271, "uuid": "b5317859-7119-4c9b-9f1a-870135ab73f1", "comment": "Malware payload (RedLineStealer)", "value": "d1eec7914a5ca2f3e3a0b4c3c4e557ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629871271, "uuid": "8cbd2dd2-0bf7-4c26-9e4c-4c522af6edbe", "comment": "Malware payload (RedLineStealer)", "value": "56e45f6af87cf8505b1d88360f14bf00bca7be5108db4d4283fab4605fca2482", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629871271, "uuid": "e93781f5-e60a-46ca-a652-637a1aa1b9f0", "comment": "Malware payload (RedLineStealer)", "value": "f655fcf0e1ecf1a79a6c19d71fba9714611c1bef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629871271, "uuid": "aa8489ef-30c8-489b-b8a8-23bd0c617d62", "comment": "Malware payload (RedLineStealer)", "value": "cc0400ae315f1bf94c8dd07be353b1fd618496fcbc828679f424802c32c3456a4526c3fe8ab82841a581b162609cffe1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629871271, "uuid": "e13d5448-9eeb-44f5-bff9-b86b271a3599", "value": "T15CC53380BA315ACBF45BDC7106F65E18C25E622E39E5A7C84BD07F87B6729302580DDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629871271, "uuid": "6ef739f2-6ec9-48c0-8098-fbc4b7409728", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629871271, "uuid": "e36a631a-0289-4cd5-a9c1-81c4ff1178ee", "value": "49152:9gTtVRY265B7HhR5V12uJ63B2ZOS7u0dpTLvvt0pzxNCoFWBusIpY34NK+y:yTtVOBrvh9J63M9iiNLv1I2oFWBuNpGt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629871271, "uuid": "cded2be7-d7c7-4c07-8c72-e6525aabadb5", "value": 2562379, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629871271, "uuid": "ca1c1649-d602-4e42-9ff0-69548725229a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629871271, "uuid": "deec76e4-3665-471c-87d2-15bb851e9fde", "value": "D1EEC7914A5CA2F3E3A0B4C3C4E557EF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1110eb6e-056e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629873083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629873083, "uuid": "aa58017e-5b55-4443-8f92-054b42787bee", "comment": "Malware payload (RaccoonStealer)", "value": "5d1e0e603c91b814a0217ff6e202d470", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629873083, "uuid": "936d8ce1-6b9a-4ba8-a674-819cb54709b8", "comment": "Malware payload (RaccoonStealer)", "value": "57158687581d1bb136eba0e77763cb2d91c3fe967456ac864c65590dc320b84a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629873083, "uuid": "cd1a00d5-b33d-417d-98eb-39b3cdf22f0c", "comment": "Malware payload (RaccoonStealer)", "value": "0edbd0d52675e9ba0c9f64dc65a38d59c6b2ea49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629873083, "uuid": "0c3dd1da-2d42-4b0b-946c-9d54dcdbbf3a", "comment": "Malware payload (RaccoonStealer)", "value": "8fffc1eb3e968c467ccb67ab0b9524fb583d0b9b7cabedf009cd993e880aff091a17dc11f5d70b0abc9a6526674d0a7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629873083, "uuid": "1b29597c-b1d8-4132-8a3a-9d836a7edbf2", "value": "T1D8B4E030A7A1C034F5F611F859BA83BDB92A3E71677450CB53E12AE91238AE5EC30757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629873083, "uuid": "e63f2ae7-c135-43dc-a825-ef7dd5fb131b", "value": "d5cdc30877a202456bbe03f8e48575f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629873083, "uuid": "e20cd8ae-e35a-472c-8f97-909b668651c1", "value": "12288:fVrsyYeRVd2ArwjXPCiW2e18sMcKT7lSRbski:5YeRVg82eMpTgRRi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629873083, "uuid": "08f942e0-2705-4c81-ac93-f8793ea50ce5", "value": 539648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629873083, "uuid": "b215310e-bb0f-4e40-a77f-28b810fdacfc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629873083, "uuid": "2693e593-935e-4d20-bddb-efc101e0e56a", "value": "5d1e0e603c91b814a0217ff6e202d470.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3cdf6c7-0537-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629849707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629849707, "uuid": "f519588b-dc33-474a-960b-0315dcc48abe", "comment": "Malware payload (Mirai)", "value": "db7708831fb13c084996e71a515d430d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629849707, "uuid": "4504f8f5-92ad-47ca-827e-3a1e61009c35", "comment": "Malware payload (Mirai)", "value": "57214f483f32298e0fe018121d6b8a09bb4c669782cfbe37cdf94af8ba47b7ce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629849707, "uuid": "4fac25c8-c04f-48dc-b531-23b506c57228", "comment": "Malware payload (Mirai)", "value": "71d6903085618f6a79f313bd9149079d6efb2dd8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629849707, "uuid": "b77d7def-de4b-4621-b7b5-b642e17a52ad", "comment": "Malware payload (Mirai)", "value": "57cd9c49db257f9760b6dded1ece80085f8eeab2a3d20bd178bc00c30df26cd886d4076747f8c7517fdafee1d9d671db", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629849707, "uuid": "4712a035-cc98-4710-8cd4-106426fe5a6a", "value": "T103231995B8D1CA02C9C45277FF1E419D372A13DCE1EB3203AD296F5436CA82E1EB7586", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629849707, "uuid": "0ac668d4-bf8b-4954-8300-9cb413ceff96", "value": "768:aidVZl5LXg+TztNoqV5AfzSleQ1EWj5CQmONE2Pt3qOWq5BXQKTnPMOdLn/hXgp4:ZVRXggz3V5iYCQ5Cut3n5BA0PMwLn5ey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629849707, "uuid": "50aff067-47b7-4f53-a7b5-37dee5da09ba", "value": 47480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629849707, "uuid": "4fe0a512-01b2-451d-996b-1618e7b4aef4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629849707, "uuid": "386265be-0a8d-4a8f-ade2-239240b6b18e", "value": "db7708831fb13c084996e71a515d430d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4b009dd-0586-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629883746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629883746, "uuid": "dc60f82c-c63f-4320-a923-e4f8214d57e6", "comment": "Malware payload (AgentTesla)", "value": "570a3dc73ebd68dab57a9e3212cb0641", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629883746, "uuid": "8039ccca-19ea-48cd-8851-2fd5937082ab", "comment": "Malware payload (AgentTesla)", "value": "574af5e3a9857eec977cd20890a10607c861ba06197388cf7f9419daef25c020", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629883746, "uuid": "9da3ea6e-0676-4893-a3cb-921a10acf7b0", "comment": "Malware payload (AgentTesla)", "value": "4d04b96831fd3508c7de037a3f644f8a41b12e90", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629883746, "uuid": "361e5a6a-6e44-4739-96a7-4e49b45a99a5", "comment": "Malware payload (AgentTesla)", "value": "8862377d445127013367d0398057f9ec603928a8273537a3885982a6f9bea1b506d9992475e04e2d247fb5fb80151e77", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629883746, "uuid": "9ca42e90-f198-4fce-97ab-50934082e15d", "value": "T122357C2877407ADED8A60F7288137A8443F3D5572731F65F28C8A6D92C21B568F2F693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629883746, "uuid": "0bb6947b-efbe-43b3-8e7c-e9f1af31d917", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629883746, "uuid": "d31b3a35-c15e-4e6d-89b4-93e1f37331c2", "value": "12288:xbVHUNvo5flNIjWEpQsLhBN9aTom5OuuGmsBkBj3Omg3OlzUeVopLceJ:lVUVqrIzhf9aTXEuu6Dmg3cTP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629883746, "uuid": "84f1d30e-e411-457c-9c04-e0f1bdee3715", "value": 1148416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629883746, "uuid": "9363c063-1f74-4b74-bcc3-230190d9c7eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629883746, "uuid": "cd8443e6-7712-4ff3-97c3-ff7175f51b58", "value": "570a3dc73ebd68dab57a9e3212cb0641", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c9b02c7-059b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1629892644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892644, "uuid": "39646d9d-2775-4669-b954-b1e51e115537", "comment": "Malware payload (RemcosRAT)", "value": "2b47fc7aac5b10c9f012ac0d573b3ff2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892644, "uuid": "038c22db-ad74-485d-8be6-1f40ef07eae8", "comment": "Malware payload (RemcosRAT)", "value": "576c45faf084a4f7d282e460ee207cd9a6dc269444701ee211f9aeb7879efc35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892644, "uuid": "91418336-8793-4d15-8fe9-5ba42d58aaac", "comment": "Malware payload (RemcosRAT)", "value": "ef40343e9537c714533ed312f72f46b3a28b8a9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892644, "uuid": "3d4b5b7a-0694-401b-ad67-5bb88e9dc80b", "comment": "Malware payload (RemcosRAT)", "value": "a47977a9da8866b439ddfc3d0691a3be1b4f0f66ff2fe12c4835dc2e2f8bb23664782f3f9165071aaf5f464e1314dbd4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892644, "uuid": "50b80d4d-bcb9-4b97-9a5e-28a3da3e98a3", "value": "T1CB4502E0E82AFD57F336D4389026FA64C6D91091EB52D07BB42BFA6451B3390245EB1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892644, "uuid": "b56adbfa-227a-43d3-ba5b-bc5588c024f3", "value": "c65aff2bab39ef464a2bad0c06b18bd1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892644, "uuid": "12c4f0f2-af71-45de-bf22-c2d1b39b4e18", "value": "3072:wdteLxnf/mbNrPNt7hrmmWVyouTnnnniucucucuc2nnnng:pdnHmbDrWVn7nnnnT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629892644, "uuid": "46b38578-5156-4fda-87b6-4abfda61dd9c", "value": 1171456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629892644, "uuid": "10b1853c-ddd6-45ac-ae80-365ebbe97620", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892644, "uuid": "1eccc5b6-8f2b-4c24-8055-cf08647eab13", "value": "2b47fc7aac5b10c9f012ac0d573b3ff2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ae5e8f3-0589-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629884830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629884830, "uuid": "34bd5286-1490-4579-8736-0033becd3d25", "comment": "Malware payload", "value": "7e778066dc55c2f0a6e0280d086baaec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629884830, "uuid": "24ca002c-4f00-4596-9dcf-390d31c8d918", "comment": "Malware payload", "value": "579ff4bd0fd197d866940a089b828465ae049c4829fa1d33cfb1f55519db7952", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629884830, "uuid": "4ff53a31-dad3-45fb-92bc-dc417713b18f", "comment": "Malware payload", "value": "166981929bacc79c6ed87db1bb5b2580b214bd58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629884830, "uuid": "34ebae38-f077-4fe5-93f0-68998e9ebb38", "comment": "Malware payload", "value": "d8201099d4469c8b2974e39832bf9f8decacba7321a6b570e478d02bfc5b6125599a381342675d80362d7429dcb12ef1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629884830, "uuid": "066c8dfc-59ad-4d70-8428-7f6333d3bec7", "value": "T157A5E903AA8B0E75DDD237B461CB533AA734FE30CA2A9B7FB609C53559532C46C1A742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629884830, "uuid": "f7085b41-4eab-4725-9c12-965ee3432968", "value": "f9fc0ecba4bcf3f4eadacd9b358488bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629884830, "uuid": "c8f655a0-d4ff-4d91-b67c-bae51426d47e", "value": "24576:hslv+HYpYyqpKBBPbOiKPG/MXXzcKVu9l3juQ55313N:hsxE3nzcKVu9l3F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629884830, "uuid": "44b49055-459e-4cef-8690-d408402081b0", "value": 2246597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629884830, "uuid": "fa87ddff-0add-432e-8554-76a5c4e63871", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629884830, "uuid": "29ddce04-2d29-4f4b-9e30-d28a969e2db6", "value": "setup_install.exe1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd6f10b2-055e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Spambot.Kelihos)", "timestamp": 1629866554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629866554, "uuid": "d5b58fdd-707c-4e4a-8966-0cb4802ab4a4", "comment": "Malware payload (Spambot.Kelihos)", "value": "d4359d5d0bbe9828a1340fb1d8537a74", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629866554, "uuid": "a15cff2f-d8f5-4212-af0e-d1c394f157ad", "comment": "Malware payload (Spambot.Kelihos)", "value": "57e2f9ee6aaad4097ac2b1151fe1cf9546c8fbc470670b73c8039285f4fd4db5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629866554, "uuid": "fb0293c6-e2f3-48ad-baa6-41d6a4e8eaeb", "comment": "Malware payload (Spambot.Kelihos)", "value": "5c8805bd3c08d9866748ac033d9e0497bb84761c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629866554, "uuid": "b4e4dd6e-53db-40e9-9edd-637716066431", "comment": "Malware payload (Spambot.Kelihos)", "value": "b43af2cdd4a5c1f8c8b4ec20bd37863759bbb5b19d721dc5efd502c6a332988143ab01c37063c5fe6bbf91a78ab7af21", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629866554, "uuid": "b2a61b2b-52c8-4a7c-b2a3-1f8e8853629f", "value": "T10466332CB4841572E5A71F32988753B7F47BF39C4FE8688DB6D81618AC2BB014E7614E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629866554, "uuid": "4a8c5d9f-33eb-4a4f-a0c4-d9a558bd7799", "value": "c9adc83b45e363b21cd6b11b5da0501f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629866554, "uuid": "84020dbb-ec3b-4c8f-987b-5a5ef8faef8e", "value": "98304:pAI+SlhLuZHUt0eb4gECc3TKnUESV/eqRrqmfgSmhML0CzSbquFwa1//NbAxg6gJ:itBUieh7c56qRTL0oLKw+NcA4BzicQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629866554, "uuid": "ab14b011-6199-4557-a73d-8fd78e74a304", "value": 7036688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629866554, "uuid": "f1847c6e-37cb-482b-be87-330fef7a99ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629866554, "uuid": "8c667d1b-f6f3-4db2-a311-fbdb046f9c14", "value": "d4359d5d0bbe9828a1340fb1d8537a74", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a5ada71-0574-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629875783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629875783, "uuid": "1c98f4b2-c576-4ff3-8e27-c218751b8770", "comment": "Malware payload (RaccoonStealer)", "value": "273a7c27d0083751a61455206d0a562e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629875783, "uuid": "61daa9c5-24b3-46a3-9410-5a49b72dec22", "comment": "Malware payload (RaccoonStealer)", "value": "583530c52abee0290a36a665b500bc6f601021ebde84d6011d8c4c40f138dd09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629875783, "uuid": "c13f8c68-9dbb-484c-bd1c-8628858fbe1e", "comment": "Malware payload (RaccoonStealer)", "value": "3bd62ef7f001e8272753c460102de569e5ba7387", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629875783, "uuid": "a5d97a71-5ee5-46fe-afdc-fec681b77164", "comment": "Malware payload (RaccoonStealer)", "value": "c68ce3e7f4c4891938b25a715c61fe4b6b093f75a7034eceeba5098e33df3f8d0b9009b83e6bcd8c772bed364a720b5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629875783, "uuid": "3f6a5ffd-8388-4680-85a3-5f941f112c46", "value": "T1D4B4E0316A91C034F9F311F445BA83B8B83A3AB09B7450CF92E216FD57386E5AD31B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629875783, "uuid": "52c08ffb-ad6f-41e3-ba1d-7fe6452dc09b", "value": "ddbb3eef631957f988f10b48742f9549", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629875783, "uuid": "f2befa9b-501b-48f2-a7e8-567c86390035", "value": "12288:ByRpiZ5SZQ6+ohTXbnYQSW+uEPv7WsOv9Z1JCZx77HCPolKj2cdx2:15SZ5nYQejWsOxJCZxfHCPoQ2cz2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629875783, "uuid": "b0d00ada-701f-4a63-8b93-6f9b4ff6673f", "value": 540160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629875783, "uuid": "23f6ec04-2ab1-4244-bbc4-8d948fe43f35", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629875783, "uuid": "725d0d54-8e51-4fca-829a-ff7ac51f96a5", "value": "273a7c27d0083751a61455206d0a562e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2cda29c-0577-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629877273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629877273, "uuid": "0f3d3191-335c-4ffc-9584-fddf3c098261", "comment": "Malware payload (RaccoonStealer)", "value": "949b5532fc6d68c9c9f69171daf5458e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629877273, "uuid": "91eefc31-c044-411d-abed-5a78db94f872", "comment": "Malware payload (RaccoonStealer)", "value": "5904d5b4b7b3dfafb2b26a923e6d7f2833f42e3d3c8dc465f0765e7cf153ac99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629877273, "uuid": "a878c5fd-5f89-4c8f-812c-1fdec7c07cc2", "comment": "Malware payload (RaccoonStealer)", "value": "58e63e185c76829d9701cde6219bf18b87481c0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629877273, "uuid": "470537e1-8ac7-4d92-a777-f2476287fed8", "comment": "Malware payload (RaccoonStealer)", "value": "92b05ceb4ea2453425234f501338a94eb42778a555e5da9a3b4194a0f31e3bc2c95be5013ddcb372e26b8cd53a0b57cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629877273, "uuid": "25d97585-cce7-465e-94b5-d4f985a60211", "value": "T1A1B4E030AAA1C435F9B211F455BA83B9B53A3AB16B3540CF53E61AFD52386E4EC30753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629877273, "uuid": "c09c2083-728b-41a0-9a39-ae1db2c16814", "value": "b1f244737f482f7370a4248faac2bcb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629877273, "uuid": "b991b4ae-0a40-4fb9-bc81-f4de8aeaa52a", "value": "12288:gkknAoVl/5KBAsQSVul10f+V8JsPBewXOTmua/EQTb:+Vl/K21RV8JsPBewXBuac2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629877273, "uuid": "e6c881cc-0d40-445e-b055-8dcdc544cf23", "value": 540160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629877273, "uuid": "282605d2-93b1-457d-9954-e78bb27773f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629877273, "uuid": "7d70ced2-ba54-4050-836a-255f6bdbfc2b", "value": "949b5532fc6d68c9c9f69171daf5458e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9977e763-05fa-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Glupteba)", "timestamp": 1629933441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629933441, "uuid": "69e673dc-131a-439a-9143-0d464464e661", "comment": "Malware payload (Glupteba)", "value": "aea1d03d9bddb3ff2000d584bd099baf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629933441, "uuid": "5768080c-37e7-4cd2-a73b-195ae2275172", "comment": "Malware payload (Glupteba)", "value": "5962e598aa1f5c22ce1164e818141de3a71fd70ec2df3407d48af0561083adb4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629933441, "uuid": "45552093-b3b2-4741-9558-b41709a52f0e", "comment": "Malware payload (Glupteba)", "value": "bd1aaf22757f7ad941972ad116813c41512a04a9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629933441, "uuid": "92969999-8085-48d8-9ce3-9477e5a73b13", "comment": "Malware payload (Glupteba)", "value": "e25cedb3f8366d3ce13bc7062d5fe6552b6f564223f047a45578fd2c5efb09e1cd3c58e04b6e875d50dafe64436caed4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629933441, "uuid": "2eef98bf-369c-47be-8a76-452fbfdc0539", "value": "T1AE2633862AF5842BEBC21836893CDD341B1B38E306F9C5477685047ABE5B360956CBF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629933441, "uuid": "712b1f15-ce59-42d7-bff9-03cff7a0e698", "value": "c2177a2021a127fae92a922150801df7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629933441, "uuid": "f8fd814d-7c11-43ad-a099-1df5098b9b4d", "value": "98304:W4k4uKmwYOjbaFBfnLleT0Rnt3S9L2/4NAzWQtEx/rh8ATEYgiHY:64uYYOKDleT0RhS9L+PWMMDQkY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629933441, "uuid": "b28328e3-aefc-42e6-ac5a-ef7e95c003e9", "value": 4586024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629933441, "uuid": "7aa3160e-2110-4df9-b3f1-0febadc5bf73", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629933441, "uuid": "90552cb2-ca75-42a3-a25d-27a7eb702688", "value": "aea1d03d9bddb3ff2000d584bd099baf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa230daf-0556-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629863166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629863166, "uuid": "def75251-20b9-482c-9a63-1edfadf616de", "comment": "Malware payload (RedLineStealer)", "value": "ca9f451b687026440ae4c635ef47d5a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629863166, "uuid": "28cd3cd8-2acb-4ff0-8632-3e70c9d97ff4", "comment": "Malware payload (RedLineStealer)", "value": "59babf45239a61449061a606bd3f578c3caf0d604c1b9db4504e74582c6a4d30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629863166, "uuid": "94f78795-e256-4cec-a684-4fa70fc81cbf", "comment": "Malware payload (RedLineStealer)", "value": "3d4a20e36ae41dc4e9e7376ac87418d6e67d259f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629863166, "uuid": "1881d2ea-cae4-47c5-b17d-6fab0cc9a738", "comment": "Malware payload (RedLineStealer)", "value": "11e7c799f655ea4d5cdce18c2f11c67fc2186de8241b95f005859960d7a5a07bb700cc3e967f592662fa20b7e261fb98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629863166, "uuid": "30cf127d-7ed0-4dc4-9d38-60821aac7413", "value": "T1F11633227BFBC5FAED4510302A8857B9A0BDCA88573546D737C5991BEE3ECED700A508", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629863166, "uuid": "2b84a507-97b6-4deb-a1be-110b588a7cc9", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629863166, "uuid": "b682dfac-e63f-4134-b2a0-036d1c17e8e6", "value": "98304:xuCvLUBsgCerxOyGqS+IPlT1x7pz43SZCeCUFz3jkE2Q/:xnLUCgCeoqkDTzFLVTkEZ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629863166, "uuid": "dd62b2e1-81bf-4043-962f-27b173779f20", "value": 4158535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629863166, "uuid": "5714172d-4f49-4f48-ba62-7db167cd66f8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629863166, "uuid": "a0940ac1-8489-411f-8d71-f9f749eefa51", "value": "CA9F451B687026440AE4C635EF47D5A0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e572a7f-0587-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629883896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629883896, "uuid": "af09d836-0092-464b-a119-ef5945c7a8b8", "comment": "Malware payload (RaccoonStealer)", "value": "16645e4444b2d7cfae9803729ba88320", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629883896, "uuid": "ef899365-bc5d-4e90-be99-cf72fd0bd699", "comment": "Malware payload (RaccoonStealer)", "value": "5a8586af2ecd930d7f07d606cbd8cc4d0b6a1ab1f9bc0a56a0510e37109e3779", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629883896, "uuid": "90243cdb-7435-44ba-a7ca-d80188adffeb", "comment": "Malware payload (RaccoonStealer)", "value": "76f43d422869d53c3f73031032c21c2f824ecf09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629883896, "uuid": "038bacd7-a007-4420-bdbb-1beead878167", "comment": "Malware payload (RaccoonStealer)", "value": "fc1c42a3521da46010208309c859e7085839996bf2dc02aefa0e853edcd802ba3c6859bf111a495bdc6f2224db6133d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629883896, "uuid": "69dea967-2741-4f35-97f3-15fa44f50d77", "value": "T1A6B4D030AA91C034E5B311F859BA87BCB43A3AF26B6450CB53D526ED53346E8EC32757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629883896, "uuid": "dd507791-4e7c-4302-a32b-99466fdb29fa", "value": "35372ade599ee63db174ac99307517b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629883896, "uuid": "2131a0d1-3c32-4ca0-99b2-b2f8785a5b17", "value": "12288:hp4Ax6BRuIhbaEKj58lXFCF6/Yt7/L1l7KuS:7x6MHj5QUSYRzTHS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629883896, "uuid": "2aa1ded1-3ac9-44de-ab88-9dd43904ea51", "value": 534016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629883896, "uuid": "b92ba48a-691f-4b91-b63f-98d2d17be3c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629883896, "uuid": "054e4275-f8b5-4c15-8c50-792058508056", "value": "16645e4444b2d7cfae9803729ba88320.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ffb8179-05b0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Vjw0rm)", "timestamp": 1629901481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629901481, "uuid": "77f22809-0d4d-4c26-af86-68d0624b1c77", "comment": "Malware payload (Vjw0rm)", "value": "5cdffc26c265c48cdbbf1aae06cc101c", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629901481, "uuid": "71642ef8-24d6-458a-a184-c9ebeab6e0a2", "comment": "Malware payload (Vjw0rm)", "value": "5a894d00f75d512b8b3604dabf49b049f40721a82397ac2e6bdf3f910565c737", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629901481, "uuid": "bb07069e-bea8-4385-b017-0f4a4884acfb", "comment": "Malware payload (Vjw0rm)", "value": "566fb395a9586ca59c4317af8b8a6e656352d5fa", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629901481, "uuid": "a9ff0783-0594-43e6-a992-dc766eb5176e", "comment": "Malware payload (Vjw0rm)", "value": "fe5ec4f3747a6ac741005fbbd90cfddbd71bc7c3f9068581455fc33231567e9ee5ba47ecea9c397b3bb3a2510adc0d5f", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629901481, "uuid": "ed7d6dc1-54b9-4bf6-9e5d-199c814747ed", "value": "T1F6453366870F12DC517FEE754A17AF45A3AC9853DC6E0840E09B0F6BA473E0D352E8B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629901481, "uuid": "a16ae8af-58d3-41eb-8c4e-0d8913f0e4a7", "value": "24576:q5P4Aday/1OtGC/HPXubl2Emy4AK+5pCwncs9hJh0+bqbK9X2XzVR:MdX8PXuIZZLkpCts9hJh0+OuIzz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629901481, "uuid": "ce92fd33-6701-4f42-becf-aa79990278b3", "value": 1274304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629901481, "uuid": "9df7baa4-b27c-4d04-aa09-c32e17f57d4b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629901481, "uuid": "478c7efb-daf5-4477-8cda-6749527154d0", "value": "KNRyOLnGcT_UKWN.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3b483ba-0564-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869114, "uuid": "5489479a-33ac-4d1c-b9a6-1dd917f907d6", "comment": "Malware payload (Dridex)", "value": "e1c9c9c9322238b77b24f111d75bac15", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869114, "uuid": "402fb05a-307d-4b28-9523-652734b4f340", "comment": "Malware payload (Dridex)", "value": "5ad8d2e74246232eb387cba83196aeefc2e2d10ea8454445155227db28543db8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869114, "uuid": "b254fc19-b2eb-48a8-b383-bfae8b22d58c", "comment": "Malware payload (Dridex)", "value": "26e9a36ba99137d8dbf81f209f7266c609bde8f0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869114, "uuid": "058f52bb-e933-43fe-8f74-3633bc999888", "comment": "Malware payload (Dridex)", "value": "6545d16834357a9efdde25a81e1becfa451a0972c6266493796761ac80804eb9ccee052809e2397ff5365305c6eeeca6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869114, "uuid": "cd199960-8797-4b29-bbde-9705e439b5a9", "value": "T16E84126842B0CC0CC94E913F42F70F72CBB1660696D6AB2F85B1E5095F17D7A8B6B09D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869114, "uuid": "a562fee2-4c1d-4159-81f2-8dbc618e5b1a", "value": "6144:oOn9PMLW4c2LohOGYw6CC5jTT453mjEIbWiGVAKSLFN+YInSCRvuPsxNcUcU:hn9PjYL2OGY/TTy2jEIJc6FNu3uPmNcE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869114, "uuid": "2d796a15-8b65-4878-8423-f28aab800f75", "value": 379932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869114, "uuid": "ef21b1f3-9929-4902-9746-82fd215ecb69", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869114, "uuid": "50f27958-ce8e-4bd8-8505-c68d22d6125c", "value": "EoY_TAX_Export-3246_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f161f9e-0569-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629871039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629871039, "uuid": "4674b70c-5c5d-4a75-ba20-248fa472b800", "comment": "Malware payload (Mirai)", "value": "a4ade5b267b5591cc3ecf494e3640527", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629871039, "uuid": "398a88d6-a669-4a6d-b8e3-88954a9b082c", "comment": "Malware payload (Mirai)", "value": "5af10ea09a4d877215ede4c76fc94553b1bee5270f799b0e47a7c9ac72ee1583", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629871039, "uuid": "cd39b7f0-21e2-4350-a9cd-63179ce60efd", "comment": "Malware payload (Mirai)", "value": "5192221f97feda65daa42d7aa3e8eeb21b50d6ab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629871039, "uuid": "61d3b77a-1158-4c5a-805a-faadb23542ae", "comment": "Malware payload (Mirai)", "value": "186a5c3c8bcd44caa14b9235fa8133f605e7e1629c565d328991e1782d7b69fe223d5d92ed8ae4ad5441da36a5f97c13", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629871039, "uuid": "8dc4aa55-5cfd-421d-b842-6920dd75bdd6", "value": "T1F523E12806150696FC68D9748B768F313ECCCB31E2898E4E696FFAC659CB0DC3211C99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629871039, "uuid": "bd5fe487-195a-48be-8a6f-0e6b7c711bae", "value": "768:rvdCbvsA9feQoKHba97T/uq3oT2EvjOu8qx9nUaxYkkYV7j0JgGlzDpbuR1J5:rv8bvsIv+3WpylqMJkk07QVJun", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629871039, "uuid": "05219867-2311-4d78-9fad-968cf748638d", "value": 48988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629871039, "uuid": "5d408bc7-c917-4e99-9a01-0a91afd5ca19", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629871039, "uuid": "3317c138-3245-4ba6-a1b9-9eed557fa7df", "value": "a4ade5b267b5591cc3ecf494e3640527", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3ba3576-0564-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869141, "uuid": "3cb3ff50-acc5-4a09-a9d2-c20129e629ec", "comment": "Malware payload (Dridex)", "value": "ff3de89f9e606b48bf73980e98d6427b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869141, "uuid": "36442404-95ac-4b41-a08a-22344efbd4a7", "comment": "Malware payload (Dridex)", "value": "5d3c9aebb0cae9d71e339df6dda52da6679ea1b95090eb51c66032f93516e800", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869141, "uuid": "c00a04ff-a4c8-42e9-947b-92fb763ee1ee", "comment": "Malware payload (Dridex)", "value": "fb6d7596e27d8d4df006e9d4b53e709f6d419950", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869141, "uuid": "9b713746-a105-4462-8a7c-5d2febc2c066", "comment": "Malware payload (Dridex)", "value": "514c7b00262e2d64deeb0e8335f36e3accec24686fc64c3911fcfbd0fd705d77dcf78784b9e16c22de65e9aa39ab1d0a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869141, "uuid": "3bf422d2-a9af-45bc-b320-90257ec7610f", "value": "T10884126C86F6C80CC85F903F61E34FB2DB756506A291771F95A1E60C6F0387D8A6F1A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869141, "uuid": "70144e94-b2f4-409b-a9c6-337d91d9abc5", "value": "6144:or3f/jgJ6MH+Z0VYOH3R+Md2LohOGYw6CC5jTT453mjEIbWiGVAKSLFN+YInSCRF:kf/c8kxek3YM8L2OGY/TTy2jEIJc6FNg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869141, "uuid": "658ad363-fcfd-4d65-8096-91922a0d0968", "value": 378737, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869141, "uuid": "cedde2f7-c906-4927-b73c-dae20a549369", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869141, "uuid": "5827097d-7f38-4579-83dc-5e79bc26a475", "value": "EoY_TAX_Document-0024534_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da41dca9-0564-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869125, "uuid": "7bf42ba3-46dd-4122-883e-3d874475f7e2", "comment": "Malware payload (Dridex)", "value": "bcfd19cc77132ab08255966b4e261297", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869125, "uuid": "36eb24eb-051f-4634-885f-e90a90bafb99", "comment": "Malware payload (Dridex)", "value": "5dab399585f039fdc320b57420fb1aec967a5a21f95bb6c820dea687cddc0e1b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869125, "uuid": "7848d5db-b48e-45d0-aae1-f3f92d8653c0", "comment": "Malware payload (Dridex)", "value": "10164288b9bf405350657a5ab7659d474a4ce229", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869125, "uuid": "ddd7b297-62a4-4203-99fb-ce9083c9cd95", "comment": "Malware payload (Dridex)", "value": "a67071d1d11f6f798e6f90ca6580bc7928b7729876038dd1c8c00d10e4d8c85e88bc531e29d730bd49b1b0c512c2f430", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869125, "uuid": "52dbb64a-2e0f-4557-8cb7-24243145bb18", "value": "T168D3E0A779BBCD1CC12A833C11EE4EB767B49B4152B25706126CF4287F225ABDF5C208", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869125, "uuid": "4c51f168-1719-42c6-864f-988622c61910", "value": "3072:oU49KruB5i3Ru5mX+NbboUDiEi63LD6z2qoaaaaaaaaaaaaaaaaaaaaaaaaaaaa0:oxlihusXuboU2F67MoaaaaaaaaaaaaaV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869125, "uuid": "979059a8-2d39-49ff-b368-8971d6ba6ad2", "value": 142055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869125, "uuid": "55d09c85-2fea-4629-8783-12b331ac1614", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869125, "uuid": "1735fbc5-80da-4bf9-a218-0b39a50351e8", "value": "Scan-1981845_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9d99f5a-0573-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629875513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629875513, "uuid": "f136ceda-a4bf-4e61-8a7d-0328c1a6d310", "comment": "Malware payload (RaccoonStealer)", "value": "86b64627eb8a92ed5bfd385708bc8767", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629875513, "uuid": "6a98076a-8f02-4e72-83c4-238f3d7482c0", "comment": "Malware payload (RaccoonStealer)", "value": "5e0c90a4ea27def0601e4b42311c152cac4ce47bac6fd9c4260a78f8d9b072a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629875513, "uuid": "0e03dff1-b768-404a-a2b0-a163ccf27e8c", "comment": "Malware payload (RaccoonStealer)", "value": "07e3cf85813b5cff765635f9e0efdb8a1024cdfe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629875513, "uuid": "dca615f2-f3d7-4469-9cb8-db7fcedbc26b", "comment": "Malware payload (RaccoonStealer)", "value": "48f948cf00f4b2241641b60eb4a13116d782d1eaa8a81bf24ff9520d6e4211081b949778eacd894a051a1be8a27de0e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629875513, "uuid": "bfd4ce15-6a1f-4b9f-aeab-40e2e4aeb7e5", "value": "T1786401583A70CD73C8255572449287D0A73E7DA06DB182877BF94B6FAF362D0372A253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629875513, "uuid": "41b0171f-deeb-4a3d-b8d7-e7c08f6152c0", "value": "bd3c9edf948deca79ee5e78523f1a042", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629875513, "uuid": "2739eab6-b03a-4d2e-bdf3-b39b9ef16ddd", "value": "6144:DQmGABIJfwU4NiVDQPmd8BpdIJ+FvGokSWCcok2cxb:DQoiI1KQPEOSS3HvcF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629875513, "uuid": "b3cb27fa-8b25-455e-9f65-bb989362a6e4", "value": 311808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629875513, "uuid": "56ebfdfa-0a9f-4a83-af19-152bf62821fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629875513, "uuid": "ed90d8fb-3b58-432f-a9da-304e96804963", "value": "5e0c90a4ea27def0601e4b42311c152cac4ce47bac6fd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4a1567d-0578-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629877625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629877625, "uuid": "4d515170-1a66-459b-b305-b4c8d461b340", "comment": "Malware payload (AgentTesla)", "value": "fbc41146754cd9ff3511533fce87c748", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629877625, "uuid": "20c8aa95-f2db-4302-9f03-f5d531a609d3", "comment": "Malware payload (AgentTesla)", "value": "5f9e0d7893d96dd00277ee6398b7e0faaa977b30a74b666142c8323838ffa247", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629877625, "uuid": "0fdc8477-1977-438e-a6e6-6068c4634d59", "comment": "Malware payload (AgentTesla)", "value": "3fefc7cbc6392a4aecb92ab6e68f10a5268d107c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629877625, "uuid": "e6961101-d119-461a-9e2b-355cca592a3d", "comment": "Malware payload (AgentTesla)", "value": "0a5878ef791f51d81ccab18d98991b9081a5c5c3b6b6906ad69df295cde3d6497bf7c908eac5aa4245127bfddf32fcf3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629877625, "uuid": "75788cef-5682-4c13-aa94-99213adb5d44", "value": "T19E93075CC4AB02E88F825BB85B3BFE48128C766CF7549632323C5B7117E1E3A815697C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629877625, "uuid": "c0304006-a58a-49ab-8f0b-4fb12d0e9d5d", "value": "384:LuHHZ1Ql1fehUoAF4EmVPuBi2TRiItg0fFWg3xWB/h:LAQl1fehFAF4EmVPJ2EIndWg30", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629877625, "uuid": "a1f3fcf8-4bca-49d0-9560-ef9dc09669ee", "value": 89424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629877625, "uuid": "531049f1-90bb-4b5e-bcfa-f745d57f3db1", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629877625, "uuid": "7cd9451c-f54a-458d-a2ff-aa162e04bf76", "value": "Quotation 2.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3afc1f37-057e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629880025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629880025, "uuid": "2d516bd9-1db5-4f68-a7bc-a2cde1ad330f", "comment": "Malware payload (RaccoonStealer)", "value": "48800dfbfab756e2049a1c96e2f505c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629880025, "uuid": "1b98637a-c411-4d44-b5d7-78f772c17106", "comment": "Malware payload (RaccoonStealer)", "value": "5fb47e4db1c3cdc909383f269870ddbb14fe047ffd5ef2976a081682fdb95883", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629880025, "uuid": "f720761a-8844-4633-8b6e-c879f80a277a", "comment": "Malware payload (RaccoonStealer)", "value": "c723b963988f3742a085e9514d5485a28be4cbd9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629880025, "uuid": "f2d0b902-db71-4d86-b763-20cb0a059a83", "comment": "Malware payload (RaccoonStealer)", "value": "80402e4b43828786e86958dad9fe8e9a3621b4c60daa49c37b49d327e6aa8a246cff667d039406e01b8afbad316d937a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629880025, "uuid": "567e12df-a644-412d-b220-1d654b0b67a1", "value": "T1E5B4E030BA90C035E0B315F8597A93BCB9393AB16B3450CB63D626ED56346E5EC3079B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629880025, "uuid": "13bbc4e6-7c03-4ddf-a90d-102801e40a4a", "value": "2d1e5013dd6b871ca263ffc72a0f89a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629880025, "uuid": "4eb19fc8-e551-46be-b2fb-2eabfac95ce6", "value": "12288:BQQBTojW5EGYNaxcHjd7ZfjUD7Cl47t6F981fw2Wzfe+lR6I:Loj44E/qkU981ft2eK6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629880025, "uuid": "1df318f2-8b6e-4dbd-8b8a-4b057e209989", "value": 533504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629880025, "uuid": "0f5119c2-f1c0-4d8f-bd9d-23e6dd385a11", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629880025, "uuid": "0c15b33d-544c-465d-b7df-39b7e938b8ac", "value": "48800dfbfab756e2049a1c96e2f505c2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1ed0a2d-05a3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629896116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629896116, "uuid": "8d0db1b3-629d-4516-9af7-e456c2276b57", "comment": "Malware payload (Loki)", "value": "7a2484277599f27801079f9bbda665c1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629896116, "uuid": "7b918171-e9cf-43d9-b2f9-6cbab99ae894", "comment": "Malware payload (Loki)", "value": "60697f7c17c442322eea32ac41ee4d4e152e61fcff29079f4522cfa8de122c71", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629896116, "uuid": "2dffa12b-98a4-402f-b7b2-0fbbc6ad9f0e", "comment": "Malware payload (Loki)", "value": "1689dcaeb5f4f8181235f45b2fea2b71a58e2e22", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629896116, "uuid": "0193ff92-7f3f-4bb3-bb02-d3a80c91068d", "comment": "Malware payload (Loki)", "value": "9f3ef30b30a96295a3c7fd626c29ea055fca26f45e86261f4c6268235ef57d491ad22875c3e54f49ca87c32fc8e5b720", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629896116, "uuid": "fc9dc858-5483-4e38-bb25-c97e3a9df1e1", "value": "T1D22402B91782E549C102DB7B57DDEC508349CC5FEAE0A8EB41197820FBB5CE86DB35A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629896116, "uuid": "ad342dc2-30ad-4eda-b37b-2f22e446b227", "value": "35807dcde258f88fa3ce5c21adc607fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629896116, "uuid": "eacf9c33-f455-4026-a08e-763fcf5e0198", "value": "3072:riCuxk8o8iH7WyeLmKraSpzGmXTS3tZozdcQobfICn9DKHAwomU+3K11ma1farvh:riQPdHG1dTsZWkIkKHAwoU3KFGSDWJO0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629896116, "uuid": "de0ce566-396a-48dc-84ea-5727c04d8cdd", "value": 227287, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629896116, "uuid": "6e420257-2535-45c9-b96a-272587cf46fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629896116, "uuid": "6d68d829-fe15-400c-8aab-5c8bc9e361b4", "value": "7a2484277599f27801079f9bbda665c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63d1e587-05ff-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629935499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629935499, "uuid": "4791cbea-8e33-4872-a09e-4c6bef212914", "comment": "Malware payload", "value": "2ddac348c3b54e70404c3a34aee23fe3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629935499, "uuid": "7b3787f7-71d3-4092-9ded-0a12260a332e", "comment": "Malware payload", "value": "60ddcc770e131e9f963ac206735d743f9490fa17888904e5c9ac31fa82a21589", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629935499, "uuid": "9d11c041-6a4b-476c-a3bc-b217328b732d", "comment": "Malware payload", "value": "0779e4032a931d2817933cabc672a93d8f97a4e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629935499, "uuid": "aa040426-13ed-4de0-bac6-542f6314338f", "comment": "Malware payload", "value": "39ee4f251df85897be5f279fdb4fc833f8543b648ac18e1f806e8c9ff7c3b915ccb4c0318d9845a1188038204419613f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629935499, "uuid": "66da1cee-309f-45a3-80fb-9b42dabb607a", "value": "T1EBF39D9D766075DFC86BC876DEA81C64EB64347B431B9207A42316AD9A1CACBCF140F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629935499, "uuid": "e0b5fca1-a382-4ef5-9cc5-867b5f0e20e3", "value": "3072:LxEHxvaPKJimyrwp+uUDCbH6mkm7IKE8xO1t/IefNzWoitRf9lfVnfbr2auK:CaPXmWwpPu/Kb3xO1t37irfVnfbKau", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629935499, "uuid": "8ac606f1-2603-4f26-841a-a19f29daf9f4", "value": 168960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629935499, "uuid": "073c575c-5675-4964-a262-96f3db183afe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629935499, "uuid": "64d73608-58bb-4c04-9c58-a39e8bf0695c", "value": "2ddac348c3b54e70404c3a34aee23fe3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "208c4496-0570-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629873968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629873968, "uuid": "73ffd585-b568-45f6-a365-02346a0ec505", "comment": "Malware payload (RaccoonStealer)", "value": "3d274ff3730e8dd0983f315b2995424e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629873968, "uuid": "264040a7-f877-4c42-b187-60f3ec871c16", "comment": "Malware payload (RaccoonStealer)", "value": "6166927dec8a133a202a8b67a57d59f8f9a26a59ab8ea46d0424f07f6df827be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629873968, "uuid": "5bcf0641-300b-4a40-bfbc-03cc9fe5fcef", "comment": "Malware payload (RaccoonStealer)", "value": "c172ad90839d68979ae53ca36ab06f0a4e68911c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629873968, "uuid": "67600178-e948-4155-b342-e7f17f6ca041", "comment": "Malware payload (RaccoonStealer)", "value": "e6c04a4f0fba3930bfca8cb02fac08882f63058f32c1f6741e28ef52903421eedb1067cd5ff140a68b9b2bd2d7c7d30b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629873968, "uuid": "2a33592e-4c80-4044-a269-381141b29f37", "value": "T113B4E030A691C034E8B315F885BA83BAB53E3AB15B7451CB53E21AFE07346E5AC31757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629873968, "uuid": "e54461ee-f66e-4941-aa42-efff80360b7c", "value": "ddbb3eef631957f988f10b48742f9549", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629873968, "uuid": "60988f35-597d-4318-ba02-a274968ae325", "value": "12288:TryJiCj6hOT9bxhebXBAsTT5//xbc2248shgfqZ2tIvBuHv8cj:+j6hhXTB38VqUtIvBdcj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629873968, "uuid": "dd8ded8a-9e0d-45a8-ae67-ee461ae0fbca", "value": 539648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629873968, "uuid": "0ecbd2d2-5b58-466c-af2e-cf613b5c98cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629873968, "uuid": "eda0af37-bcc0-4fa3-9d88-f9319c7343d3", "value": "3d274ff3730e8dd0983f315b2995424e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bdc4c85-0565-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869235, "uuid": "574854d5-3763-44c7-9f63-027cfb2579b1", "comment": "Malware payload (Dridex)", "value": "57fa561ecb1002468fab2c804e9dbe56", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869235, "uuid": "0d990a6e-1679-4f77-aed7-7f718e59d682", "comment": "Malware payload (Dridex)", "value": "6258c48e2ba9da68f46662e02b7d095f2100cd62466ddb562135ae87151c4fd3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869235, "uuid": "e80ad551-6515-48dd-95ef-2f5c7fbeebe9", "comment": "Malware payload (Dridex)", "value": "0418d558877be17e90302e505a403023a8e925e7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869235, "uuid": "934fe071-3f03-4bbb-bde9-7cbd6be53df4", "comment": "Malware payload (Dridex)", "value": "11bfbef3a39fae93421c52887b7db4f92fc60b6e1f357577d5665a3aaef45e6aa31e46be77cfad399bc686548b820c5e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869235, "uuid": "46045a32-3716-491a-a3c3-769598e69913", "value": "T1C0640219C8B3D87ECE970CFF4D7805E263A78637C5918ACB88C571EC2E520764299AD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869235, "uuid": "0e0f6385-13c3-4520-9fdd-e5435cd8ad12", "value": "6144:o2NcTOMsXO/J6t/VYfASkKTzZYwPMPFde/Qxx2u+OA+NT5Ae:xqBsX7ifASkKTzSwkPFduQx0uD+e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869235, "uuid": "01b79de8-c048-401e-9207-f49c0ba77fd5", "value": 319160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869235, "uuid": "8959e6d7-2b10-4c41-b282-0cffb28c0cb2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869235, "uuid": "0f67a880-c36f-4fae-901f-3e0a774e801b", "value": "Invoice-16676589_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "953094a1-0565-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629869439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869439, "uuid": "95f0e140-d09a-443e-8fc3-9030dc84271a", "comment": "Malware payload (AgentTesla)", "value": "1c5122daef292e1b6caf4022dad5c28f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869439, "uuid": "6ff167d9-7a80-43b7-b0d7-250bc56522e5", "comment": "Malware payload (AgentTesla)", "value": "63d091dab8da98df5f8615d682fe1c65d2750567d97cb87341f015f079bf855d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869439, "uuid": "5b1e147e-aa39-4dc7-ae4f-9016a7b4f6e8", "comment": "Malware payload (AgentTesla)", "value": "b7ead7ab312e06c39eabc695abf18d5cf250c457", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869439, "uuid": "db762a7a-c696-4ae8-9363-d99e7429d8d4", "comment": "Malware payload (AgentTesla)", "value": "aab3aff3c4f3e7614bfb524a382feb610bd0c546740220ed50d6224fa529cd3c95b1e8278be69bd5f114d4dbb20fb437", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869439, "uuid": "189113d6-c01a-45af-bb96-279dd9440a45", "value": "T1E1A3ECACC49707E88F85ABB8632B6F41018CB56DFB44E1337668973517E2D7A502787C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869439, "uuid": "cb9d5d27-8242-49cf-b9ce-dc7e382756a2", "value": "384:Kfk5gRDfc2xDPgt7C8xGIPGPIRYXvGryuA:KHv0T8cKuOuA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869439, "uuid": "610447be-072e-4679-91cc-06a6896ee9ed", "value": 99197, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869439, "uuid": "53574a90-8cdb-44f6-a7d3-f7b8b5584b84", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869439, "uuid": "e246efe6-2e4c-492b-a961-cc16b8f07f23", "value": "ORDER.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5f32ab6-0564-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869038, "uuid": "cbcafe52-fba6-46c7-9d74-22bc9e2d5562", "comment": "Malware payload (Dridex)", "value": "c9583f3fb7fc59a0212e1cfdac8f1f9d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869038, "uuid": "9c52b3a7-5094-46ab-88a1-85582a17ca2f", "comment": "Malware payload (Dridex)", "value": "64e5fbb1bfddba1a05d871a51f6e3fd2590d4d2dcacfc59c6bfbd18212cd7647", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869038, "uuid": "f5b55d2d-a0ee-41af-a14e-1db249efcb52", "comment": "Malware payload (Dridex)", "value": "ddb32f110b1641101c18c8def3b4cde0540f603e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869038, "uuid": "4ddb58be-eb00-4439-8dfe-a3bb70de2f4b", "comment": "Malware payload (Dridex)", "value": "02cccb63fc61a20354522da918ae4d1df5949880c460182749d52e1d94c783c32e8224d8ab9fbd4a44979152fa14f259", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869038, "uuid": "d1dc03c8-e5c6-483d-8bf5-008f5c630294", "value": "T1E674126892A1C80CDD4E413F52D70F71D7722E0AA6C2BB1F95B1B30D5B0797A4A6B0AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869038, "uuid": "0be73065-f897-495b-aa44-e1ea70ccca86", "value": "6144:on/qi+6S3xQb60+74E2LohOGYw6CC5jTT453mjEIbWiGVAKSLFN+YInSCRvuPsxf:+KP3xQbA4bL2OGY/TTy2jEIJc6FNu3uq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869038, "uuid": "60bc672a-5c31-400e-b3e7-67ec743cf87e", "value": 359601, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869038, "uuid": "84bdfd56-1fc8-4d7a-9569-ee9d94ac335d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869038, "uuid": "651b0808-31c4-4f10-b48c-158a1e6567e1", "value": "EoY_TAX_Document-381243445_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f80ab310-05dc-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629920715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629920715, "uuid": "b81bfdb1-6370-4421-8e15-6ac6543742ff", "comment": "Malware payload", "value": "94a4991f829183880d7804d2fbe88a90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629920715, "uuid": "ca99fd38-56c9-4985-8b00-c5f6c5c5fadd", "comment": "Malware payload", "value": "64e8cf040ef6996bff61e2fb8a26285ee8e578225b2ce003990ebe8f58c12046", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629920715, "uuid": "d5fea8bf-ca7f-49f4-b03f-81f380a6565c", "comment": "Malware payload", "value": "59c9729dba35874283f5636fdfc3decb01fbf885", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629920715, "uuid": "669358e0-b26a-4860-becd-ebc5158311aa", "comment": "Malware payload", "value": "ff54bf9e4f9f835c34f3b1955cb875c65f3df78cb498a92629dacef2d71a9b168a50ad87f83b265c3927463cf1789b68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629920715, "uuid": "39496f38-91b0-4323-ba66-d8af1bf7a704", "value": "T16662095ACB901C62ED7B8E3970F0D6166B70B3426795C6FB91ADC150CF8278235BC1B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629920715, "uuid": "ca0f3061-78de-430f-b047-e46a086f2563", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629920715, "uuid": "8d942f97-2659-4538-8b49-78b95896d8a1", "value": "192:39iAEtaUlbjZCklJK5O3lDWpHrDWpHE7x0gZHSVLRjt8:NEtxlb91W0DGrDGuph2O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629920715, "uuid": "ee57527f-f186-4838-a3d0-229c3ac7cb79", "value": 15568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629920715, "uuid": "63ff46fb-a2a7-48dd-b8fb-e9c1065f3f58", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629920715, "uuid": "c18266dc-ae5e-4ad0-a41a-ef681b79fce6", "value": "Run.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8326ecb1-05ef-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Glupteba)", "timestamp": 1629928679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629928679, "uuid": "8ff6f653-c56f-44e7-8027-a7655f908858", "comment": "Malware payload (Glupteba)", "value": "2d9efdd99d9744934858f1702b16c9ab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629928679, "uuid": "6731a633-6649-4029-9e99-b8295bbf64a6", "comment": "Malware payload (Glupteba)", "value": "6572d86423d70deaf50f882a87488edd2b3242b38c72a64db18771cdc07c38ef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629928679, "uuid": "82f64b2f-5cf7-4d63-837a-9b4d3b6da6ff", "comment": "Malware payload (Glupteba)", "value": "a47516b9251142d53464d678da8b7aefaf701972", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629928679, "uuid": "507a6994-96e4-4a2d-93d5-3bf63a848d5e", "comment": "Malware payload (Glupteba)", "value": "3eabc171b1ae4b4347ca62ada3ea646ffd4ca71e274282cf870ceacb053b6b5854324c6871cdb87597e3469b65e466e1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629928679, "uuid": "8087af5b-7608-45b0-b86d-4ca94496b5e6", "value": "T10D263330AB91E025F4B312F946B643A5B93B7F20AB7461DF42D426DB02686F6DD31B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629928679, "uuid": "925ac82d-0c57-4ae5-981a-87fb2baaef29", "value": "f6ee633166e72a1d10f4f54440093ac0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629928679, "uuid": "1c60a3d4-363a-4462-a905-a9d31352f7f0", "value": "98304:k6CxsJ1sHX9maNMuK7bBcHsyiL7NuyfbkiCPxQuwtE3NG:kYJsX9mV6MyUNuygiCPndG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629928679, "uuid": "9a1bc75c-521b-466f-91d2-0c127948e534", "value": 4656680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629928679, "uuid": "dd7ac42c-e173-4059-8581-485e2ebb5c55", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629928679, "uuid": "6ee71b8c-8153-4ce5-81a3-eb05eae32bbf", "value": "2d9efdd99d9744934858f1702b16c9ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b805a78e-05b4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629903428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629903428, "uuid": "cb64d643-2f0a-4f8a-8446-2a9117467c19", "comment": "Malware payload (Dridex)", "value": "2f447990399de9fbea36fbe048b01d6f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629903428, "uuid": "a0198fb2-ecb4-40f8-8884-e2e791a2ed48", "comment": "Malware payload (Dridex)", "value": "666cea07a8acfbd6bcfd52cd7cdb9668ba9182d92df744868506715b069d0d97", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629903428, "uuid": "f7daf81f-6d4c-4dc9-9966-e3ebb535d6df", "comment": "Malware payload (Dridex)", "value": "0e02a2ffae58a155053a1c1c662089495b8aca93", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629903428, "uuid": "13cc360b-e770-437c-a718-e53b548cba14", "comment": "Malware payload (Dridex)", "value": "a370a0fab97f0a66c710d14e1b45e51db49d0e6d736e3cc24d6b33a1348b6101d2c40dbaf7387e8b4f1394e2539b69d0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629903428, "uuid": "b9ebaa4b-3eb0-4f03-ba96-050c6058f23b", "value": "T14414DF82CD9F46F9C21B167139F531BE21E80645A769CC2BCADAD2FBF47D300D46261A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629903428, "uuid": "da88c18c-eff7-4cab-a7ef-f7d074b83461", "value": "15d931f2533164c416970d03fa5b5c88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629903428, "uuid": "2d268c33-bae1-4e0b-a194-3196fad5310c", "value": "3072:RH0uyjZqEpAK+Gf78TBdrXkTM5vhRg9Esf0DwvtyMpVnpA+z6tX8sxKViWC7dU:RUua/Pv7YNhRIEZDeXVpAxtMsxK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629903428, "uuid": "b4abc6be-387d-45a8-9e82-ae2a7c54c7f4", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629903428, "uuid": "6333ae34-dfc0-4519-a246-e0aa281a9749", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629903428, "uuid": "4378df3a-6362-44c3-88f6-4e14dc1e9966", "value": "2f447990399de9fbea36fbe048b01d6f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e554f94-058c-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629886044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629886044, "uuid": "4c93725a-b340-4057-9105-2beaf2e3e104", "comment": "Malware payload", "value": "9d604378bd96b7d5de98b2d64e8b388c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629886044, "uuid": "6406203e-b593-4950-8316-0c003c00b586", "comment": "Malware payload", "value": "66d55774ddc3c2e2a33f3158adc526bd703def0eef939c1e72956ae7256f0dd6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629886044, "uuid": "2f402fcc-ef1e-44bc-b94b-b59ed3cd0cd6", "comment": "Malware payload", "value": "713d6b6319c007878905879f47ce4f3806f3c1ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629886044, "uuid": "e977f014-6ca3-4a4e-b437-f99be33984cf", "comment": "Malware payload", "value": "37bcde2ae0cf4bd0669e0d75a5d114ac457ad15262219ef0eae933bb98cb8cde7598ca58b6c6449a4b7ab928b1cbd8f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629886044, "uuid": "08ae45b0-54fe-483b-9b89-d24575986ad1", "value": "T1DAE49F57F7CBF6B0E6FE867A85F2851C52B774620260A78F664072896D22382453DF0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629886044, "uuid": "f1a13146-bc1a-4ad4-85bf-803facc90081", "value": "a31761b5a590c4c499d5f4a347d75c12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629886044, "uuid": "ade99bb2-d3a9-446b-873d-3789f4734fd8", "value": "12288:cn/zDvGHAykH8vLW/4+8bzbBSreMdjBY4ZyrE7K3yl8PeVooA/AB2LEJZsAQPUq7:uzbGHAzHKjX1kBY4ZyrE7K3yl8PeVooY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629886044, "uuid": "81802e66-98bf-4a9b-adac-d64407b1c4ec", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629886044, "uuid": "02c86a0c-d75a-4b1f-a914-bac7139cd9af", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629886044, "uuid": "18f1a568-c7ab-48aa-9256-5d008bfb9c06", "value": "0001.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "885aa3bd-0567-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1629870276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629870276, "uuid": "79ff5528-b08f-4963-ac75-f4e5da42881b", "comment": "Malware payload (RemcosRAT)", "value": "7b61cb23b8389e29a5d7870ada6ab98e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629870276, "uuid": "8053fea4-bed7-4883-b026-b5c03124708b", "comment": "Malware payload (RemcosRAT)", "value": "688485847e439db92e0b811a8d5f7a9cd69f451b3845e2a8a2a8b15ac9f9f252", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629870276, "uuid": "feab15e9-b6c4-4719-abc9-9c5ae3f9649d", "comment": "Malware payload (RemcosRAT)", "value": "55897e68926688ac5534d1f82a80a31b52d73535", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629870276, "uuid": "b7ff7712-919d-413d-a4b1-ea63e551296b", "comment": "Malware payload (RemcosRAT)", "value": "1f677dc769f13da84c69e9f87158e0850a51b06ea27c393bb7e3444fad0747bb30eeef78d4d8f831fa2549013b2353b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629870276, "uuid": "69c649d6-ab2c-43ba-8908-344378a9f96c", "value": "T116B4016EB591841AD7F976FC681021F3A7297DEAE12460CBB1F5BB58C03050BFE0866D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629870276, "uuid": "8c034d75-7220-4b80-8f0d-0610f8acb4ef", "value": "35807dcde258f88fa3ce5c21adc607fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629870276, "uuid": "924f5dde-e27d-4e22-bb21-4bfe7f388226", "value": "12288:rvEW4f/qepnpNQdaw1oKMl9OoNacdoUYRxK8:rvl4fCQppw16OojoUs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629870276, "uuid": "04a25e10-fb19-4459-836d-0662306de85e", "value": 512814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629870276, "uuid": "2303b3b1-dc06-4509-84d9-dc599f131cae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629870276, "uuid": "e6163962-a119-442f-a350-348f346e9afb", "value": "099900000R.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fc4a26b-0565-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869242, "uuid": "6641b8d8-0b6e-442a-9e68-3eb68b54b717", "comment": "Malware payload (Dridex)", "value": "559eea5641975c6255ea7ce8009b510b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869242, "uuid": "aa191bfa-b074-4657-9e73-877036bbd9fa", "comment": "Malware payload (Dridex)", "value": "6a7a63b4b58439e8116908c89df85d7d94f7317f11858d824b1c3bdb9a91273e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869242, "uuid": "c9005f93-ff35-46ad-83ff-bf372e4bbc2a", "comment": "Malware payload (Dridex)", "value": "216867d6862e5e756caa3ff885d40bee627b6d35", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869242, "uuid": "afd0669b-ec19-47c5-9770-050ca2079501", "comment": "Malware payload (Dridex)", "value": "5683f664162a43ead9ec0c4c2c98996b34bb3e7386cf31cd26bbb28d0f15c78b13144ad93949b865a6c1c12c0424651b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869242, "uuid": "55a21d1c-d622-48d7-a0d3-ffe17ef93e78", "value": "T1C8B3D0EA7672DA99C12D133D15DF1E7A6BF88B884292871A026CF41C6F235F7D70025C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869242, "uuid": "26662b87-a531-4c58-8930-4eedde28c937", "value": "3072:oUIImeIe4Elu0zs9H/Qui63LD6z2qoaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaA:oVS4Spsx/867Moaaaaaaaaaaaaaaaaaw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869242, "uuid": "0b5c2b86-5455-42d3-be69-6972ffcb1feb", "value": 115419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869242, "uuid": "cd153bf5-37ce-4c47-8f6c-368b91ea36fc", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869242, "uuid": "9b79a7ee-616a-42ab-83f1-1c17fcdf41d9", "value": "Details-74149_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f8d8b2b-0565-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869215, "uuid": "5746f9c1-3e88-4921-aa34-9200d446acc9", "comment": "Malware payload (Dridex)", "value": "ebd8d505db5812357c29ece3a10581ae", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869215, "uuid": "798f0805-55db-4cc6-9382-4d1a6c67186b", "comment": "Malware payload (Dridex)", "value": "6b7270d290ae785e4e420aec9ae7fe48cc325f65138e93307e2d21cecd9aa898", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869215, "uuid": "1bd2aa61-092a-49fc-b1b1-2b9a0fa0201e", "comment": "Malware payload (Dridex)", "value": "bcc6008e3146cf5907db5c3029b9ae3e57f4163d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869215, "uuid": "3e1b4284-e283-466c-a02f-779da43d433f", "comment": "Malware payload (Dridex)", "value": "d031cbfa0a9cc6799c8da78dfd3ac87551b633c0e94d2ad6cb9f2008f8be124cb951e993519c4060124cc5dcd99c5507", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869215, "uuid": "83e4eb55-da95-4912-9b99-6ed67f0bfca2", "value": "T12B74010DC6B7E97ACA860DFF4D7C04D1A3978A37C5914AC6888971EC2F1307A4259BDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869215, "uuid": "30b58145-c7d7-44c1-a33f-8bb459a219d9", "value": "6144:oIj/izqKlfbQHXO/J6t/VYfASkKTzZYwPMPFde/Qxx2u+OA+NT5A4gNM:XeLZQHX7ifASkKTzSwkPFduQx0uD+c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869215, "uuid": "a4395d88-7585-4997-935c-af3e5504d49b", "value": 348509, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869215, "uuid": "afa4ca28-8bae-49be-947a-5c56e1105279", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869215, "uuid": "908fdbdc-3241-4132-94c6-c8b95452e7d3", "value": "Scan-4091257416_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a1022ff-05cf-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CryptBot)", "timestamp": 1629914974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629914974, "uuid": "f972a8ae-6cfa-46e8-967f-19c37590e858", "comment": "Malware payload (CryptBot)", "value": "df80e2baa39df168def0153a2da053a2", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629914974, "uuid": "77a43b81-6d11-4085-bdd2-20ad675cf2bd", "comment": "Malware payload (CryptBot)", "value": "6b7bb728fed4545f0e4b9d3ab78e8f008d78f635d1a9f118a1b962d466c2118d", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629914974, "uuid": "47f0f086-d11d-40a7-8a72-d987a76b96ba", "comment": "Malware payload (CryptBot)", "value": "85c6fb34424276b3570c23c48e04552ffa2c1d4f", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629914974, "uuid": "3e7ecfcd-297c-4e6b-ac4d-e676e572699d", "comment": "Malware payload (CryptBot)", "value": "555c6a60210151087a230d399232f0d8cae36407d7cbac5ee86642d1e616994d7b6795bc50b0ec7e063583fec7c42836", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629914974, "uuid": "ce9d4087-0b1c-4f43-9e89-58187cf7322a", "value": "T1CAE5330ADEF69479C650E2BBE61C016036245EE8550E49E1200FBE7980AAB7D5FF7F42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629914974, "uuid": "acc1b7f0-4ad9-4eba-988d-b4bc6651f2f8", "value": "f8d9e6f58bdad8d3f277d01c805576b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629914974, "uuid": "c2f56d2a-5446-474a-b913-bc3513e80d00", "value": "49152:i26B4s8A+F1PPbpNwOD5iIUJaQVSn0CPW3ABy1n8kyNeC3qRiwQcvqPxB1Y:in8tlTBUgiE0QW3ABE1yNtWQfY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629914974, "uuid": "db255e0d-3311-4975-8ebd-1cd7bd795a61", "value": 3149312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629914974, "uuid": "4a0f3cb2-09f0-451f-994d-fd83facf9f9a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629914974, "uuid": "f2e073e0-5725-4e9d-89e2-76007eb3857c", "value": "df80e2baa39df168def0153a2da053a2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc710d37-05ce-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NetSupport)", "timestamp": 1629914602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629914602, "uuid": "5c55c9db-1437-4b86-acc6-57b79c9a9009", "comment": "Malware payload (NetSupport)", "value": "7aab372250bf1a480266078124b1862f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629914602, "uuid": "c0c7b94c-47e5-4205-9e31-9edd2c4f405c", "comment": "Malware payload (NetSupport)", "value": "6c481c30e6f426d96a6f6f4f3f58cbf30d055f5c42896f55974d9dd5891f223a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629914602, "uuid": "934e251f-a7a0-4165-acc0-b09d8d906b0c", "comment": "Malware payload (NetSupport)", "value": "016c2f9a8fcafa6ee0baa6a5e4c0a752dbfd43af", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629914602, "uuid": "7e2ca6f4-451b-4a9b-a68c-6f205f6b9804", "comment": "Malware payload (NetSupport)", "value": "2d2f67a8c6aed693e4967ff0b8fed08a2c3f60c03355597ece8e1c2f85e3f5b8dfcfd7656cbd1c82aae0647c215e3dbb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629914602, "uuid": "ed644f3e-939a-4e2f-92f8-0c67caa9e589", "value": "T11B5305D46391D50766CD1F83BF0ABDEDE02FA8B659C8A5078694BA9C24BD407C6B0DF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629914602, "uuid": "a6f6217c-6ee9-46b4-bd5a-c3d44b9869ee", "value": "768:NZP5FPhYuXoSvet6RcQlrd8Yh+X9CXsixMBwscfoR8hGqSjgfBtbipLr2STDUaqp:NZP5FPh7Zet6RJlrd8Yh+X605bI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629914602, "uuid": "b6456db4-e3d9-46b5-bd87-fd8086c1ad1c", "value": 65971, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629914602, "uuid": "61bad58a-5dc3-419a-a259-60aeb4669cd8", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629914602, "uuid": "de302a75-0f29-4020-afcb-94e3ee00331f", "value": "feedback.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdcf0492-059b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (a310Logger)", "timestamp": 1629892727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892727, "uuid": "1f6c9011-f293-4351-b046-e123b6d4588e", "comment": "Malware payload (a310Logger)", "value": "9d8bd1a80acd712dc10e174cbdad8daa", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892727, "uuid": "cfff30b9-9307-45d1-acf2-761e97ad62ea", "comment": "Malware payload (a310Logger)", "value": "6c61d18fadb92cf6235f0d9f708f876f8b8bcaaa6eb7d66d5ed515a60a317d94", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892727, "uuid": "6d9fd21d-a589-403a-9d6a-eef356fe919d", "comment": "Malware payload (a310Logger)", "value": "94941990af9a90fc27369e4bf4a1a82e11c536c7", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892727, "uuid": "f16e0be2-05b7-4f84-a885-0d3ea75606c2", "comment": "Malware payload (a310Logger)", "value": "1c2401bb878f15c1b2abbd51d190d674a5f60290480cee69e6587986e83dced6613609559f155a319c251550668a45fe", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892727, "uuid": "c69e9253-d7dd-4981-992d-57ac31a25125", "value": "T11FB41275412969BFC96036F78FF549AA46C89F7BD12024CA60B07DFEC5F8B8484182DC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892727, "uuid": "b4b4cd50-f1bf-466a-89c0-4d6084a6c7a4", "value": "35807dcde258f88fa3ce5c21adc607fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892727, "uuid": "4ffb3f6b-daaa-4b4a-b62f-5283defa0521", "value": "12288:WCYl8CEyYIa2K1jePyf5DNjleenYXacCEwi1lyFZj:WCYlF5HnKSKDvLnYXrpwxFZj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629892727, "uuid": "e743ea41-2c69-4473-9764-ba557dcf86f9", "value": 498536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629892727, "uuid": "29d345e0-5144-4232-861b-c25e0e21be5d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892727, "uuid": "20af2a0d-be2b-4425-b6fb-a898dbb1108e", "value": "9d8bd1a80acd712dc10e174cbdad8daa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e05e65d-0586-11ec-8fa1-42010a9c0011", "comment": "Malware payload (BlackMatter)", "timestamp": 1629883627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629883627, "uuid": "91ecbc32-f070-4e89-9e3f-bf3eaacb0fc7", "comment": "Malware payload (BlackMatter)", "value": "10aa058a3ac49e016cad7987b8e09886", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629883627, "uuid": "8d9cb071-55f2-4dcd-a1f5-8e9739e0d820", "comment": "Malware payload (BlackMatter)", "value": "6d4712df42ad0982041ef0e2e109ab5718b43830f2966bd9207a7fac3af883db", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629883627, "uuid": "00e7bb8b-723f-430b-9705-f1cdf92a46d4", "comment": "Malware payload (BlackMatter)", "value": "cca6682330a819592c3b1ea0448ceb4e141593dc", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629883627, "uuid": "0eb4222e-8b81-4ca5-bfab-a748c2f27aa9", "comment": "Malware payload (BlackMatter)", "value": "d2e78e210e87a1a169abbbc1d51e8b2bcd56f56f988649fd43d1a9b473930bd23a410062c6f7f01b5a196a0d67a9dcf5", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629883627, "uuid": "d3c419bb-b432-489e-a47d-793b318565ee", "value": "T1FD634A1075A5E033E07796B2BB0E7D713BC98D3C1C766553A4980F48EBA18631F26E5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629883627, "uuid": "87ac553d-475e-46ba-ad22-9bfecae7cb86", "value": "96c0c982709316e2c58b11a3c2b057ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629883627, "uuid": "843f7fef-45ce-43ac-825e-f139acbc8ced", "value": "768:VjjjjjjjjjDahoICS4AIbxCJhjZeO3r825CiqxLbMnkHYnvizKktsLFYXg/ripMX:NICS4AgxwhjEO3r825exqkHYnKevTiO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629883627, "uuid": "c73d19ce-6391-4270-861a-f62b49cc7dd5", "value": 73216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629883627, "uuid": "144cc261-b067-47b0-ad68-54eb87e6ccde", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629883627, "uuid": "5e74ecc4-6c6f-493b-a120-4fd783f8a047", "value": "6d4712df42ad0982041ef0e2e109ab5718b43830f2966bd9207a7fac3af883db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40704d64-059c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1629892919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892919, "uuid": "d836866e-eb8e-4663-83bb-1b9a19a4c209", "comment": "Malware payload (Smoke Loader)", "value": "49516fe08c765da8c2bc9151c6191b84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892919, "uuid": "8a77197f-18f0-4fcf-90af-4b0b0b66bfb7", "comment": "Malware payload (Smoke Loader)", "value": "6d69e8561d00ec74735297d21e777a9fe9b858b384292c38cb0239db2e3b73bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892919, "uuid": "a7a11a41-1e72-42ea-b78f-8ae7a8f3bb63", "comment": "Malware payload (Smoke Loader)", "value": "42b2b55cea15d147f5e0ffa189676390ab8215ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892919, "uuid": "78336721-655b-43fb-8b6e-bb311a86be78", "comment": "Malware payload (Smoke Loader)", "value": "59a6cf20bb6e6f34bce2d0a00eaa641ef6bcf1758cd3bac5d679a7787a23570d78dbae1450f77b31088a7d1dc42fcb35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892919, "uuid": "f7515bb8-98ed-44b0-ac47-0383ec9d6922", "value": "T19C447C30A6A1C035F0F312F849BA93B8B53E7AB16B3450CB52D526EE52386E5EC31757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892919, "uuid": "9b4f2f56-097e-4c05-915e-98a51b3ae489", "value": "35372ade599ee63db174ac99307517b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892919, "uuid": "5a59b826-ea6e-4f18-8164-bbf8f5702523", "value": "6144:YCP4v6MVz4eJJIHNZgwbfGQ7+e0CL60yuxvk:lDgzxJ8Zgwbeu+06av", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629892919, "uuid": "29b2a957-146d-4d38-ad32-3bde7f700586", "value": 274432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629892919, "uuid": "bec94234-e2fa-49f3-a9ca-d2dc4e5e31f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892919, "uuid": "a9edd07b-4665-4dc2-b88d-7f0353048e29", "value": "49516fe08c765da8c2bc9151c6191b84.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b636c5f4-05f2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629930053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629930053, "uuid": "1d2f29a9-905c-4048-9768-037c0421f451", "comment": "Malware payload (RaccoonStealer)", "value": "e0a988448c0f1a41fee0176052212389", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629930053, "uuid": "a4ab8194-c39a-4cae-8c7c-33a70a019770", "comment": "Malware payload (RaccoonStealer)", "value": "6da42206d67431f500c18b7628f8ae9ef4118539379ab7d47933de0a1360f776", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629930053, "uuid": "bfd62b19-425c-41f1-97e0-a71c25bbab6b", "comment": "Malware payload (RaccoonStealer)", "value": "5a9a604bd3f8bcc640f074ad9ed7e552599c7126", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629930053, "uuid": "f4fda103-86d2-4f50-a88e-3e12c0c5b2b4", "comment": "Malware payload (RaccoonStealer)", "value": "1de0d00c57d5cd03d9b20ebf59459190ae87db2c10c8a2bfbd3acef627e4cb20921adf4dbeefa96536e5e9e1b0db9b51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629930053, "uuid": "a1d8557c-f6c1-497f-b854-c226b770aa32", "value": "T1DFB4D030AA91C035F1F362F445B6837CB53A7AB05B3550CF52D61AEE1A346E6AD3078B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629930053, "uuid": "252c7d7b-7fe3-4bab-a2fb-2152dd68240f", "value": "f6ee633166e72a1d10f4f54440093ac0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629930053, "uuid": "822a0c59-33dd-487d-83ad-6875be7264ed", "value": "12288:90+Qa2PodbYTyCYwEGKMMY4h1iu/PVHSy2BHoUCt/hrnbegZ:ZoPotwEEMYkjPNSyA6t/hrnKgZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629930053, "uuid": "a2a80ae8-69a1-413e-b543-5ce998ae1bce", "value": 537600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629930053, "uuid": "197ddf95-3308-493d-a4ea-477f1a18b697", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629930053, "uuid": "9df7065a-5966-45c2-a493-bb28c8df9acb", "value": "e0a988448c0f1a41fee0176052212389.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1336701-0564-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869056, "uuid": "e475b301-2e6c-4326-b629-9079d36e4b4c", "comment": "Malware payload (Dridex)", "value": "2ce295dcd3764b8618daeade78c6e6c4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869056, "uuid": "88bc9fdb-03d5-4eba-b170-591a42355620", "comment": "Malware payload (Dridex)", "value": "6de25ca57c86190d89f900b0d6c95bc5484102e46180f39c916e0f6b2ddca9f1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869056, "uuid": "1317713a-3292-4f12-bd94-2d9b84a1b8b1", "comment": "Malware payload (Dridex)", "value": "46045b4d9f509a83cedfafaa48a05c19f52249a4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869056, "uuid": "00fc52e5-a9f6-4dd5-8994-eb0f1bb6cd2d", "comment": "Malware payload (Dridex)", "value": "3d8d710522d469b71f2791ebfd951d3784728e08ed89535938e66e180bdaa324aa85c7907f13d05bb6e2b390243ee613", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869056, "uuid": "ba7dffcd-e3b7-4817-9621-8da1d7ee5662", "value": "T16274126892B1C45CDC4E503FA1D70F72CB711A0A5682B72FD6B1B60D5F13D3E8B6A0A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869056, "uuid": "3342cbfb-1d8c-4c6d-b868-a86307b317c0", "value": "6144:ogkHHNfWH2LohOGYw6CC5jTT453mjEIbWiGVAKSLFN+YInSCRvuPsxN5j:kHNuWL2OGY/TTy2jEIJc6FNu3uPmNN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869056, "uuid": "51d57a6a-31b5-4607-98c3-098fd76eebd1", "value": 353190, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869056, "uuid": "5df32403-b394-44d7-a7d3-ddf921cd9977", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869056, "uuid": "a08a1e03-6f5c-46c2-adfc-9d19f420c74a", "value": "EoY_TAX_Export-59764745_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "901fd98c-059b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1629892623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892623, "uuid": "f777e63e-c7b8-4426-907a-d1eb3561c2fe", "comment": "Malware payload (Smoke Loader)", "value": "906efd90e3f6ee1c7a52947ae04cf168", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892623, "uuid": "0964bd03-0f80-481e-9c3c-f22eef2bb817", "comment": "Malware payload (Smoke Loader)", "value": "6e390536448edde2377fa1fd7844adbc9aee58583641e300ecdf847983ccf9fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892623, "uuid": "f0c25033-8f15-4d81-b701-86a133072cd5", "comment": "Malware payload (Smoke Loader)", "value": "3920532af227a2ceb435a04c18f56cd79dcc0519", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892623, "uuid": "4ccc2617-7b6b-468e-a41e-d5fec863c17c", "comment": "Malware payload (Smoke Loader)", "value": "65d4c8a0d2ea7efbdabe5dbb3e3b261eb46c1c8e78d77e3ca0c8748425c48403a4f3740469a149b4a058b8cba6c7a722", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892623, "uuid": "e08de73c-53f8-4831-b388-d2ec6571d497", "value": "T149449C30AA90C035E4F312F885BA93B8B53A7AB06B3550CF53D526EE56386E4EC31757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892623, "uuid": "eea9aa49-f90f-4180-9d38-ae2710ff41eb", "value": "2d1e5013dd6b871ca263ffc72a0f89a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892623, "uuid": "1e0ad2f7-2a41-4b0e-8d28-4c08d4eb4f19", "value": "3072:+/c4AmO4g8HiXQIlLYrCXdole/5eBxKto6M5shlvat7zDy2lqM/Xe5mgMNpSk3Os:+EBp4gP7KiolA5dto6uAvlad3F3K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629892623, "uuid": "33e6d077-4006-49df-bc29-69ad5331b3ce", "value": 275456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629892623, "uuid": "564defde-a772-4c3a-826c-e6c3a6e094e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892623, "uuid": "2caa5c67-1484-43bd-a00e-8789831886a1", "value": "906efd90e3f6ee1c7a52947ae04cf168.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97d680df-0571-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629874597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629874597, "uuid": "76f9eb59-5922-44a8-8d5d-a357d6e1201b", "comment": "Malware payload (RaccoonStealer)", "value": "3090649ba50f814094b852620b762c1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629874597, "uuid": "3defa932-03cc-4ea0-832b-8a431f6121b6", "comment": "Malware payload (RaccoonStealer)", "value": "6e4f659019bf327df05eb4aa7db3a381f01f8e35157cbe1a81c1bdaee3ab0c5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629874597, "uuid": "761a6379-deb7-43c9-97cc-0f928e92291b", "comment": "Malware payload (RaccoonStealer)", "value": "b66ba193acea83fdcf7123c2e76c13146d624a66", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629874597, "uuid": "1b1247da-a9ea-4b4b-964c-4264b53954d7", "comment": "Malware payload (RaccoonStealer)", "value": "fd82e05805363fb10a4eebae00ac88e3bc9abc67ca02101f806a096a73cdbd9c2be17cb8ff8b756660bfb2dd97b4c5a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629874597, "uuid": "111682d5-2c1e-4d3f-98ac-a1028c6a9dfe", "value": "T15784CF30A691C434F9B621F889BA83B9B93A7EB15B7450CF53E516E903346E5EC30793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629874597, "uuid": "f8198aae-6496-4dbf-b306-e2173ed6d057", "value": "ddbb3eef631957f988f10b48742f9549", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629874597, "uuid": "152d966b-0011-4e32-b24d-29210ba2859d", "value": "6144:SiMW4fhicjHIdMz1BlK7nhxDEbBkxQvHFLRSg1qFANpkkh3ROIHwPMMjeUMtX/pa:AWuhiYod0FK7nhx4bixEHFdSeqRG3ROA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629874597, "uuid": "ff835907-9b99-44b9-b356-c24072ca3a0f", "value": 383488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629874597, "uuid": "7ff95205-787c-4605-ab55-d8b3d34b69df", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629874597, "uuid": "88e50236-56e7-4d77-9dcd-271d32483f22", "value": "6e4f659019bf327df05eb4aa7db3a381f01f8e35157cb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afbabb0a-0564-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869054, "uuid": "35e22e61-6da0-45f5-bfd9-4eaade908315", "comment": "Malware payload (Dridex)", "value": "f44a4e2d5fe0ef1d7e24afc0ea452031", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869054, "uuid": "cf48bd62-f047-4cc8-ae94-fc90ea27d900", "comment": "Malware payload (Dridex)", "value": "6eb00c5fee11ba0e5f5237689915f837dfb76a790a544255df4d1533d08d5c01", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869054, "uuid": "5a80695a-6baa-4fb2-b4ba-46ae963725af", "comment": "Malware payload (Dridex)", "value": "225d774ceebd6d2cc7cf2c8f07de51eca7338f38", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869054, "uuid": "624c184d-23a7-4899-b63d-367e1dfb1577", "comment": "Malware payload (Dridex)", "value": "658dbd5e594292536d581465fdff2ba2ed58553417fc6100ae82b33bd27913549a0ba1d57137c97ced8920dffc42563c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869054, "uuid": "d25dca48-e185-4022-b046-23b8b1f67d6d", "value": "T13474126892F0C80CD94E413F91D74F71DB726A06D7826B1ED562B70E9F02C3A4B6B1B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869054, "uuid": "53d28cec-5ebf-4f3f-9c57-c03dc1d6acf1", "value": "6144:ogAL6Lsn1YNP2LohOGYw6CC5jTT453mjEIbWiGVAKSLFN+YInSCRvuPsxNR:ZA2LsSNOL2OGY/TTy2jEIJc6FNu3uPmr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869054, "uuid": "44a35d94-9822-4744-bc99-9cf7fed70b21", "value": 360577, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869054, "uuid": "0a667d26-f4f9-440f-b4d8-7f6bf03a6073", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869054, "uuid": "e52dcf1c-b0c5-481e-8fbf-6ba4bcc857b9", "value": "EoY_TAX_Details-405136868_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9326f146-0565-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629869436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869436, "uuid": "ff708b8b-6b10-475c-8ced-a6f1d89b7bdc", "comment": "Malware payload (AgentTesla)", "value": "127a3c0376880e46b8c1c22f9e1bbee3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869436, "uuid": "1e3892d5-a4ce-4615-9521-f38a8b9b7732", "comment": "Malware payload (AgentTesla)", "value": "6eb480d2e02ab436a1294b39cb001a933e7d5e7d7aad5131820451f17dc55e20", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869436, "uuid": "fe7f582e-0e25-49cb-bdf4-e094fb1a7a43", "comment": "Malware payload (AgentTesla)", "value": "caeb845a3585531f5515559e2c014a972c72e664", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869436, "uuid": "a6adea33-c5e1-4dc1-8286-09ccd3dc529a", "comment": "Malware payload (AgentTesla)", "value": "70cfcd422baa01038f02ecc825e705d8258c569dae34dff646d18dd05166a5769464d51fc231ea785fa666446eb5043d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869436, "uuid": "0012afca-12d6-46d6-9b83-0984818906e1", "value": "T1F3C32EBDD04705A8CF869BF8272B9F45148C361EF398A1727A7897356AD1C7B402383D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869436, "uuid": "108478bb-cc81-4ffa-acd0-bcc59ec0c704", "value": "384:1bRLRE9MvyjB6+AJ9Hv/ZS4+IKPLCXAnW32y/Wl:1dLi9MqjTAJ9HWjCXAYgl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869436, "uuid": "386dde02-9f44-43e7-972e-9522416d970f", "value": 126563, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869436, "uuid": "96f14186-3f4e-41d5-9767-399e14bca149", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869436, "uuid": "405b831c-4706-4c3e-b06c-622543841df4", "value": "POmt1904069.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dcfac47-057d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1629879600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629879600, "uuid": "33eb1cca-9a17-4d39-aff7-08bb5bc5e180", "comment": "Malware payload (SnakeKeylogger)", "value": "009784700cb0534965d78fb5e2433a8f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629879600, "uuid": "b127513e-d8af-406e-913e-c7ad79bf8f34", "comment": "Malware payload (SnakeKeylogger)", "value": "6ec80b2dc86e97a886c52fb67aea4ce1ab195587d51236f00cd5c4bf93edb4eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629879600, "uuid": "10dc613d-2a4c-4dd1-b761-45cba88e94bc", "comment": "Malware payload (SnakeKeylogger)", "value": "05f2a89463f1335681fe7669a95a91ff52095081", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629879600, "uuid": "cfd3daa8-de0b-442c-a160-3a55d81b2dab", "comment": "Malware payload (SnakeKeylogger)", "value": "2ec49d9f560abee3437c549ad78a4e335b22cb50eed296da59d6a633ce5b45f4a000eb484161e4c7312c1a6808aa5435", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629879600, "uuid": "bf8becaf-cf04-401d-8f17-2b2fd7f95cc4", "value": "T1D2350102B781847ED532293218266AD5EB793D301E24F66F63E43E7F9F711819624BF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629879600, "uuid": "68c853cb-8e45-4430-9ca7-7895378537e7", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629879600, "uuid": "52124ae4-41a2-4249-9f0c-cd134a17f98c", "value": "24576:nAOcZw/DuR+4Ys4zlisWCnG8rSjlCBWq3XFQYcqa6lCKCvZ:ZVl3NG8i8WWX6KtAZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629879600, "uuid": "d6ccfbe9-8cb2-4f88-92f3-15af71b324b5", "value": 1140132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629879600, "uuid": "94325cfd-7287-464c-903b-c2a840312506", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629879600, "uuid": "b31487d0-32c8-492e-bb8a-041af3cb9488", "value": "ORDEN DE COMPRA014.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2181ebf-059b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (a310Logger)", "timestamp": 1629892653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892653, "uuid": "0f3dfca4-d949-474c-aff1-04023c50ebf1", "comment": "Malware payload (a310Logger)", "value": "6ea7d1f25a238b9737d63d7dd1178dab", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892653, "uuid": "6915f4b6-a35c-4381-997d-993330aa00be", "comment": "Malware payload (a310Logger)", "value": "6f0cba180dbf4115883c20ad4f8279c765d449033146d2588069f7f20a2db61e", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892653, "uuid": "374f6ec5-e94b-4550-b7dc-0c88114a6afd", "comment": "Malware payload (a310Logger)", "value": "bcff7d791c2a2ea06d3c465d139ec7855388d3ab", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892653, "uuid": "02111c3a-9c55-41f0-95d6-e097729e14d1", "comment": "Malware payload (a310Logger)", "value": "189dd703259ade159ded249435a8814c92622a5efaf3e4e9609d409f046e328ed8e9b3945274157804d39d686dbabfe1", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892653, "uuid": "320a39e1-8026-4de3-b34b-660a5ac3db8c", "value": "T1D3B4124BE1BE5130C2928EB538CA82573717DC716F1A4BA271827465BD727F3A0B4E63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892653, "uuid": "f05b4768-9a4c-46f4-90b1-0e16c0e83f05", "value": "35807dcde258f88fa3ce5c21adc607fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892653, "uuid": "83f76799-333c-4018-b865-c14a2ef8b82e", "value": "12288:zFtu6HbaVc4ZWhh7M+27bA1GsiLUU3+8Gnq0xs/zdoknSkjIvXe+AcN:z3oWvMZQYXZ+80q02/zbndAZ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629892653, "uuid": "fd7a25d5-7d67-4e59-9dd9-64d396bce148", "value": 498477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629892653, "uuid": "7e676c2f-6c80-417c-ba9c-68eb2e23a716", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892653, "uuid": "1217680e-2cbc-4b34-9061-501f462126bf", "value": "6ea7d1f25a238b9737d63d7dd1178dab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a898e270-056c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629872478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872478, "uuid": "6d4643f9-3752-4d63-a44d-2145d6f04345", "comment": "Malware payload (RaccoonStealer)", "value": "5fab316b665f8b05fe892d560c7ac49a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872478, "uuid": "4c9074e4-b192-4e98-8ddb-f030bf184fdd", "comment": "Malware payload (RaccoonStealer)", "value": "6f10ef5813936e016760672e5e3ef3df0e1b385d7c3051efcbfe5ba8b3e2548a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872478, "uuid": "fdfbc828-41ec-48bf-af65-9321f36d6d09", "comment": "Malware payload (RaccoonStealer)", "value": "7d3e740c0ba0e594e2823370667a90fc0f738389", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872478, "uuid": "978d579c-4ce2-40ce-a276-55e10ccacedd", "comment": "Malware payload (RaccoonStealer)", "value": "e598757e61ca7cdbaf8b6f4ad58f1a26380295def6d89c2bc510d9b30ec737e6a73da690d038aebedebb3b642e8e70ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629872478, "uuid": "efe1f1b6-6cc0-4056-9ac5-76406ff38345", "value": "T1FBA41289BEA0CC73D525C1735C62C7A0563D76A1A9B042833BF88F9F1E661D03B9E356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629872478, "uuid": "23ad22cc-8fe2-45ac-a63c-743836a35fd1", "value": "bd3c9edf948deca79ee5e78523f1a042", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629872478, "uuid": "b356b79d-a347-4e27-a4e4-4107176e8a44", "value": "12288:2xScc5c+l7RDqQq8cIWrOz/y+557EBUnvcF:2xDc5cKeh1+2uS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629872478, "uuid": "feea6e31-e974-49cd-ae1d-c5f513746b66", "value": 467968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629872478, "uuid": "35ef35ec-af9f-4ec0-a69d-00244d2e2810", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629872478, "uuid": "879a81d4-b4ae-44d1-962b-e58a90c77668", "value": "5fab316b665f8b05fe892d560c7ac49a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9436567d-05c9-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629912387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629912387, "uuid": "fb4251e7-ee59-42cc-803d-ec23df8f027c", "comment": "Malware payload", "value": "3d1a4d688334228ced79e914d87224ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629912387, "uuid": "c184f8d9-5b1e-4ce3-b76e-57493872535f", "comment": "Malware payload", "value": "6f6022a7213a133fb217d60dc3ef39feeb11757d0ef35e5f3c94063557a171e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629912387, "uuid": "39004e51-5476-44b9-ba7e-14f7163ab001", "comment": "Malware payload", "value": "a3639067ddb3f32b20b91b3ad38372a765c39c33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629912387, "uuid": "66f94eac-9c2b-4028-9a2a-38b93af8816f", "comment": "Malware payload", "value": "8d6fe25a66860570ea3d1678469642e6d87145136470287db2e605dd1ee05f4a849abb97a63b1855bece538471228bb3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629912387, "uuid": "a7620ba8-580f-43aa-aa43-9d900a417fb1", "value": "T1E5F4BF57F7CBF6F0E6BE827A86B2851D52B774520260A78F674072896D23382453DB0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629912387, "uuid": "bb652d06-c250-4ab6-8101-d8e5dfbd141c", "value": "a31761b5a590c4c499d5f4a347d75c12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629912387, "uuid": "5d87ca32-4faa-4b89-9a1e-5a13bce1f259", "value": "12288:hn/zjvGHAykHJRLW/4+8bzbBSreM35qZGDxMm5r/uR89Kmn:Vz7GHAzH7jX1GFxM6L+lE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629912387, "uuid": "8d51dc7b-cfa5-47cd-950b-56ed0f1f9f30", "value": 748032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629912387, "uuid": "e2180f4f-02f5-4de8-ab47-61de4c436906", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629912387, "uuid": "a7b2625c-d127-45b6-974c-f9493b7a074d", "value": "Wire_Transfer_Copy.xll.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66d6079b-0599-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629891695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629891695, "uuid": "c48d47d5-324c-408b-a0f8-910819bfc80b", "comment": "Malware payload (Formbook)", "value": "a922d2f18ccca51fdd3f34f81a8f4791", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629891695, "uuid": "caea1156-b6b9-47d9-a4d5-62ae5357b30f", "comment": "Malware payload (Formbook)", "value": "706b6130898178ec07633c7deaae6536907bd9e22445a91f2ba4e8d869136efa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629891695, "uuid": "a11ed926-73cc-49f7-8fe3-ba6fa7f27f7a", "comment": "Malware payload (Formbook)", "value": "21c49e1dd4cab9e47f7562806d525b3e95cae8ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629891695, "uuid": "85c6a188-0717-4679-82cd-12864a596376", "comment": "Malware payload (Formbook)", "value": "2132611cc7cbdd558c8ba29cddfbdc0317e6e287122d8ea86d99b111dfef2ea959b1627b1a43b7f3599f4380d9d307a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629891695, "uuid": "a3eeca63-78dc-451f-8f31-96e0832cb39d", "value": "T1FD24128DEE6CE6DFE4873736ED02D65034ABCD31490341E39A64B062FEB912AD6245F4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629891695, "uuid": "99a08535-ad4a-4058-a524-49c77e5d54a6", "value": "35807dcde258f88fa3ce5c21adc607fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629891695, "uuid": "2c0f2cea-aa03-4816-9f97-8126915a5aef", "value": "6144:bMJX3Wd3+GGMaWDMIbEk0zz436c1Tq7UK9oB2kYsTAbW3KSF:bYyuGaYMIYk01koUK9AYssbaKSF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629891695, "uuid": "cea33e05-153c-4aed-b7a8-5ed43c751339", "value": 226087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629891695, "uuid": "121a60aa-3089-4fce-8206-fd3ca2e6d3e0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629891695, "uuid": "94b25aee-0b41-4433-a9df-458ffc8abe72", "value": "payment advice008.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e62b396-059c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629892916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892916, "uuid": "51e4dd30-8b3c-43b5-a7cd-0b80b4a21da6", "comment": "Malware payload (Formbook)", "value": "6cd0a4f10dabb456456d0b7336f13116", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892916, "uuid": "cae5d9d1-2e8e-4000-b6b1-938105f11b31", "comment": "Malware payload (Formbook)", "value": "71335267a0a48bbcf678e354b421445d3db926ec5dd9b40c2a004cebb9b166f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892916, "uuid": "3246ec2c-a547-4d7b-ba86-bfd8a19f30a3", "comment": "Malware payload (Formbook)", "value": "a227150d865fd8c5c1af938654055bc68c59de4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892916, "uuid": "3d3c6b52-e460-46ab-82cd-8848f4c09b15", "comment": "Malware payload (Formbook)", "value": "ca94ee031deacdb51c1d8b5e6cbf2da6a7f69061430abfde0f33fae219cea97c733c3d74c94baae76d5ddf806341460c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892916, "uuid": "df408cc3-0767-465c-83da-a4134353fe73", "value": "T13F84124548C5CCE2E71AB375D0B3CF9819667832CCD56B689354EA2EB870243B853E6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892916, "uuid": "a39cc784-4ed6-45e4-b9a7-27a680c85238", "value": "ef471c0edf1877cd5a881a6a8bf647b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892916, "uuid": "c5bd6220-d5ab-4b55-9e40-cbe4d3d2bbf6", "value": "6144:N4XrK9PX7Fp6Gh2wWRGl0EDDf1PisZQ5rAGQwg1QtP1f4paaYlsdcaMJEdbI0PzL:GXe9PPlowWX0t6mOQwg1Qd15CcYk0Web", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629892916, "uuid": "a5b83be8-302b-4f66-bb83-d4512acaecd4", "value": 376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629892916, "uuid": "887f6fa5-f898-4958-b5b6-ec0e817590e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892916, "uuid": "bcf6d4b5-f180-48b7-b86c-1356d56450de", "value": "6cd0a4f10dabb456456d0b7336f13116.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e816c6f8-0573-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629875591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629875591, "uuid": "e2d78f34-10bc-4a36-bebe-eeae74c3dd4c", "comment": "Malware payload (AgentTesla)", "value": "250e9cf369a5e9c416087054e50aad7d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629875591, "uuid": "6942ae47-fee2-4757-b9dd-1dd74b930bb9", "comment": "Malware payload (AgentTesla)", "value": "71ce3a856699a0a766d278e400af5bdd793de226ec137a3bbaa64cd82b5db701", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629875591, "uuid": "01980c57-8cd3-49d7-9692-0fff31df99f2", "comment": "Malware payload (AgentTesla)", "value": "472c19c90f6cde09d9bbd87086e797ce15c72f21", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629875591, "uuid": "1877d92b-5479-493d-876b-d3c17565391c", "comment": "Malware payload (AgentTesla)", "value": "b2b9138c72dec83843cbaaf6487c7e7172901d4e404ca09f78e7ebe77457f517d0855c3a853fe3ecafa9a982a27d09cf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629875591, "uuid": "54efaf2a-62f1-414d-b0ce-c3770efcc912", "value": "T174C4238389235464DA3C89E6779F02557A5003D4A8A60CB4982D6E07FB5B603FBD6FCF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629875591, "uuid": "bcac574a-d0a8-45ad-9796-929070182290", "value": "12288:s+LLF/J9Eh0pa5KAcaEOrzyEidtuCZiLO1xQ8PMzwlbiC12hGQww9Dp45DoUCyU:sCHG6U5bNrrNinpoLMIElxghGxwyFCyU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629875591, "uuid": "bc453228-e553-455f-89e8-4d42cd9b9d94", "value": 588029, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629875591, "uuid": "685bc793-9732-4911-a6f9-6afb2dfcf0ec", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629875591, "uuid": "98e46fa0-5c8e-4442-aca2-296522670f34", "value": "HASTELSAN PURCHASE ORDER NO.5-10400.DAT", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b628a28f-05a6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629897412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629897412, "uuid": "07bb2684-1d11-4781-9744-dad952b98089", "comment": "Malware payload (AgentTesla)", "value": "aa587ebbf050bd4a1631fd2a3346232a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629897412, "uuid": "c08b16db-deef-46ca-a9cd-c82da45bbf56", "comment": "Malware payload (AgentTesla)", "value": "7336a855a84f2f2d0f49c00a9ccdd993135369b15fa93fc429c31bdcdb002cf6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629897412, "uuid": "bc4b04a7-9fdb-44df-9f3d-bcbdc0bf08c3", "comment": "Malware payload (AgentTesla)", "value": "f898720c9f7ebf199d8400ff4f0a78cdd2f5fc43", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629897412, "uuid": "2a92c282-3c10-4284-a815-62b0d7c28908", "comment": "Malware payload (AgentTesla)", "value": "467bfacae7e04fa1f4a010b9402274d1bc6bd3766ca8558879b9a39b05d1c1f1f9cb5fa9497d8e81c3d9846e573fbd92", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629897412, "uuid": "01c3561a-e301-41f8-94a3-d45a525cb37f", "value": "T118E423B8524C8BBFD67C4C3C41965486D2FCD5AD7982D5883D882BE4C29B3E91350AEF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629897412, "uuid": "4d4d6e61-074e-4c1b-ac35-4b19a5c5ebed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629897412, "uuid": "ff45392f-e500-4741-aab5-93dfca887eb6", "value": "12288:UA+G/T5voQGYWYmjd+Z4dC++FHxaIXGClNLi/e1MGDauKzm0PnqgquWVO:tx7WFYpyd+ZYCvFRauldMZdPnS1VO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629897412, "uuid": "a1457c14-727e-4c8e-aad0-2fd5309a2689", "value": 711168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629897412, "uuid": "6b385fa2-b323-45ad-a359-8606ea464f70", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629897412, "uuid": "514c2e9d-a3de-400f-8b7c-2d2a82e14ce5", "value": "D0vP3sIEv20LMl4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10ef1ffb-05cf-11ec-8fa1-42010a9c0011", "comment": "Malware payload (FickerStealer)", "timestamp": 1629914744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629914744, "uuid": "5576bd74-84b1-4e93-8e9b-78869219659e", "comment": "Malware payload (FickerStealer)", "value": "4988a43a98b7d9c6aa7e71b8a8919fd6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629914744, "uuid": "fddf54d9-fec9-4631-9bbd-214e80724122", "comment": "Malware payload (FickerStealer)", "value": "73d34ceec57d41cab2e4b22046898b531fe0b59ab16c533c7eee3a52caf29848", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629914744, "uuid": "84fa3fdf-3d55-47d5-b216-dfa4420caf95", "comment": "Malware payload (FickerStealer)", "value": "5e0f468d9e9a9d14eef11caf54dafbe384303be4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629914744, "uuid": "516ea334-8521-4105-94d9-fa85eaf6fc25", "comment": "Malware payload (FickerStealer)", "value": "a5c089683ba7a0af3e90137feecfea3795ef19e75bc68ee4fb799bbd24bc9a349e6537c7b8c7fe1692d80a4dad2518f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629914744, "uuid": "7476e910-251c-4c83-85fa-37bca869a3d3", "value": "T15AB48E3065F45C25FE9622BC45AB835AA73E7E605B32D3C7427625B58B232D6FC70382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629914744, "uuid": "d85c4bf5-779a-494e-b5ad-2d6d8157956d", "value": "1d03ad9b9e9a9068c266e5f5e715b4b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629914744, "uuid": "f02afec1-d34f-42b4-9732-95fbe6887213", "value": "12288:eXSX3CPuJE0/PRm3HAURSEy0OiISPSpoKT1EW0rF3:pCPuSpRSoUpoMy3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629914744, "uuid": "7bab8cee-f160-41bf-88f5-9dc3e8c36a8e", "value": 523595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629914744, "uuid": "946e513d-1ef6-418a-ad02-57c297a9966e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629914744, "uuid": "be7df9a6-5a43-4c2a-a682-c40132d1a926", "value": "mixshop_20210825-181122(1)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c983fa1-0564-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629868968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629868968, "uuid": "1350f875-cb51-4081-a5a4-c2e792d89c35", "comment": "Malware payload (Dridex)", "value": "607ed63abda24d4af47aafa487b085d9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629868968, "uuid": "2a8e778f-aab3-4d3c-843e-5219f760f4ac", "comment": "Malware payload (Dridex)", "value": "75ff9ff14b88646c851bb3e7b1aaf362d5dd458b4eae2b4f8c31cf317e09d755", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629868968, "uuid": "ee26b9bd-8ac6-4e4d-8a90-39dc4de08fee", "comment": "Malware payload (Dridex)", "value": "af00a4b4ad83b8473abda03c815531fca19aac38", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629868968, "uuid": "e6f96ce4-ef34-4bb6-b15f-380516d4b7d3", "comment": "Malware payload (Dridex)", "value": "1953f2acdc1b20c3a4874a2b5f41cfde3fac7fa697c2fc88348892399e3c41bb8a47fe1f05f2f2ca7caf8e5a80892a9a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629868968, "uuid": "775dd427-dc39-4c29-b3b2-4a807c0fcff1", "value": "T18574125892B1D81CCD4E403F91D74F72DB72590A9685BB1E85B1A20DAB03D3F8BAB0DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629868968, "uuid": "2e756f2e-8f16-42f2-9484-9df020cc3f0c", "value": "6144:obgdLIp2LohOGYw6CC5jTT453mjEIbWiGVAKSLFN+YInSCRvuPsxNP:U0sYL2OGY/TTy2jEIJc6FNu3uPmNP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629868968, "uuid": "0db12688-f7ed-4480-a1ff-2482194c7fe2", "value": 358963, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629868968, "uuid": "8432c278-9404-46f7-a36d-831a32d1dfe1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629868968, "uuid": "5046a5d9-b86a-4366-bf36-9cb4932476b6", "value": "EoY_TAX_Export-64951491_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2759d7a2-0570-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629873979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629873979, "uuid": "5cd650d0-b5df-4a48-b71b-6b3d82185d9f", "comment": "Malware payload (RaccoonStealer)", "value": "8a8470632db10c3b2e4d35b47506a68d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629873979, "uuid": "c0d2f902-d1f6-4b25-85b7-ae9772053a7f", "comment": "Malware payload (RaccoonStealer)", "value": "76be54f6563829ebf3b3d066a06674a8c52558ab9492f30c5ae284187aeec557", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629873979, "uuid": "79a92bf4-1a7e-4ee6-a538-a23d0a92e1c0", "comment": "Malware payload (RaccoonStealer)", "value": "5875dcad453931507e46d13a5c14eb052cf4d6f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629873979, "uuid": "09e1f5f6-1cf4-45bc-9a43-0ec7e46eac4b", "comment": "Malware payload (RaccoonStealer)", "value": "9da2404d77fc8646da7b60c3b97eb6b2dce75a6e00d17a2f903eb4bf6773506f85c1f9b4d29e1c8053058e2d41d1b459", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629873979, "uuid": "a8bdb6dd-5ca1-421e-b747-4b534aea9974", "value": "T18CA412203660C433C55755728CD5C7A0EE2979632E319243BBDACF6F2E392D1761A3AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629873979, "uuid": "6010ba12-e1c0-4445-a897-4d6a8fabf003", "value": "3bdc58d7d3add14fdfc74404aa032a2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629873979, "uuid": "21d2d569-bf49-4c82-9749-6cb49d2a0bcc", "value": "12288:F0YnpIUpNZXthUOiTtIVPyNf0wh46YrcbkCB6Ei04LEcF:F0Ep13chmq0wmSbkwH4X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629873979, "uuid": "98fb521e-65cc-4da1-a3fc-6472f88c9a9a", "value": 492544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629873979, "uuid": "59a6ca30-d9df-4b14-8705-4475d575abb8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629873979, "uuid": "2bc4e5d4-802c-44fa-85e9-574f13b78282", "value": "76be54f6563829ebf3b3d066a06674a8c52558ab9492f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82087fd1-058d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629886587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629886587, "uuid": "c4b59680-0bf7-4757-bb93-8d05016e673e", "comment": "Malware payload (RaccoonStealer)", "value": "85b28ef10bf5f86cf3f0f683cceab612", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629886587, "uuid": "cf3d466b-15d4-4670-b95a-5778b2410017", "comment": "Malware payload (RaccoonStealer)", "value": "76ed171c081e42c667427bc700d818ba7d6e3f29ef79b4bac08fd7609e9f4d4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629886587, "uuid": "dac8f81b-9469-4060-ae42-786aeece58e0", "comment": "Malware payload (RaccoonStealer)", "value": "ef5b91121511ac6b0ec7e6abc3372f07cae53817", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629886587, "uuid": "3ab7fd78-a4d3-4079-ab89-adf50e922478", "comment": "Malware payload (RaccoonStealer)", "value": "588f020cf4b2a298cae0491262872abc8ce09fb4dd4d1d246daa46bc3f9902516496283cbf604e813e284f5f41031f54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629886587, "uuid": "8d7b66a0-68eb-42bb-b43a-c3d4a21d1664", "value": "T187B4D030A691C035E4F316F855B683BCB53E7AB15B3440CB93E526EA52346E8EC3176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629886587, "uuid": "092eafec-1553-4ae7-9fab-929bcb8fc020", "value": "35372ade599ee63db174ac99307517b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629886587, "uuid": "4713b5ed-6b02-48f4-8665-2472c23fc457", "value": "12288:Nkc5RDlzI0xOw+/HPgaWUteSB6uKtYD+KuZ:LRDla/4usJuKtQDu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629886587, "uuid": "f4d2fd81-43a5-4fc5-92bc-7d142684a31c", "value": 532992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629886587, "uuid": "c59aabf8-19e3-4921-b527-7cf6c9a0d7ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629886587, "uuid": "0075c8df-ce90-44f2-8a48-a0d9e0b18c00", "value": "85b28ef10bf5f86cf3f0f683cceab612.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9c5ff85-0537-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629849717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629849717, "uuid": "d9e55546-3da5-4716-87a0-d20a8aa22bf8", "comment": "Malware payload (Mirai)", "value": "2982ddec162ffddd488673daa2c54a85", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629849717, "uuid": "9ef6873b-d29e-415a-b168-7c34cb5f83ea", "comment": "Malware payload (Mirai)", "value": "7730977c8a73990024a195a9c03b47fc2b42e3109f29e73327f2390c1147c160", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629849717, "uuid": "7086ec6a-756d-4fb3-8f91-d23c81a117a2", "comment": "Malware payload (Mirai)", "value": "bbe7afe5f77e42aed75ba7be8c10243689261472", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629849717, "uuid": "e6ba67d0-f35e-47f0-802d-91dea228fdda", "comment": "Malware payload (Mirai)", "value": "e6eac31e0ed77feab2a219000f9679483bbaa044167647f9be01168fcd14d99c0fae06f8100377d653cc3208e216cac2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629849717, "uuid": "b086450f-cb81-45c9-9f2e-d2c6e824b2ad", "value": "T1E243F746B9D19F01C5C452BAFE1E118E3313576CE3EFB213AD206F246B8A96B0E3B455", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629849717, "uuid": "aab7e17f-6fe0-4cf9-843e-f74f5d0ba784", "value": "1536:KxntC0lwE5XFyazf55R81O1ZmZIhcPIbiTqg/sCNLLts:4lNxFyaz5v8o1gvqg/sCN+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629849717, "uuid": "eff661fb-4372-4ab6-90eb-6bc282d55c5a", "value": 58668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629849717, "uuid": "1b624bd7-5bf7-4822-bbb3-20e45e900794", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629849717, "uuid": "d7120ddb-aa83-43c7-b071-892c5c0ca80a", "value": "2982ddec162ffddd488673daa2c54a85", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee83e72a-0564-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869159, "uuid": "73870a96-6906-4ef2-ae2c-5d9ba0244ae3", "comment": "Malware payload (Dridex)", "value": "d88e7a53eea816822a4a46a639748911", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869159, "uuid": "8c7b4bda-3fa9-418c-b0ce-11b2d4bf1284", "comment": "Malware payload (Dridex)", "value": "780d8ba81a8ddb54173a78f591241252c58583202ccd9dfeee860fd22915ebb5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869159, "uuid": "02caf59b-9d24-4d3c-8974-243de0d69287", "comment": "Malware payload (Dridex)", "value": "201c2ada0bcfc7f16cddc84668286f7844df80c2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869159, "uuid": "e588ffb3-6926-4006-ada0-11558833747d", "comment": "Malware payload (Dridex)", "value": "d837527155012c009744a8096facbdb391bb5fa43460dbd91ed6a8c0f68e780e241cce3a2bcd4e40ad9b148087ce38be", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869159, "uuid": "fbf3c7a9-c2dd-4b16-a63c-3dcd54ad7fef", "value": "T10F64122DC5F3E53BCB960CFF8C7914D263A78637C29549C6889172EC1E260764298BD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869159, "uuid": "e26bd40a-0691-4187-ba23-8211200f66e0", "value": "6144:o9TwhpP0hKyXO/J6t/VYfASkKTzZYwPMPFde/Qxx2u+OA+NT5AA:dpfyX7ifASkKTzSwkPFduQx0uD+A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869159, "uuid": "48417cc4-31f0-46df-81d1-5eb73741cfb7", "value": 329599, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869159, "uuid": "a52db3fe-b9d5-4b3b-baf9-3ecae49b42c0", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869159, "uuid": "2aa5dd38-9292-4b7d-a4f8-53124c785b6a", "value": "Details-57892868_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "878db63e-054c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629858679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629858679, "uuid": "01d136e1-2bed-429b-949a-c9585935c8e9", "comment": "Malware payload (RaccoonStealer)", "value": "cb286c9b98bbf94aee0c25d4ce619bc4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629858679, "uuid": "9bf3617a-0ac7-45dc-a68b-edcd6438354d", "comment": "Malware payload (RaccoonStealer)", "value": "7838e3b48693351eaa30bf7caf00c3b2bbe9c9595151d137cfc7c2f306af1ee2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629858679, "uuid": "e4072700-3c16-4dfc-ae0a-e4bed5fa5d84", "comment": "Malware payload (RaccoonStealer)", "value": "86fc88249d57e178df2272c857a5e090844c5161", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629858679, "uuid": "1ba9968a-c11e-4396-8fce-b8d06c361403", "comment": "Malware payload (RaccoonStealer)", "value": "bb592d9e45b225c8ef7da93dcd61ccffc0353d5d7a49a0eb7a6fbdddb7c2d5f62685a8fad5a390827d396424cfe18dc7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629858679, "uuid": "086132ed-a915-4c54-9a0d-c5e4d375bc4f", "value": "T1AFB4016437B8D1AACDBD12B008070792B3309C5B7504EE7A97B735AC5EBA7CD480E19B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629858679, "uuid": "96012c37-9349-4219-9117-f438c29c51f4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629858679, "uuid": "a1908f9c-4faf-4295-a58a-0645534a1579", "value": "12288:oshS3eRm4lUx5xhNGp6h+zuJzpgE1ikqIJp1w:osM3um4oLNOz6v1iA1w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629858679, "uuid": "96b4e80a-4ae8-4c3d-bc58-c1212f4adbc4", "value": 540672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629858679, "uuid": "7ccad65d-7f7a-436c-b9a1-3b6bfd892126", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629858679, "uuid": "c2b415cd-bbf7-486b-83e1-23ef79016944", "value": "CB286C9B98BBF94AEE0C25D4CE619BC4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98fcff02-0576-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629876747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629876747, "uuid": "c0e1a4f2-b050-4b54-b6de-960bd6b75086", "comment": "Malware payload (Loki)", "value": "648dbb20f19d83ce2a8399ed4d734e12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629876747, "uuid": "8abd071c-8aef-4979-90c4-54cf7aefae2f", "comment": "Malware payload (Loki)", "value": "793957d8deb9a28270f9e1d2ebce7285f2dd0398d27e86f5177eadd4e45b980e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629876747, "uuid": "51e02f90-dde2-416b-9ef8-ac16096e6ac3", "comment": "Malware payload (Loki)", "value": "6228f2179cf795ecf90ac06b6229376d0aceea5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629876747, "uuid": "1173df0d-5491-480b-8eb9-a9b080415ff1", "comment": "Malware payload (Loki)", "value": "fa78c0a2248b56d6b5d940d29ac5b394e3b0fdaf3a4b746a770867972aa19eb121827ae606630131517d9ef07388eed5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629876747, "uuid": "00a459d7-bc54-4b13-81c8-29da4eee1abb", "value": "T1063402058C6957CFE05DDF7D4FC0F35AA6848D32528E45AD0A82FA868FF8CA064F9497", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629876747, "uuid": "2a1e9fb3-643b-4911-972b-8775d3adeebf", "value": "35807dcde258f88fa3ce5c21adc607fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629876747, "uuid": "62d9a222-d904-4a75-ae27-2e2f75ff473b", "value": "6144:jAOSdMWMZIdCQy7QRotUJbNLgOgGN1dMy7pRVT5rGdq:jxiCUotaLdgwbVT5idq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629876747, "uuid": "2be10ecb-e0ca-4ccc-90a0-4d93ed63dfc2", "value": 230715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629876747, "uuid": "a2afde47-28ed-456b-bfb2-f4b350d6e22f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629876747, "uuid": "0bfe458a-a3e1-4bb1-84f2-ff724eab794e", "value": "648dbb20f19d83ce2a8399ed4d734e12.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6e58216-055e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Hancitor)", "timestamp": 1629866516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629866516, "uuid": "e5593f67-1a30-405b-8f8b-7cf9a6411489", "comment": "Malware payload (Hancitor)", "value": "7b5b74ed8ca5f213d111ec2fced1f446", "object_relation": "md5", "Tag": [ { "name": "Chanitor", "colour": "#3242A0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "DocuSign", "colour": "#6C3C77", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629866516, "uuid": "d1b803f9-5236-4cc0-a6cc-cc23fb4eef95", "comment": "Malware payload (Hancitor)", "value": "797fb35ec5ef998f910b1b488a3a394f0d2921e26f1625cd46bfc294800484a4", "object_relation": "sha256", "Tag": [ { "name": "Chanitor", "colour": "#3242A0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "DocuSign", "colour": "#6C3C77", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629866516, "uuid": "6ebcc484-8906-46f1-bbbd-5fca6de4d004", "comment": "Malware payload (Hancitor)", "value": "ba9a35d82106d6c0ce5c50b4861e20c20cacac42", "object_relation": "sha1", "Tag": [ { "name": "Chanitor", "colour": "#3242A0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "DocuSign", "colour": "#6C3C77", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629866516, "uuid": "7c5b105c-c846-4487-961d-9d76bdb61aad", "comment": "Malware payload (Hancitor)", "value": "795e338411615c552a6ced12ded3f0e17558041f3ec4b20903519323fe897d0a97efe9dae9f87b1c69a6976a90a59d73", "object_relation": "sha3-384", "Tag": [ { "name": "Chanitor", "colour": "#3242A0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "DocuSign", "colour": "#6C3C77", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629866516, "uuid": "cdcb4ef5-22a3-4c95-a65e-063a82a7a298", "value": "T111D40107B986DE03E04ACB397EA6CDA9376DAD055E08F3C771607B1E6BB13219D0354A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629866516, "uuid": "6d4e7fb5-d1a8-4ed6-8397-efe669571fbf", "value": "12288:7V9iQsDr8NJEUYfwg8I3HMzNK3Rb+jC4xU4Wht:7VXkr8NWUYhR3HMBK3RMet", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629866516, "uuid": "dbb99a1c-44db-4b70-87f9-79fe210d39c7", "value": 638464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629866516, "uuid": "525d6ec9-9c3b-48e2-8cd8-8a42db5ae98a", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629866516, "uuid": "ced3467d-9dd2-45be-ad19-505034416971", "value": "0824_0646880414.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa5ae2b9-0572-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629875192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629875192, "uuid": "d810311a-7e59-499c-809c-7b95fd555a1f", "comment": "Malware payload (RaccoonStealer)", "value": "0a0b219b88d82cc04578ecfbc034a01c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629875192, "uuid": "832e8c0c-b5b4-4f01-81e2-56fc8c84bce7", "comment": "Malware payload (RaccoonStealer)", "value": "7a4470171b9a696d8a4e4a42423766708d87763b84ed46571a25b43723da6a52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629875192, "uuid": "2c80518e-9c16-4840-aac9-5ef3e0880f75", "comment": "Malware payload (RaccoonStealer)", "value": "69c636688f3242066e25482daf5df9aaec7f20de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629875192, "uuid": "55e9ca31-3e00-49f4-86da-d4fcdea9c71d", "comment": "Malware payload (RaccoonStealer)", "value": "ee367e7c848808b0f389b517e90e63aa29b9de80799a898b5ee76de5a233b32f7fa32ee103deb25f760da77145d0f0d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629875192, "uuid": "d9748a0d-3766-43c7-a1ad-f89997d790a1", "value": "T15EB4E0306691C435E8F311F855BA83BDB9397AB16B3440CF53E62AF946386E4EC30796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629875192, "uuid": "5cbdd8ea-a79c-41d5-8c28-d4377235f0c6", "value": "b1f244737f482f7370a4248faac2bcb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629875192, "uuid": "9c275d8f-f9c1-4036-87a5-8305bdedf818", "value": "12288:btfGA5VjMkuE4s3S2ftBDsLpvAt8Ws9MFNHXxvLcq:/VjM52/DapvAt8RMFRhv/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629875192, "uuid": "4bb8f244-89ca-468b-a441-58d1f92100bf", "value": 539648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629875192, "uuid": "6193add8-ea82-4051-ba85-9b6693e92992", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629875192, "uuid": "b0f6e587-adb3-4752-9a18-44d8084a9b86", "value": "0a0b219b88d82cc04578ecfbc034a01c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a575b2ae-05cf-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629914993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629914993, "uuid": "c0e725a1-f62c-4e9f-850d-678e1ad29a75", "comment": "Malware payload (Dridex)", "value": "6f29b8ca882ab27f5d0bcbe4ae23c940", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629914993, "uuid": "6ff058d8-9d83-4e26-87e6-fc93a56b6052", "comment": "Malware payload (Dridex)", "value": "7a8e8082b76e9e339be9ce49a93e312f1795b1cee4b7b0ac457089c90e6fd679", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629914993, "uuid": "2cc99a87-54ff-4c54-80a4-69808303fa71", "comment": "Malware payload (Dridex)", "value": "9116f99587213efa7d5add640a9d95324cfa77b7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629914993, "uuid": "dac93ae3-d27f-4bea-a748-d541843c1ac6", "comment": "Malware payload (Dridex)", "value": "8aa50701c59701f2a008174a2d287b6c97361bb1583a19c4c6b773170609b108912b5dcbf7ebca5b1e3fa04f5c8b219a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629914993, "uuid": "9c42c468-3c1f-4125-9e33-758e0dcca88b", "value": "T1AF14D082CD9F46F9C21B167139F531BE21E80605A769CC2BCADAD2FBF47D300D46261A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629914993, "uuid": "68201ba9-cfb6-4e19-9870-f0d0b6492638", "value": "15d931f2533164c416970d03fa5b5c88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629914993, "uuid": "5806f2b2-ce35-458f-a3e7-6e24ec6f18f8", "value": "3072:NH0uyjZqEpAK+Gf78TBdrXkTM5vhRg9Esf0DwvtyMpVnpA+z6tX8sxKViWL7dU:NUua/Pv7YNhRIEZDeXVpAxtMsxK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629914993, "uuid": "cd8e5b0e-8d9e-441c-bcd7-d64081ca67f2", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629914993, "uuid": "fc97e27c-1f2d-42ac-94a9-939fe4e5fded", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629914993, "uuid": "59fa3206-27c0-4835-b2c4-1d874cb026a1", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "214b01e6-0565-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869245, "uuid": "5a0341f7-582c-40fc-96a1-6d4d471cd1fb", "comment": "Malware payload (Dridex)", "value": "dc0fd795acd135a66520283eecf4ad32", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869245, "uuid": "0e3931a1-14da-4e36-a178-0b4353660b6c", "comment": "Malware payload (Dridex)", "value": "7afea17a13f2dd18c6762a60738e47a4cf999965b444ae9a841b444e14ae72b4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869245, "uuid": "5bb0f351-7fbf-4174-aa07-08c063852bc1", "comment": "Malware payload (Dridex)", "value": "7137dd36df75924cc1668e12e805429163673418", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869245, "uuid": "03b6a7d4-8128-42e0-80c3-b8a5fb6e9d97", "comment": "Malware payload (Dridex)", "value": "b601713937ee98bb1b07a3a389b7a1ebaff11c3b4b906b93fa8d1987b0d7c58e650bbb95f2cef852b12bedecb9bf705f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869245, "uuid": "4296f8c7-b8a1-480a-8830-440624ec237d", "value": "T1C274126882B0C85CC54E413F65DB0FB1DBA3290796C2AF1FD5F077086A13D7D8A6B0A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869245, "uuid": "651ae175-505c-4376-a9e9-2ec5daba8ef4", "value": "6144:oGZYspxJaaIyOC/42LohOGYw6CC5jTT453mjEIbWiGVAKSLFN+YInSCRvuPsxNE:hZRpxJaVML2OGY/TTy2jEIJc6FNu3uPt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869245, "uuid": "bc16bfe5-a062-493c-b615-0e0c70942836", "value": 366738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869245, "uuid": "18222384-a64f-47ad-94a9-bdbbdac3795b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869245, "uuid": "95c20ff1-057b-488b-84c0-7ecf1d1d05a0", "value": "EoY_TAX_Export-500595161_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "088f18a1-0565-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869203, "uuid": "9a3aaceb-a4e9-49f4-8081-a1b256f594a4", "comment": "Malware payload (Dridex)", "value": "8bc9640aa0ffc83696e2ca65a119fcae", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869203, "uuid": "c5c6619d-785a-4152-b3d7-7fe96960cce5", "comment": "Malware payload (Dridex)", "value": "7c28a53014ef117f97f8cf374d31dd68196ab32a664e0c50f6e2fc59e1eda678", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869203, "uuid": "79ff2914-49af-47cf-9528-c160fe8e4668", "comment": "Malware payload (Dridex)", "value": "b867c13199e407a427e4d58e6ea20b2d56e754ae", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869203, "uuid": "2ee9ea33-f355-4075-a095-e5855a5ecc24", "comment": "Malware payload (Dridex)", "value": "5b7c1b7f34af2b7bdc08eb2072ad0f04641586ef0c5e464f5197ddfefa2042de9ea797e2aa6b31c49401efd05e0343f6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869203, "uuid": "cf9245b4-a3a9-42dc-9422-8d42ff823f0c", "value": "T198D3E0E67537CA8CC02D873C5AFF4FB66BB49B85416503071268F91C6F236E79B58608", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869203, "uuid": "35189e5e-00bc-4d62-9ad6-b261a7efb13d", "value": "3072:oUa2jtfP8+Rk6vsN0p28i63LD6z2qoaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaX:o/2j9U+26kv67MoaaaaaaaaaaaaaaaaE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869203, "uuid": "8d36075d-f70a-4ca1-98c4-c95cc853ca9e", "value": 139539, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869203, "uuid": "c411d36b-e559-407a-b5cb-2045b4c5365a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869203, "uuid": "1d1b953f-85a5-41d7-b054-cb9aea3221dd", "value": "Invoice-60932_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2437720-0564-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869139, "uuid": "65f5520b-3353-43ee-9343-47eacc6fb881", "comment": "Malware payload (Dridex)", "value": "ae44481e40a79ab9e42345967853a91f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869139, "uuid": "fde3dd21-5256-4354-bb10-933aaab91b96", "comment": "Malware payload (Dridex)", "value": "7c3736d3a14fe8777d1fee62ddfdd65ace4b726c4bd0f93e885d6d8b623f1110", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869139, "uuid": "cdd6b0b0-ca78-43c8-be6f-029860c6a57b", "comment": "Malware payload (Dridex)", "value": "75ba1eae505a453424464f8483d40b4f4935f61c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869139, "uuid": "af54a536-2cfb-471c-b049-8abbe7e3ba16", "comment": "Malware payload (Dridex)", "value": "fb18f5951173d6dcee877095b7a77839e27f6a7cecd5c4337f74523f24acbd6507fd522d7ec9fd97c2070baf2f5fb72b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869139, "uuid": "0d083249-6097-4b44-b3d1-83fc8614a643", "value": "T1BA84127C96B5C80CC95E813F52E70F71DBA06A15B2D1672FC2B1E2196F0793D8A6B09C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869139, "uuid": "48262052-230a-48f3-9b3f-bd0b0a791a37", "value": "6144:oF6nB9I6fidRM2LohOGYw6CC5jTT453mjEIbWiGVAKSLFN+YInSCRvuPsxNP:06nB9TfUzL2OGY/TTy2jEIJc6FNu3uPq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869139, "uuid": "4499dac7-bb2f-473a-b4eb-a6cb6e9d0cac", "value": 380555, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869139, "uuid": "df9bc609-8fa6-48c6-a095-c248a9d010c3", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869139, "uuid": "dde5bd92-e359-44b0-8d32-e9781d47ce7a", "value": "EoY_TAX_Document-3364_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "301c0546-056d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629872705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872705, "uuid": "d6f278b5-25d7-462e-a6c7-3a7a3d3d8b9b", "comment": "Malware payload (Mirai)", "value": "73c18924e6f4ea204168cc4a61701cd4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872705, "uuid": "62bcd5fd-6b59-44b6-81b3-b184e9b33947", "comment": "Malware payload (Mirai)", "value": "7d22d51ab5304a7aa6ad95e6a3450d0eceab242ae1ef034c8c2e914bd82ef333", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872705, "uuid": "3eab9d30-af22-454e-a476-3d2dc1b66b98", "comment": "Malware payload (Mirai)", "value": "f87f32c974ddfb2348f6024b7ed9182117b7e3b9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872705, "uuid": "bf187df3-be9b-4f92-b1b0-37c599b8dbd6", "comment": "Malware payload (Mirai)", "value": "df8aea3d3d50c7185e44ee6499ef2e6a0608d98bdf984ed814f8f0a9fde82c2271b5d1d2ccd8b90076cb208415be6390", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629872705, "uuid": "19856df6-3e9d-4f7c-921b-55b14f1a892b", "value": "T18F33F1B1A526BB6180B04074DC36CF47E75B0B3CDBE5748262D5E7083E85994A778CEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629872705, "uuid": "c569b247-3699-41d7-b798-b25cc07fc5af", "value": "1536:sFqgDpsULWXukWXPecVI1TUF61V+K3YaeDjULh:rgSULqukWfjSUF6f+K4DjULh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629872705, "uuid": "63cfad6c-7acf-4cbd-b432-71b6b98fff6b", "value": 51160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629872705, "uuid": "864890c1-e39a-4d46-b40e-2a1f8f399c0a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629872705, "uuid": "8b08954d-aec4-48a0-a8a7-67d274d9716e", "value": "73c18924e6f4ea204168cc4a61701cd4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df8fadbe-0564-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869134, "uuid": "1a2b5c21-bf57-4921-85f3-8ff44e442c67", "comment": "Malware payload (Dridex)", "value": "004d31674eab4fda1f8d70c825816054", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869134, "uuid": "8e676111-34ee-4d84-b04c-b1ef939d24cf", "comment": "Malware payload (Dridex)", "value": "7d5df9e67334ad0661d6471f1183adc083b9809c242641f1227634f583a1d95a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869134, "uuid": "5228dbd3-83f0-41b2-b693-fe499d2d0ea7", "comment": "Malware payload (Dridex)", "value": "72d950592e13cbf2ad6ce3294b5d858da3a56533", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869134, "uuid": "fe2dfa28-d23b-4147-8b62-fccc9f5fc32f", "comment": "Malware payload (Dridex)", "value": "ba198b47f952c3602354ab0a5ef5007227abd112d1e4fcd353a2762b1bf49aed201c99ec4514683a5939ba81c09f4ea3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869134, "uuid": "1e7b0b0a-bb0d-4ea4-bcfe-b44d69334cb7", "value": "T1B0C3D0A67932C988C139567C51EF1EF67BF89B4226E25B0621BCF51C6F23693CB40129", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869134, "uuid": "16acbb17-7851-44c5-a98c-7c7ebfc0c79c", "value": "3072:oU3OSNQ+fPjWzqjqlzCEiwI6i63LD6z2qoaaaaaaaaaaaaaaaaaaaaaaaaaaaaaW:o23Cz7lzCEiJ67Moaaaaaaaaaaaaaaak", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869134, "uuid": "7eef0d59-e92c-4436-b4da-a041e608575d", "value": 123420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869134, "uuid": "8a964d03-efe6-41cf-9c09-ec5924d1bfc6", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869134, "uuid": "760d882d-2b22-4aa3-bd22-82025420df0b", "value": "Invoice-1037_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4fa8d92-0564-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869116, "uuid": "de203ffd-27c3-4f76-80a0-97c6af837e69", "comment": "Malware payload (Dridex)", "value": "e990ec2f2292a20fa7431377236bd3e2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869116, "uuid": "713f6de1-8d66-4957-babc-427f40762cf1", "comment": "Malware payload (Dridex)", "value": "7dcc207eae96034d432e889458531b38fe3c4220850945014ef0d65a7cb2a3d9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869116, "uuid": "163a8441-28d4-4131-8a8d-5f57b60ff2c0", "comment": "Malware payload (Dridex)", "value": "10f9c06cc4a3e65c93845bf3492b956b5766283c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869116, "uuid": "cb3e9ba1-f921-4fbe-b9e9-17925575a7ad", "comment": "Malware payload (Dridex)", "value": "c29b5dd8f708c82f1a7755091b0752498f09e61c59d26da0813af965f584be678d334066aaf12a241f152ab48048d8a7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869116, "uuid": "0b567062-2d37-45fd-9a7d-65fe7819e22e", "value": "T159B3D0997233DA9CC12D923C61CF5FB7ABB48F8411A29B15526DF52CBF228E79B4010D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869116, "uuid": "6047aea5-f82e-44f5-978d-6a40a54dc960", "value": "3072:oU9HK8bWD09OLZk4i63LD6z2qoaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa3RY3o:oxqOyOLZkR67MoaaaaaaaaaaaaaaaaaJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869116, "uuid": "3eaeb1be-ab5e-44c3-8790-6c9b6d01971a", "value": 116317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869116, "uuid": "46e1667f-0933-435a-a41b-831ec5accb42", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869116, "uuid": "60d8cde8-c926-4b18-9bac-be2388499dc1", "value": "Details-72836_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81e84c34-05d6-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629917940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629917940, "uuid": "d8f249d1-3f4f-402e-9772-206589b7c818", "comment": "Malware payload", "value": "fd212aeaf2a519e24276516eeb1dedef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629917940, "uuid": "3aa3542d-19e2-4a68-8d1b-935d2b8c2c30", "comment": "Malware payload", "value": "7e5dd61d1a28a21f3eeaf8ff3723b69019f83be520b6ad986a57b5de05dab438", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629917940, "uuid": "1893d69d-0be2-43b8-aa8b-eecf4a9665ee", "comment": "Malware payload", "value": "55bb12aaac948f80f17d0f2b45db7992b92683ce", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629917940, "uuid": "e2fc3af9-de3f-449e-ac73-713171142275", "comment": "Malware payload", "value": "ba3617f33f707dd1ce7e792a4c35f9878256025c27ca602038e0d0ce03f3d43d7183da7e7241ae14586da50b1d2be00f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629917940, "uuid": "a808aaa8-be31-4945-b07b-8c1c3bdd9cb3", "value": "T1EEA4E10E558BC967C3198FF29273F57207BEE9C9FCDB11B53606E88ED4AE56D8240A10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629917940, "uuid": "ae912b1e-6844-4dfd-94f4-b94f2c6c3689", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629917940, "uuid": "448ce7d8-aa48-4548-8f74-3e9c196f267f", "value": "12288:gZycYZmPGAD5HHT6O1FaxE6z1Jy7tMfHEce:gMcYZmeOz6MWE6z1JGtdce", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629917940, "uuid": "ac8bcc47-b9b4-4eb8-b623-f0577691dbce", "value": 491520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629917940, "uuid": "2a58977b-cb27-4af7-9057-938501b72d6d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629917940, "uuid": "fbfd2ac2-7688-4274-87d2-adf8b522965a", "value": "fd212aeaf2a519e24276516eeb1dedef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bc38cab-05ce-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1629914467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629914467, "uuid": "af73b276-aaa7-4167-9f76-4172c67431de", "comment": "Malware payload (RemcosRAT)", "value": "75f7dc6f6b46ef8f379000e8b6905529", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629914467, "uuid": "73cb09eb-db4d-4bbf-b555-1f3f5a484a96", "comment": "Malware payload (RemcosRAT)", "value": "7eb677c1c5c60d34da90cab2b4ea019c500b5c3db6964cc14849dbe2f9f5fa30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629914467, "uuid": "83459859-5952-4518-88e7-112067c096fc", "comment": "Malware payload (RemcosRAT)", "value": "f3a9abcfa08f16d34f09800a5df4ba5f794fcbd9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629914467, "uuid": "97780db9-3219-43e0-ab70-bd49165444c8", "comment": "Malware payload (RemcosRAT)", "value": "26e955eef2dd8ea762ecd6689abbc3013131c087acec5b63236ef844043efb4a7f308e0d0acafbf31b8d74741f43105d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629914467, "uuid": "68d9f940-fc4f-474f-9f27-d898c5a04ef2", "value": "T1C5F47C23B7E25E39C5B3253D6C07B771CC3E7D1569326E8657A02E486E3478038662BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629914467, "uuid": "b35ac8fc-2718-48cb-8f35-630a6622527a", "value": "5a802a354982a97544e495df27ee8291", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629914467, "uuid": "ad6fd7f9-fafa-4929-872b-188480270f25", "value": "12288:vFtHRwMpWIIyKj9X1WxQ3jC0CJVYT+R0ws8Y7X2ujF5JjFWVJq2O:vFtxwR9uwvQYYdsW+TJ581O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629914467, "uuid": "89ebf1f8-9aea-49f3-8b4d-732f5c8e7b3a", "value": 760320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629914467, "uuid": "dbac451d-619b-466f-965a-c718be8cd369", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629914467, "uuid": "3c61de1d-fe06-4609-88d4-5b31ee9ff64d", "value": "Nuevo pedido _WJO-001,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67eaa025-05e4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629923909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629923909, "uuid": "dd73558c-0367-445e-9a03-f709eb103e45", "comment": "Malware payload (RedLineStealer)", "value": "18877b6e78fca8d5307bce698cb94406", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629923909, "uuid": "9cab7580-7501-4fe7-b1f8-e0d6b5185e3c", "comment": "Malware payload (RedLineStealer)", "value": "7f3a3f91f7fd02497d558020eb3e15a8e3f9d3f3e78fb0e6d188303cebe4ee40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629923909, "uuid": "76ba03ad-6602-406d-99eb-3d28ec2a21be", "comment": "Malware payload (RedLineStealer)", "value": "f4df974b2fbacf6d406666a24367e356a44af89d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629923909, "uuid": "7c09ec1c-385b-402f-b15a-5d2ec21b2262", "comment": "Malware payload (RedLineStealer)", "value": "acadf80e6e152bc20819d728648c19e4c97094d60ef0c5b3509a726247fb8f342ffdbb55b1d33a12d310b316f00e7c0e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629923909, "uuid": "c7ba4c97-2264-4efa-a6a7-c723f2367419", "value": "T1CBF533DE4F198512C2A37FF2663D5A8E5FF4EB813C1292A8CC1255072DC8F23619E5D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629923909, "uuid": "416537f6-b785-43d6-81aa-43c6a66eb946", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629923909, "uuid": "fb2ce2dc-398a-417a-93be-fafadbd785c2", "value": "98304:m9q4jYP/cm8XyV0mGZagSbQMuEYdOjpiaF9:uhcP/cLyga/BjHjp3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629923909, "uuid": "e9a73827-d8a0-4a12-bda3-3d83267ca614", "value": 3380280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629923909, "uuid": "6a937909-2628-4781-b1cd-567a8f6a1b8e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629923909, "uuid": "0ef2c686-4806-4fdf-946e-86f8439a4a8d", "value": "Renetry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d842580c-0570-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629874276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629874276, "uuid": "56d8736b-3b45-46d8-a4c0-e160dc81a91d", "comment": "Malware payload (RaccoonStealer)", "value": "713e10f117335ca484a0848c33205786", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629874276, "uuid": "dcc3ccf6-8357-4a11-a84c-ebfcbf799514", "comment": "Malware payload (RaccoonStealer)", "value": "7fae4ffb43200001f2f16a6a2b23a507370fb692c8fa659d3c335fb7a4002277", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629874276, "uuid": "635b0aea-abc9-48b2-a9a1-66564168ff5a", "comment": "Malware payload (RaccoonStealer)", "value": "72dfbc2ed501458782479f71ee654153fd3f1c59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629874276, "uuid": "47d09d29-9746-4ccb-8bb2-a876cc319609", "comment": "Malware payload (RaccoonStealer)", "value": "4487c9820af766958099b7220687ed9fa3814aa19f756680750b4c613b2cd6e14426797b0410a2b62d5fb36eb3090925", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629874276, "uuid": "6b258955-7b4a-49cb-8513-785416e18c26", "value": "T13BB4E030AA91C034E5B211F885BA83B9B83E7EB1977540CF62E61AFD16346E4ED30757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629874276, "uuid": "edd3b67b-36f7-4a29-b624-2d05fb7fb291", "value": "ddbb3eef631957f988f10b48742f9549", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629874276, "uuid": "8fbabf63-63fd-483f-8d67-985959765ee7", "value": "12288:2lQLiUQrgw2+VtQeb0rrDzMuqn4iQ98Dk0gc:FQrgQwrDzM91FXg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629874276, "uuid": "373a2bc8-9678-4750-8575-36d633145bfa", "value": 539648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629874276, "uuid": "a2081c09-7d04-47ff-a77f-d7154edd50cf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629874276, "uuid": "c701e15d-62a8-421d-ab43-e1d13f7ccde8", "value": "713e10f117335ca484a0848c33205786.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45906914-05d0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629915262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629915262, "uuid": "4278a4b7-995f-43b4-8d6c-a7cf04efaf81", "comment": "Malware payload (RaccoonStealer)", "value": "0aa0d96febeccf15a0bb7063991a697e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629915262, "uuid": "138b21f0-4070-4aa4-bf3b-267e715e5669", "comment": "Malware payload (RaccoonStealer)", "value": "7fdc306985158e34a26f13164f95842755139198052b01121bfaaf76b01a28eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629915262, "uuid": "b01f80da-02ec-4dd9-a68a-8e1ec318f511", "comment": "Malware payload (RaccoonStealer)", "value": "b400a1b8c4854307786af5e66b60ba43a8b9a642", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629915262, "uuid": "178d9709-604c-41a0-8424-0eaf4e07c86b", "comment": "Malware payload (RaccoonStealer)", "value": "bca00f624fe9f1d4871729a43def655b39ea7c3af486d52e27acd3f1afadeb889145461436f8446f5970e2cdb91006f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629915262, "uuid": "a7c467ac-a775-437c-b0f6-16d7534abce1", "value": "T101B4E030AA91C034F5B212F495AA83BCB83A7E715B7440CF52E526EE56386E4EC3175B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629915262, "uuid": "b7d9f203-611d-4242-8cb4-34dcee2bd23a", "value": "1d03ad9b9e9a9068c266e5f5e715b4b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629915262, "uuid": "3ab21a45-5aa5-4c98-b75d-0f554b508ec4", "value": "12288:8pExCQDq5BCi6mjIC7uxxnhuXadwGPF517ftEvS:LCQDKjIrxI6F517ftE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629915262, "uuid": "54ed9a75-da87-407d-bd43-81d8b37b75d5", "value": 537600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629915262, "uuid": "d5990952-f636-4642-a80c-4585b8a43361", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629915262, "uuid": "61321aeb-ba9a-4c1d-adaf-46e515a3c019", "value": "0aa0d96febeccf15a0bb7063991a697e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a303105b-059a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629892225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892225, "uuid": "86429818-8814-466d-a02b-d2c5b12b5244", "comment": "Malware payload (Loki)", "value": "d9fa43cb02cc9264f9bd1cff74c7c414", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892225, "uuid": "bb70ca9e-996b-4164-b242-62e06394438a", "comment": "Malware payload (Loki)", "value": "7fe27a3d98514bf33e4f5aede5a6d530b35d901938f2fff96d0def9017e8039a", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892225, "uuid": "e32298b4-f61f-4d42-bf3f-0029be88b8a7", "comment": "Malware payload (Loki)", "value": "6e990d83d78ecbeb6b09414302e9cc9e92b54c34", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892225, "uuid": "f61ab02f-11e6-42b6-9525-b3a13a36193c", "comment": "Malware payload (Loki)", "value": "bbcf2e1b35bc90bdb710fbef7eae97e54c2f380c572931661d0226fa21209647fcb3a0655db131ec22035d46766db0e8", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892225, "uuid": "34fc5d58-c019-4f9d-b93b-db30f882015b", "value": "T1DF55130859A30E0ED11FA231CF2E7FB649454D2AE919DE2722FA767E30F017D51832E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892225, "uuid": "2a90dc02-88c5-4201-acb5-3c1e46274080", "value": "24576:IHacOavL6x9vNHgwyJFapEaXj3g4UcWJKUz54/W/pdGqGV+JK/x:IHaFav4z0kzTUcMD4exQFV+s5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629892225, "uuid": "afb49fe4-8855-49dd-a451-ceb6f58cfb20", "value": 1337344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629892225, "uuid": "eae859ad-b89b-4eb0-85e7-b96021141ebb", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892225, "uuid": "2b83e170-5801-40c3-9d3c-480176da3625", "value": "PO19-003219.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88e8e276-059c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1629893041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629893041, "uuid": "3ad1e250-3fa2-4db9-8f9f-26cfb5c88f42", "comment": "Malware payload (RemcosRAT)", "value": "58c95ff949b18fd7d355506c4147f1c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629893041, "uuid": "f2666dea-3ba8-4235-adf5-8496bca3e35d", "comment": "Malware payload (RemcosRAT)", "value": "80815a7e6ad20eed27bf6b3112f7b735d102cfc375e40444cef9abca506ed80a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629893041, "uuid": "189bb5ec-1587-4f83-a7cd-0ca6c2fecfa2", "comment": "Malware payload (RemcosRAT)", "value": "01c22e62e348fefb235aafeb987e10ec63ac53d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629893041, "uuid": "9991afc2-2b09-4dee-a269-93d8fd2e94af", "comment": "Malware payload (RemcosRAT)", "value": "23ca24453e047df1ae664dd463c27eab69a7324004a1835018af2f36da5bee0e18028c50f8d52aa53ab59a8aeb4479b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629893041, "uuid": "702e848a-32a0-4cd4-af01-dd2f1955e4c9", "value": "T16BC3C5D2AB612838D3B52C70E967ADC113159B005ED3573F218FDBAB25E0792A9C734A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629893041, "uuid": "1fa25c4c-e7af-4350-9a14-1bd198d7071c", "value": "c65aff2bab39ef464a2bad0c06b18bd1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629893041, "uuid": "50b39ae5-c965-4fa7-a3f7-b9e6ded7f94b", "value": "3072:rb+8gOwqIQDf5vrmRkOe2GG7hrp3Vy3b:rypYhvi9r3Vc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629893041, "uuid": "dbd212ba-b6f1-4aa2-8fca-9410e92b457b", "value": 122880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629893041, "uuid": "eca8587d-5be8-4a43-9b61-62f2135f36f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629893041, "uuid": "10c7e9a1-347a-4d20-84c2-d51a8ae323c2", "value": "58c95ff949b18fd7d355506c4147f1c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cde32a97-0566-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1629869964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869964, "uuid": "be64b534-bf10-444c-b953-64cbd657cb68", "comment": "Malware payload (Smoke Loader)", "value": "b3fe7c0124c172137abdb00859ef357c", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869964, "uuid": "0fe745ce-4e2d-4afc-a9c9-7696b1ee3689", "comment": "Malware payload (Smoke Loader)", "value": "80d28363a5fb3eef64eea01b589261bb08d7f947fdc8ab8e29cd30c4c3bd82e0", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869964, "uuid": "c94db3e5-7f64-47b3-ba75-7bc82a918030", "comment": "Malware payload (Smoke Loader)", "value": "e593ef7453e2d5d80bf2e8aed0c14dacef686496", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869964, "uuid": "a2b5ae30-ff32-406f-b079-42b64b091727", "comment": "Malware payload (Smoke Loader)", "value": "d8e81edbe2f710d8b9103ef748363fe46457866cd38d90dfe244ab1110cffcf2f21083a914567a9b4e05a775a52be4d1", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869964, "uuid": "ca876d5e-3ed0-4b2c-8326-29d4675e514d", "value": "T15004BF0136B0C473C366453168E1CAB0E629BCF55F619A9337E99E6F5F352C0B72A386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869964, "uuid": "200b8f7d-587c-4e4b-ad81-4b287434809f", "value": "bd3c9edf948deca79ee5e78523f1a042", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869964, "uuid": "944b3222-61b9-43af-aded-f7037d50f236", "value": "1536:5QCFVRBO4LP0/kOkw4cF9pWKkpxvSbPNymS5uCCU5u76tNxC5BriobhO2Yp2dZaE:5Crz7kpxabNiICCU5uZgMdZafD4UA1b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869964, "uuid": "b07dbcac-b42f-4006-b9f6-64dc0401bc83", "value": 177664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869964, "uuid": "a2a754c8-b8f8-457b-9fe3-3e197f0f9b3f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869964, "uuid": "a46ac411-fb42-40ae-a2c4-4e2a3ee59b96", "value": "b3fe7c0124c172137abdb00859ef357c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2837dfef-0565-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869256, "uuid": "6cc02cdf-7d3f-44cf-a0ab-7f9ea41009b7", "comment": "Malware payload (Dridex)", "value": "d2a8d53a7f4ff5f2a8fecf44dbb8c92e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869256, "uuid": "e309631a-d277-4795-930f-5ef8ddb2a7ca", "comment": "Malware payload (Dridex)", "value": "810b669d19151df1461804da5057fe57f355369adf5770b0b5022ee82317dc54", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869256, "uuid": "b4122162-203f-4348-9945-656f336365f0", "comment": "Malware payload (Dridex)", "value": "f2427e6b2efae30133fc2e2225aca7446ccf4cb7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869256, "uuid": "53f2ad78-a810-49fd-b395-c76cbd8d67b1", "comment": "Malware payload (Dridex)", "value": "bbde43a6cdac89eb0e766ca8a5bf6f66b2df98ee7dca8176171cbe357a0a321dda52b5d6b7c2559c296e72f9dd3fc8ee", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869256, "uuid": "79da1da5-5e13-4381-9ba0-3e710b93337a", "value": "T15C74126886F0D84CD98E403F61DB0F71DB616606A6817B1FD6B1A3091F17C7FCA6A0AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869256, "uuid": "0a19e133-7a6e-47af-ac32-45b8afad0db5", "value": "6144:oo3mEeO2LohOGYw6CC5jTT453mjEIbWiGVAKSLFN+YInSCRvuPsxNo:l2EedL2OGY/TTy2jEIJc6FNu3uPmNo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869256, "uuid": "fa4c6f62-0936-4b87-a653-498d10ba2c7e", "value": 353059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869256, "uuid": "30bf6c9e-87be-4aa7-b256-b5cec3e1bbd9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869256, "uuid": "02194048-693d-4617-b606-4e86576b04cd", "value": "EoY_TAX_Export-05586_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d428836a-0566-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1629869974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869974, "uuid": "93e2f53a-0061-479a-b8bd-0bc15b9f6e6c", "comment": "Malware payload (DanaBot)", "value": "f1b4d4902447ce5caab448a1ceea1279", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869974, "uuid": "f7c8c1fd-9d08-439a-a391-9868655e9c10", "comment": "Malware payload (DanaBot)", "value": "82986179159fb1244b89a23ab01b915fe1c24407712c156a087fe902572a4a8f", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869974, "uuid": "14d01eea-a70f-402e-811c-5364255bd8c6", "comment": "Malware payload (DanaBot)", "value": "8cc16603412373abe9733661949c8e7e68cbbfc0", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869974, "uuid": "f8715f97-c801-4c88-bb4c-9ef0f3cd290c", "comment": "Malware payload (DanaBot)", "value": "0c1e73ca2484461e1ca1ed9380a36538d9effbd8cf31f1b886003bf8d6d598a4852e6305760d52b5148bc166f0a3e9a5", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869974, "uuid": "348d1da8-c197-4766-b127-befe708349e1", "value": "T151F5332AADF4AEB6F4C587F009788306516F7DE12E61D2FF4610ACCDA7306634578B92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869974, "uuid": "6604e7bc-6197-49b1-9880-682d33bc573d", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869974, "uuid": "0cd2f182-743e-4633-912f-fef5d2320889", "value": "98304:dZihAT0yIsO/Wjyzn3fizXpogVw3I5gWIaeoMlbMBF:dUhO0yrO+a3filzx5gSejQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869974, "uuid": "4e6dea6e-2cfd-4ae9-8b3d-d02e2ef1ba4a", "value": 3591015, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869974, "uuid": "831c590a-7182-4cbb-8c98-df1cc11e631d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869974, "uuid": "1ce6a09b-de8f-4c2c-986b-e185d6c409df", "value": "f1b4d4902447ce5caab448a1ceea1279.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d125a823-059e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (OskiStealer)", "timestamp": 1629894021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629894021, "uuid": "3e053f62-9e85-411d-8a9d-eee73263d21c", "comment": "Malware payload (OskiStealer)", "value": "1110d573c57860b4ba2719fb17f508b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629894021, "uuid": "f363de2a-003f-43c8-b278-4a0277d3be64", "comment": "Malware payload (OskiStealer)", "value": "83e8782266edec54f4c451f60e2095864c8a9d817e7296076e128c686a6bfea3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629894021, "uuid": "5c73f4d0-4b6e-4123-bbe1-ee64089d7076", "comment": "Malware payload (OskiStealer)", "value": "8212db43ee02260bc150364213c1534b648f1da8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629894021, "uuid": "9c07144e-2474-4396-80dd-fd9dfd7ab6ee", "comment": "Malware payload (OskiStealer)", "value": "5a9172404dde9b1d46df59925b2794578b667cdca8166f0a6240dd56bbc08af8280ca38cf17fb3571f024c7c92cb6b52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629894021, "uuid": "9faddbf6-0179-4695-83f1-60fee4954946", "value": "T12EF4E0AD721475EFC82BC9729A981C64EBA0B47B530BD203A45315EE9E0E6D7CF141F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629894021, "uuid": "2f3dfcc6-d288-4fc5-8aa0-b68c3b0cbae5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629894021, "uuid": "cb6ee8df-e1bd-4165-93b5-1345e422729c", "value": "12288:en34ViF3zSxwWIQ8VHjuuRImRclE2hao+coM2algtZZES43Tf4Po1yfMa6hVehXm:Ot3zDkijpRubota2ZZqFI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629894021, "uuid": "1c1485c4-4168-480d-b472-50e4fb28eb58", "value": 729088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629894021, "uuid": "f8efab80-ca4a-4d1b-a528-8a93c294f772", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629894021, "uuid": "4e8c0840-4bb8-472e-ac12-eed0e24cfe28", "value": "payment.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97ad7ac6-05f7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629932150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629932150, "uuid": "2b4acc2b-74e0-4ba6-a6b6-d094e4c7b1c7", "comment": "Malware payload (RaccoonStealer)", "value": "4cfe5d56e69b49b12c674465a4330700", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629932150, "uuid": "71bd231a-be3b-4b0e-9d42-e320118ecfec", "comment": "Malware payload (RaccoonStealer)", "value": "848813fa2c1bf4b2ae9cce84ba9fafdb5349f9b81c838ea3cf537f7e83e34109", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629932150, "uuid": "ae69e226-1441-49eb-bb55-638a0720051d", "comment": "Malware payload (RaccoonStealer)", "value": "3d2a20ddd27587d4f988865b27d22b011fb746bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629932150, "uuid": "a7a91c91-f503-4685-87ac-83488238466b", "comment": "Malware payload (RaccoonStealer)", "value": "9dd828a018f1b8923a755c9681d6538a67528b4d26a360c264b4dd5de78e374c32a40abfda11de37bbab959d0a6e8e13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629932150, "uuid": "574be2d1-a9e9-45e8-a020-fae94d175356", "value": "T1A4A40141B6B0D23EF9DA51328429C760962B7EE75B20028B3F845B9F3A311D0561DFEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629932150, "uuid": "081c98ad-5bfd-4c9c-8edb-630e2dc39007", "value": "c2177a2021a127fae92a922150801df7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629932150, "uuid": "08ad3e93-f546-4e01-b2fc-1089dd4ebefe", "value": "12288:h6ADUjB4J59b3zkpFnNMO1i33PCijWdQcec:h6I9bDu3bM3qiKQc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629932150, "uuid": "1595771f-bb26-4120-a3b2-faad2e57bb80", "value": 467456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629932150, "uuid": "a11ed38a-68c4-4677-af4f-daefda9d6c09", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629932150, "uuid": "145d7120-de1e-447d-9acf-723769d8ed05", "value": "4cfe5d56e69b49b12c674465a4330700.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb3f963a-0564-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869100, "uuid": "f6495138-2b3a-43ac-96ad-e975927dd7ac", "comment": "Malware payload (Dridex)", "value": "d899724f12f068324439f6ee3068c0ce", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869100, "uuid": "3bb2716f-62b6-4d74-b4d7-8d936ff55693", "comment": "Malware payload (Dridex)", "value": "84df536eb57b0882afa74879246159e5a42495fec382b09f3e93b72c0f3506f3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869100, "uuid": "70da1a4b-2202-4fec-9575-74fab558d217", "comment": "Malware payload (Dridex)", "value": "b32a39f409ef6e0f7355d6272517e3bd5d394b3f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869100, "uuid": "c325e08e-8f35-4ad5-b9de-19a3df3bc58d", "comment": "Malware payload (Dridex)", "value": "7d8bdd01149ccc57b098279de263639abbc91535c3515d718da2954effbebe543aa1a55f0ecab1923939ca389180eefb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869100, "uuid": "40a20224-84ba-40f2-9ee2-c1260d1b5596", "value": "T1D1B3D0E87736DA58C53E033D91DFAEB73FB85B8446924611222DF4185F720A7EF54228", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869100, "uuid": "f7538ee0-763e-47d8-997b-f4048fd1ba69", "value": "3072:oU7P+l1PNVD2lqmGi63LD6z2qoaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa3RY3B:o4eB20m767Moaaaaaaaaaaaaaaaaaaay", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869100, "uuid": "3d272906-096e-45f6-9a78-2c1191e9bc11", "value": 116266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869100, "uuid": "94707d53-0eb2-4c30-a74b-2b2cb3716a76", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869100, "uuid": "6bcaec66-006f-4211-b5b8-5e567373cd28", "value": "Invoice-94575_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbea5cc7-05ed-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1629927942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629927942, "uuid": "a44f4016-bd25-463f-9433-ad37ff63cae6", "comment": "Malware payload (njrat)", "value": "30f422cc3e94ca1ebfe7b514e0a3deef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629927942, "uuid": "8c53ede6-5a4b-4f70-941f-a11f2a6278b4", "comment": "Malware payload (njrat)", "value": "8500f1744e517dfa7e8f0e08aeea29ca2625695ee2b90653a007edd1be838f54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629927942, "uuid": "78cbfa63-2cea-4f60-b3fe-cca29a536579", "comment": "Malware payload (njrat)", "value": "8bdbe1fd3a9da00dde1e7019014391828180959a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629927942, "uuid": "0d0c2c6c-94e5-4b74-a7a6-b9a59e2fa86e", "comment": "Malware payload (njrat)", "value": "66153d0c724fe9865ef8ab21554c2ec889f62ab6fcf0c0e90c598407b145df3d94c000c01fc6545bf706ae2f4a092e5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629927942, "uuid": "63276cf2-4830-4d4c-b56d-fb46b642b1ed", "value": "T10C063312E9D580B2DA766F754636275496B8FC200F71DB5F9388B9AC9B330C0A730F96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629927942, "uuid": "02548738-822c-4377-b4c2-927c997675a8", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629927942, "uuid": "efc3fa6c-c64d-4717-9673-db99c8f87773", "value": "98304:Y+zBHWSjDdayAjCjzvJB6rpjDpdBL55C5xYdj:xFUbCBB6F3B55CnYdj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629927942, "uuid": "d8df2e18-94c2-4169-a5e4-f61aa0a0ea16", "value": 3953793, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629927942, "uuid": "e80b7df2-78b5-4495-88f6-81cd18e7baaf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629927942, "uuid": "f25daa33-bc62-40fe-a772-a13a24b472d3", "value": "8500F1744E517DFA7E8F0E08AEEA29CA2625695EE2B90.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cc934cd-0584-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629882578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629882578, "uuid": "52949456-33db-4e21-92db-015c083f0b91", "comment": "Malware payload (AgentTesla)", "value": "e771180fa9b53d717bd4c3da0f0f4e05", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629882578, "uuid": "ed0fbdcc-585b-409b-9304-36727bbd69e2", "comment": "Malware payload (AgentTesla)", "value": "85d8d66051e41c4efae589030d320e341c15681a375dc09ab6df114bccf6d1e1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629882578, "uuid": "c8970db9-8277-48fa-9d49-257b11c16b19", "comment": "Malware payload (AgentTesla)", "value": "d21784b51ae67d294c9fe29fc6bdfc468f1faaa8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629882578, "uuid": "b7410f2c-49d0-4d0d-91a0-34621b0618e4", "comment": "Malware payload (AgentTesla)", "value": "27ef170a5c9bcf18ba41c406da372e80d495daec05583a8df64bccb24897aad9d9cbb1d6ada2a27f8b246663317e6b1c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629882578, "uuid": "a66f190c-ad9d-4b35-928f-492b3f653cf4", "value": "T18125073C19B83627D1BAC766EBE18413B29094AF7121ED59A8DE03E70743B4675C723E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629882578, "uuid": "4afdd785-9cb3-41ce-ab42-97804b7fb404", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629882578, "uuid": "7d87fc55-1124-46bc-8eed-9438b98a70a0", "value": "12288:u11CO5SopSVLadcDc9F3nC0Py3gAh0L1GLVhjjQdZ8Y0rnFVcNkDJKF7tj7al533:u5AuL1GLLjP1XcNkW714OGyDmsm1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629882578, "uuid": "fb844123-8f2f-4a90-a7c9-53bc6b3d91aa", "value": 990720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629882578, "uuid": "65705dce-96f2-48d1-8b10-e6fb6c7aeb67", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629882578, "uuid": "9ff674c3-40b0-4620-904c-c49bb49ea659", "value": "OC_Y490215874.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1917d5af-0565-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869231, "uuid": "a6a2ac34-e249-4f55-88a4-ce90a715a2ad", "comment": "Malware payload (Dridex)", "value": "9223ca3fc057bfa36d4edca9ad50eaf7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869231, "uuid": "fb746ede-79f4-4899-8a37-d1824bf557cc", "comment": "Malware payload (Dridex)", "value": "866cba5d10b39dca37d70d5e496569ecc30d4c76a626bed9e5a5bcd0fa8961ed", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869231, "uuid": "0fb47eac-73b1-45ad-af2e-22735f7ee3b9", "comment": "Malware payload (Dridex)", "value": "80b89aa9eb275a83de6e8ab95597b50fcd2a0573", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869231, "uuid": "5cd95887-bfcd-40f2-8b85-15d770a0354c", "comment": "Malware payload (Dridex)", "value": "0303b0a2ed1033d9ba22799649c52a99a97a453e81d995855c6d3e64e6876f541209050403e50728adfedcc33d5a907c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869231, "uuid": "2b8473f1-a308-44ff-8dfe-fb410fda23bd", "value": "T156B3DFAAB132DA9DC06D533C45DF6F776BB88F4412A34B15222DF85CAF225E3DA50128", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869231, "uuid": "9e74b9eb-ade0-463b-b0e6-67b712f3057a", "value": "3072:oUui1GaLaz16Wxr4zo/fi63LD6z2qoaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaW:oqsau56or4U/K67MoaaaaaaaaaaaaaaJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869231, "uuid": "3e337b87-6fe3-4129-b422-1eaa71e5f7a4", "value": 109039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869231, "uuid": "89806422-ca96-4f09-9d8d-72d34b1a274a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869231, "uuid": "5a7745ea-33fa-4ccf-8792-bf7bc04ccaa8", "value": "Scan-316243118_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23c6a624-059c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1629892871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892871, "uuid": "964f4aab-662f-4696-8711-9d88d39df991", "comment": "Malware payload (Smoke Loader)", "value": "bf1336f26ed7df9c1d72126e43f558a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892871, "uuid": "46d07482-1bd6-44f0-9477-cb49ad8709ff", "comment": "Malware payload (Smoke Loader)", "value": "87fc3e042747ec6e69f1c32bb906de41b2a6e4b1fdd6bdfb041c3689002e97cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892871, "uuid": "014c4e1b-498a-47ab-8545-57dfa4700c61", "comment": "Malware payload (Smoke Loader)", "value": "2dea26934da1770a8720bb788a61f7b71385b1cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892871, "uuid": "c4011d18-1b83-42d9-a2d8-c9f0718b873a", "comment": "Malware payload (Smoke Loader)", "value": "63a8a179905d7802cf106b26709a9b2d3090a48507683317679d156ed39c2ad027bb5cb307d711b4510ea7dcbff79fae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892871, "uuid": "20d61d4f-df3b-46b2-8845-0c48d8247aa5", "value": "T113548D30AAA1C034E9F211F4497A83BDB9393AB19B3550CF53E52AE917346E5EC30797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892871, "uuid": "0bb53df2-5376-4561-8308-ce96c04918d4", "value": "ddbb3eef631957f988f10b48742f9549", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892871, "uuid": "ec703caf-f6b5-4a18-b022-24785adae4f8", "value": "6144:EkDh4MkEirjH29xfUBTVqWBC1dgbRk8suE2w2xQr:vh3kEi3W99kVqWBCIbQuE2w2ur", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629892871, "uuid": "292c475c-dce3-471f-95fb-e6ed6dd918a8", "value": 281088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629892871, "uuid": "d2f71c88-ed98-4fce-b44b-f779d860addf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892871, "uuid": "e41948b9-9bcc-4ded-bf95-de651d03a101", "value": "bf1336f26ed7df9c1d72126e43f558a8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5b39187-0566-11ec-8fa1-42010a9c0011", "comment": "Malware payload (KPOTStealer)", "timestamp": 1629869950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869950, "uuid": "c18f09a0-1f3f-4122-b8cc-fffe78b254d8", "comment": "Malware payload (KPOTStealer)", "value": "2dfd26b62aed469c649521c77e2272d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KPOTStealer", "colour": "#42A642", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869950, "uuid": "cfe492c5-23d4-4ad3-acc1-eaaf45a57348", "comment": "Malware payload (KPOTStealer)", "value": "89299028b5bc71b904bb9081ff287c61ddff5911ccee0ea483d7c479fd3dc5f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KPOTStealer", "colour": "#42A642", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869950, "uuid": "17e4d7e6-bdfb-4769-b7ce-7a108410e743", "comment": "Malware payload (KPOTStealer)", "value": "d6b662fb5f393873210016a35d238d0740f10481", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KPOTStealer", "colour": "#42A642", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869950, "uuid": "de3a9cb0-0142-4634-a4fb-ee99d41fee2f", "comment": "Malware payload (KPOTStealer)", "value": "2ef5745ab5d9a4483e6b2ba3dd12761d7d136caf1a1e8fc8cfbb6c7f506e38103eee0cd272a77e9ea3af171b5c1ea726", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KPOTStealer", "colour": "#42A642", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869950, "uuid": "b95645f5-7a40-491e-8367-f34d4ae74011", "value": "T10A8401407660C533E45A207048E2CBB0D66E79E36EA446437BE4DB2F6F75292B73B346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869950, "uuid": "48670cb6-33a2-473f-806f-84cf770af84a", "value": "3bdc58d7d3add14fdfc74404aa032a2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869950, "uuid": "840e0c51-1902-4435-9a4f-4490135eb124", "value": "6144:lDwYhDlax6M+ecz/hXPPHxATjGI5gL4ZpOtGfv4R8bEcxb:lDwGDZRBzJXHxmq4Zp1REcF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869950, "uuid": "89199454-65e6-4737-bcc8-90a072fbf586", "value": 404992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869950, "uuid": "4c0b3b18-c9db-4ee7-9b5b-abf6f74e735a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869950, "uuid": "85b983a6-24ee-4a71-9cfd-49c4017e2c03", "value": "2dfd26b62aed469c649521c77e2272d7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "757e32d9-0587-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629883989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629883989, "uuid": "544dfc57-04af-48fb-af7e-06ae0606a020", "comment": "Malware payload (AgentTesla)", "value": "dfc88a456dc13136aa28d368c0583237", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629883989, "uuid": "7e0317d9-b8d0-4ac8-a749-91425c4d51f0", "comment": "Malware payload (AgentTesla)", "value": "8c5b43b0e8a36c7522180ca43e43868972cffd9b50e5bbac32694d7aecf4448c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629883989, "uuid": "9802d686-852d-4743-b9e1-c0d60d9ae9fe", "comment": "Malware payload (AgentTesla)", "value": "f1a5186b63002143a7473173723113d770a5aa1e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629883989, "uuid": "a50fe9d5-106f-4109-a7f3-fa3f2a859230", "comment": "Malware payload (AgentTesla)", "value": "36a8f2e7380973077b319b8782635983ebbd3c004ca4b8a58f30dce60be24229dd45d59366a87fd14232d9805d3205e7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629883989, "uuid": "7e751073-3187-427c-bc92-98491f5839b1", "value": "T1BC159D7023C9C254EC1A8FF0166CF79102F275E7B6C5CD6A16EA720CCE5A9D12B1768B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629883989, "uuid": "11182000-be2b-4077-adbc-e52b6283614c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629883989, "uuid": "987eb855-2885-4b28-890d-50fb7935cb16", "value": "12288:eFcsGI/cD8RWiCod1+i84gica+9/T46astY3pFUrX0E1vfOKrr235PzdJIr22EOQ:e1gizdQiPgbaekji3vfp23Zzcr2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629883989, "uuid": "19c6f82e-af08-4eee-8b81-7ef7047b2c11", "value": 946688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629883989, "uuid": "8844e526-b5c9-4e65-80be-932b301be57e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629883989, "uuid": "24723375-ff23-4f21-a969-1576d29ac3a6", "value": "Approved Purchase Order#08024021#.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01389799-05f9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629932756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629932756, "uuid": "785eb8b0-9960-4e49-b421-05416896fe81", "comment": "Malware payload (RaccoonStealer)", "value": "adedaf5e119be48cc90bf8b7851f9e5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629932756, "uuid": "e21a29a8-4bbd-4455-b4e0-fcfee64e577b", "comment": "Malware payload (RaccoonStealer)", "value": "8c6bfcef8131e02e228eb4e94537deb8c15f897eeaee0086f67e0bb6c45066f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629932756, "uuid": "30b2ed59-47a0-4ff0-9ba4-3c93f8031a72", "comment": "Malware payload (RaccoonStealer)", "value": "08b30e6c30e66bfce82bd7e573f02b939a41bda0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629932756, "uuid": "ea8996db-12ae-45c0-b796-1f44eeb9e0ce", "comment": "Malware payload (RaccoonStealer)", "value": "3b2ad8c532048dbde67bbfa0df73dc5aed2dee8ee67ed6d7b4ecf6388151157b1ee36763ead844ed8b2f6aa65a1b1e15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629932756, "uuid": "b6353317-829c-475e-a0aa-2cf82a9cab26", "value": "T1FAA40114B9B1C076F9C084B28C76D744563BA9F39F248297368C5F9E3E212D0671EAE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629932756, "uuid": "8d9d5a2c-422c-46eb-bdbe-9e6158a8c333", "value": "c2177a2021a127fae92a922150801df7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629932756, "uuid": "e5d2b85d-dc67-4a3c-81b4-a2f56f2326f1", "value": "12288:/4mWlG2jcTEJSQUO6FweG9wSM8TVgZda2dqfzHEec:/Ys2jcTErU3FPSDTcdapw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629932756, "uuid": "9906edf8-8e45-4c0b-a9c0-652817da5c74", "value": 466944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629932756, "uuid": "97571800-83c2-479f-b6ab-8af4ffb49421", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629932756, "uuid": "7c527610-e55b-4a90-9ea0-ec9931c7e225", "value": "adedaf5e119be48cc90bf8b7851f9e5d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5780fc04-0572-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629874919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629874919, "uuid": "4653faa0-8fd4-4041-9e14-3d817098ee97", "comment": "Malware payload (RaccoonStealer)", "value": "3b3aeef0fb9a412fa69d2f730e433d88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629874919, "uuid": "3cf88cda-45d4-439a-8907-51427526fd73", "comment": "Malware payload (RaccoonStealer)", "value": "8dd2a56704198ab57a70bc7e8f8d338126af40cfe4a00a7c67dbecda59f648cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629874919, "uuid": "75da4e02-123e-4754-855c-9078b15a166e", "comment": "Malware payload (RaccoonStealer)", "value": "6a6633b0d0f658f9802263d26a1f6920d8c0f2f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629874919, "uuid": "cc60a322-baec-4fb0-8242-58e6bab145e0", "comment": "Malware payload (RaccoonStealer)", "value": "42bc4881c69807f2e725e1b09b106c72e56d9f1432c568c7a1c3884aee094a0403624b745e0f05b5989307d082532aa3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629874919, "uuid": "704051a3-502b-47f6-a784-58a4b761c66e", "value": "T12464F2803A70CD33DA5A1273C895CFA5AB3E7CA25DB1814777E41BBE6F351C0361629A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629874919, "uuid": "265642bd-381e-4675-81d4-e4f7b4b58133", "value": "bd3c9edf948deca79ee5e78523f1a042", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629874919, "uuid": "40e05a93-da7c-40da-9cef-3145a2ee4791", "value": "6144:MQdGOa5xUj69oyYqcadDXnounnwnNOk2cxb:MQDa5xQa7cCMunbvcF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629874919, "uuid": "6fc10fcf-263d-4217-a1de-f435521b3158", "value": 311808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629874919, "uuid": "e50b0d2c-e215-490f-9749-1c22cd1b04f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629874919, "uuid": "fe545385-ed41-453e-a280-dc6c4fd1f56a", "value": "8dd2a56704198ab57a70bc7e8f8d338126af40cfe4a00.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "422ebbbe-059a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1629892063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892063, "uuid": "313c730c-614e-46f7-a2bf-a352bb5ba113", "comment": "Malware payload (njrat)", "value": "c0ed511f039b4f0e7f83a6c2538b8770", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892063, "uuid": "e9bce10d-707e-4ef7-954e-e5f1c2c7292c", "comment": "Malware payload (njrat)", "value": "8fdb72f9c734907a1eff8282ffdf1294127d42debd0c75d6b46ac758a5facc97", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892063, "uuid": "2a62626b-0f40-4348-9e00-d59a2437b19f", "comment": "Malware payload (njrat)", "value": "56b29a0d6710ed054dacfdae25292a07eaea05f6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892063, "uuid": "ce798f78-56be-4a9c-afbf-98856bda491d", "comment": "Malware payload (njrat)", "value": "15d3382a0383bf9e30f7cde272f76fc87432841ce2742724f9f2c32963548ff1adafa0aea7468fc5b7d6627651a7832f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892063, "uuid": "1be87d49-10e2-4e3c-b517-ec34a3b026e1", "value": "T1CED32A43B5985305E824257580EF2D7903E27BEB7B32E6997F4C278D1D137A29E81F0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892063, "uuid": "0497f101-98f6-419f-9f58-aac8bafce2a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892063, "uuid": "f4506f70-882d-45b5-8155-3cdcb2032e14", "value": "3072:2mZmuwy8xEgTFzjhpd2mDqGan+OwtgXiC:2mZpwy8xE8jqmGHBnXi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629892063, "uuid": "afe9ad9a-da19-48cf-843f-8ac97310d464", "value": 130048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629892063, "uuid": "a2e9c3f0-2080-4139-b209-603408fea2d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892063, "uuid": "d19132be-2a06-408b-bffd-90f4125ac520", "value": "c0ed511f039b4f0e7f83a6c2538b8770", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "690e423a-05ae-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629900718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629900718, "uuid": "d1bcdbf7-3aa8-483e-8899-6d5a9a9116d7", "comment": "Malware payload (Dridex)", "value": "1e69c532796ae69da06ba992a1b2f03b", "object_relation": "md5", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629900718, "uuid": "08a82866-20db-4885-87a0-8066be6f5d06", "comment": "Malware payload (Dridex)", "value": "91a9d1482cacbe1adc5b23f56604b376860c13b69894164a9f79f9292d7f79b1", "object_relation": "sha256", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629900718, "uuid": "1356227d-b8c3-4e17-a062-1ddf93cb32e7", "comment": "Malware payload (Dridex)", "value": "ea01398474bfd8cced99c66d44545c6f15dfe67d", "object_relation": "sha1", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629900718, "uuid": "977f6e55-947c-494c-bb1b-fd3791521788", "comment": "Malware payload (Dridex)", "value": "737936fd3016f55d64bccbf041a7de72be7a4207f332d5824c30dc9e2d0a9d7b0128f2e5d7c737bb2c516830821f1106", "object_relation": "sha3-384", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629900718, "uuid": "2c296856-97fa-4523-b1a7-c0d0e72d102d", "value": "T1383412060DB7357DDF5D80740C8B0F8ECB915605A1C1B28AC6A2F1A82FEE1FB2E554E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629900718, "uuid": "f95bff5f-3fad-4b09-9932-7be9d83d5dd9", "value": "6144:oD8eMJAm8dtxliGGKAtC2U7AY5LrasAoXNgX:i8XJAm83xcGGKA7tBsAggX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629900718, "uuid": "63ec141e-82a2-4936-a0af-b2956ec1816d", "value": 237495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629900718, "uuid": "10a1508d-1b52-4b60-b365-1c8918e2fbbe", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629900718, "uuid": "b6ee3b48-34f5-442b-bd6f-c87789643b33", "value": "Invoice_Due-IN-57576841_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cd59c1c-05e8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629925635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629925635, "uuid": "8477141e-d624-4dda-9d1d-46d5d887ac1f", "comment": "Malware payload (RedLineStealer)", "value": "bca3e9c3438e054c4dd375cb2cff3322", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629925635, "uuid": "b919ae4c-5066-4e49-9111-6ac2d58cbd07", "comment": "Malware payload (RedLineStealer)", "value": "9283a7ec1f495eaa521dfb7dc078c614dbe17aeae998576518953a4b5a4c17e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629925635, "uuid": "1f0f8a99-4c64-4127-bba0-79fec5981e5c", "comment": "Malware payload (RedLineStealer)", "value": "ea00db5753baff3542b2f1c0ae5a4d108cf3f1d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629925635, "uuid": "2e69e7c6-4244-4956-98ec-ab34070ef075", "comment": "Malware payload (RedLineStealer)", "value": "8beafb8d7a6e0e2c9f5430e3bf90253052fe288e8ed0d069a5bb0737b0d2e7ead6607af5e86d54ee6b88b942fb382993", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629925635, "uuid": "12c85e2d-812a-4462-b9f0-4ee73fc04ddf", "value": "T116A33B3263ECC629F3BE0A366870111587F1E0CB6401E75F5EC174EA6E767826648AF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629925635, "uuid": "606dd81d-ab97-4c3c-96d5-1156ee6f6996", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629925635, "uuid": "424c826e-db17-4a0d-83c1-5f0a8769d2f0", "value": "1536:do6aG7BCxihrFMIMgmoRQxWauIw8ygbue7vquvNyAsd3petx5RETG6WAaoigR:ddxtCK5svXJb3qulyddsNW5B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629925635, "uuid": "64f7cebc-942a-44b4-b0a6-b73c08ee64ab", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629925635, "uuid": "ccaebaf5-1b85-4c79-a372-aca9fd81ff49", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629925635, "uuid": "544a186b-733d-47a3-9bb5-51507422487d", "value": "FortniteDesyncInstallerV5.5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f986a1d1-0564-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869178, "uuid": "5c53b29b-b6fe-4c43-a562-2755241cb7df", "comment": "Malware payload (Dridex)", "value": "6aaefc2cc503a997f31188c815488d01", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869178, "uuid": "25658f27-83ae-4297-b07d-bf46330c817f", "comment": "Malware payload (Dridex)", "value": "934e6e698f9e4f3b5e23f258238c154fee92652cc606d883dfbb082ee34df857", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869178, "uuid": "e0ade21a-7764-4a27-93a2-d05ed11b5e8a", "comment": "Malware payload (Dridex)", "value": "83a3e3b9811bc65ddb425978d2970ace1b9067a7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869178, "uuid": "aee1d4d9-50bb-4135-bc73-1cd4ea02dd88", "comment": "Malware payload (Dridex)", "value": "d90e46645123ebed2db0f1c2c1a459f59d53a5435ca4e62ba9180b0da325d5c601bd345f0c2915275964b854fe671020", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869178, "uuid": "7a35180c-a4e8-4616-829d-056893b0edbf", "value": "T1ACD3E0EB3927DE48C42D433C54EE4E77ABB88B8556E34B07126DE82C2F129D78B44619", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869178, "uuid": "fa2e7fd9-f4ea-4370-a357-a4c6a5452a5d", "value": "3072:oUt/rQluhkRzijQCkRIz/8lOD3i63LD6z2qoaaaaaaaaaaaaaaaaaaaaaaaaaaaM:orxZmzaIzEYm67Moaaaaaaaaaaaaaaaw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869178, "uuid": "6e435296-8f47-4a01-afe3-435cdefca65a", "value": 141117, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869178, "uuid": "5ef4e3f9-9f7e-44d9-b76e-29b5e8a3125f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869178, "uuid": "007ca5f2-0f65-4839-859c-a2a443f3f130", "value": "Invoice-2764553832_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edfc132b-05bd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Cerberus)", "timestamp": 1629907384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629907384, "uuid": "4cb4385c-cd58-4b85-9b37-ffd9aca0565c", "comment": "Malware payload (Cerberus)", "value": "b69f4a2b8cff204d9c42dc4d7277fa96", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629907384, "uuid": "0c65da90-2243-4427-8d91-27238be2a3ad", "comment": "Malware payload (Cerberus)", "value": "935ed96da7b95fd6740f9e2950e32f6a25112597bd5a00f705c351db7761c1ef", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629907384, "uuid": "178c7bea-588d-40ff-a0a5-a47343024a16", "comment": "Malware payload (Cerberus)", "value": "6e1fa50f394ec8cdba5fddfc5d73f46c61bd5c3a", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629907384, "uuid": "99058f24-1f47-44e2-8e6c-e909d21501f5", "comment": "Malware payload (Cerberus)", "value": "7f25df6063859ecb5e1046da5926a20ea4dee549e0c3fd1a6f9647480a6dd27f8b8830a42c9cc0e13c91a6eef4a42c87", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629907384, "uuid": "aeadcff7-8eb4-426c-9dc3-831ef381319c", "value": "T149D3018393C0147AF07FF53559A9E7721BB28A84B7E5A3C335045268ECA674B0F4CE56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629907384, "uuid": "6eb8d5ac-1ca4-4d37-af11-c43e024e76c5", "value": "1536:AL3E50uXsIGFQgUmsLXQLTzlUs5u++BD6BcSWeUAGZ0GuLuIyPy5fXrfXZqL1wqo:MvFQgcgLno8+SWee0GuLuIQ2XzXcvE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629907384, "uuid": "e6f97ce6-db65-4888-8b1c-6cba4900e472", "value": 136625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629907384, "uuid": "0da0eaf3-0003-429e-9174-98aa84482325", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629907384, "uuid": "7907736b-9e7c-44bf-953c-279309e786b6", "value": "playstore.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7b75002-0569-11ec-8fa1-42010a9c0011", "comment": "Malware payload (STRRAT)", "timestamp": 1629871322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629871322, "uuid": "3e39a96e-feff-4064-b2b7-7d3a9ef89310", "comment": "Malware payload (STRRAT)", "value": "8c967e80d69f6d0407af817acc034ee9", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629871322, "uuid": "ed694351-34eb-457f-98aa-2d634cd20261", "comment": "Malware payload (STRRAT)", "value": "945fddfc1fa07995d86ba94d167693ce80f462b3738a6c1c05a5557601aadf2f", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629871322, "uuid": "75687c51-4252-4e7f-8eaf-7e88ceda079f", "comment": "Malware payload (STRRAT)", "value": "2dab6fb260d020c40b92280effb4c6f91a97b0ed", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629871322, "uuid": "19d2f6d9-1e0b-49c9-8e3b-ec646e5530fb", "comment": "Malware payload (STRRAT)", "value": "3cda55e2be8317adbcf028a8bd85bc35692cafe7156684faa2c542959b42a47d59db6862fb78885f4e84a9d90dfdf8bc", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629871322, "uuid": "2fe4c8b6-d261-4496-a1a3-5ed855e6e297", "value": "T13BB3DFFF3EE2C0B5D10BA4324401922E695C9198C12494EF66FD349B1D31D6E2B96AEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629871322, "uuid": "f90991b2-9579-4268-a39e-48b11c85d84d", "value": "1536:m+6lO77EyNyGSZTvdBxX5CJgOn1HAqnA/GSHLx4hVtjZZ30mlz9YfijW/lS6:mFyYJxX5eggArOSrehHZZEmlx9C/D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629871322, "uuid": "92f135fd-11f9-4a6f-b6cb-730883d56798", "value": 113145, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629871322, "uuid": "8732cd54-f62c-4ba6-bca5-814a3a56f395", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629871322, "uuid": "0b1862d2-9b4b-4252-98b3-c38f0a590d6c", "value": "invoicepayment.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c45f4863-0564-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869089, "uuid": "f8235b30-0d19-4d9c-81b4-79af03738ee5", "comment": "Malware payload (Dridex)", "value": "8e249503f14012819ed4313e1eb07d0d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869089, "uuid": "83ed51a9-cda2-4923-83cc-88c4911ee9d2", "comment": "Malware payload (Dridex)", "value": "94ee5cee4668dad2208b8df3c34e0f50d975bbd0a85e9beda5e06d972d1371b3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869089, "uuid": "b54d7b37-5357-42e1-a7c1-c0d869b7ec3f", "comment": "Malware payload (Dridex)", "value": "09c399e1d077ba18679458fb30618414aa48af7e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869089, "uuid": "456294eb-0567-41c8-b46e-4c42e31269cc", "comment": "Malware payload (Dridex)", "value": "910c22735d1505a40cfadd2305b83281ba032938f87511fbd3852373b70d8700df3844b9c0612c8d85d2586e3f66e27c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869089, "uuid": "2bc613d0-44ce-4749-9887-a52de572969f", "value": "T1C174126896E1C85CCC5E413F56D70F719B721B06A781BB0FD5B1B20A6B03D3E4BAB168", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869089, "uuid": "9fa582d5-2d93-42d4-9944-a1fa987d77f5", "value": "6144:o1qPJ2Bz42LohOGYw6CC5jTT453mjEIbWiGVAKSLFN+YInSCRvuPsxNz:OqPEvL2OGY/TTy2jEIJc6FNu3uPmNz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869089, "uuid": "7252a6b2-b7b9-4b95-b75e-6bf7a433ee77", "value": 352883, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869089, "uuid": "e9d99a2b-0e8a-4826-b356-b7e73af5639f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869089, "uuid": "a720a0f4-41d9-4837-880e-e013f78e0afb", "value": "EoY_TAX_Notificaion-9134_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7b20f06-0564-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869148, "uuid": "84b413f2-ebc3-458d-937c-d867b6543b70", "comment": "Malware payload (Dridex)", "value": "25ce25759d47db9528f7fdffc529ef1b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869148, "uuid": "20e04830-7f12-4d6f-ae8d-0e0facc6b137", "comment": "Malware payload (Dridex)", "value": "95f6e0233ea3baf6ce84716b36b606b90bafb8eb8d9aa20ee4148f72654299f7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869148, "uuid": "25f74064-ec79-45d0-98a0-56809eea6edc", "comment": "Malware payload (Dridex)", "value": "cff96761ede944dd37c1c77bb252523a1573f7ae", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869148, "uuid": "103a9f5b-5fd0-4eb3-b1fc-d10b9a1377a6", "comment": "Malware payload (Dridex)", "value": "9c1f8cde9d779178c50e062abd981482cd3c48ef9379aa8dd11ecd11db9d769dc328e65da31ae7e639723af7491f86f0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869148, "uuid": "be0b79cd-0f67-4d38-8231-79450881e3d0", "value": "T14DB3D0EA7222CA6CC13A533C81DF5FB76FB44F5952E242062278F52D6F126E7CB44219", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869148, "uuid": "fc91ca12-10fe-415b-bf89-3e2781f8e62a", "value": "3072:oUYJThOpc0yL/e2Di63LD6z2qoaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa3RY3h:olJThVe2G67Moaaaaaaaaaaaaaaaaaaj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869148, "uuid": "eb6d869c-4870-4009-9ffd-5d3291fbec0a", "value": 109039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869148, "uuid": "5eda208d-977d-4793-97aa-b6d2363f4681", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869148, "uuid": "5d16d2f7-9193-4d61-ae8a-37022c250d9d", "value": "Details-690945971_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e6e5f60-05c9-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629912377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629912377, "uuid": "11eed836-fc56-4147-bfc0-78cb54f1b047", "comment": "Malware payload", "value": "ee141a3af016c6287843616c377b5600", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629912377, "uuid": "95b86a49-7fe2-42d5-aead-4dfe907e42ba", "comment": "Malware payload", "value": "96debbf13dba9875faa0a6df2f7492e5387f5fa22c3ba745d698b600ebace023", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629912377, "uuid": "84d21eb3-f998-47e0-8533-863e18187d83", "comment": "Malware payload", "value": "bd366a4068afc946fc2779710ceb32477c68736e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629912377, "uuid": "5e1a741a-9c29-4be9-81c9-d641a447eae1", "comment": "Malware payload", "value": "d29d74c0e061037e0f051d75698f247ebad2e37a7056b456c61073a33a21e07d5d32a7a2f2be4677c22b7efcc5973853", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629912377, "uuid": "2212b821-62ba-4601-97e7-c81cb5ee48d7", "value": "T1FD5315D42691D40766CD1F83FF067EEDE16AA8769CC8A60386947A8C64BC507C9F4EF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629912377, "uuid": "46b2347b-353f-4af4-866a-884975ddcc1d", "value": "1536:oj5vAlVNH4xCttFBBquzn8Zos5zRujKgGjPZZDt:oj5olVNH4xCttrBquzn8ZoGRTjPZZR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629912377, "uuid": "7e84eaf6-84fe-430b-99a3-896f4cc34c6c", "value": 61031, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629912377, "uuid": "efe1c893-6637-4a0d-916f-d5ac6cb54e82", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629912377, "uuid": "3ab34001-0b51-49c2-aa8e-9f3858002032", "value": "LDR_4473.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb7ce19f-056b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629872161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872161, "uuid": "64c4adca-33c8-4f16-81b5-d4780e2bda7d", "comment": "Malware payload (RaccoonStealer)", "value": "68817aa183c3303868ac4a25ff2629f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872161, "uuid": "424eaa6d-4d87-4a6c-9bde-34b0a11f567b", "comment": "Malware payload (RaccoonStealer)", "value": "977f93ecd23782a1232275938ab8ccf8f1fd43eab6398c07277a3da7b4e22319", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872161, "uuid": "07393113-4fab-454c-a8ef-fa29019c7baa", "comment": "Malware payload (RaccoonStealer)", "value": "d52a49cfe59f820109312e2fe960abd874a4099a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872161, "uuid": "c952d112-89f5-4b32-85eb-c0e04f3e5e42", "comment": "Malware payload (RaccoonStealer)", "value": "1931990f519b9c70abe41fef16a54d9825dd494f6b3a9e3a3bab78ed659cab47e805c7147696aa10241118bc8d6909b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629872161, "uuid": "b31fa320-789d-4c0e-ad05-81d1f678c420", "value": "T174B4E0306AD1C034E9F651F459BA83BCB52D3AB0AB7540CF63E51AF916286E4EC30797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629872161, "uuid": "7d0ec7a3-6b9f-4b49-83d3-862adde94222", "value": "ddbb3eef631957f988f10b48742f9549", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629872161, "uuid": "33e7a53b-e5df-4295-a702-db9b61f4290e", "value": "12288:xijWisi/0WySX685bQT4qsGgpowP+BfTKpmSlwbmOGv:7i/0+A4agp32BfNSlYmOG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629872161, "uuid": "29a82404-269e-4bc9-a2e1-f598b615db1a", "value": 539648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629872161, "uuid": "e7e1a962-3ed0-41ca-a02e-fbfc74668c54", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629872161, "uuid": "64468826-bd43-487a-adcc-705d20c84291", "value": "68817aa183c3303868ac4a25ff2629f7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ae747a5-05bf-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629907996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629907996, "uuid": "abbbcae0-312f-422b-b831-cf4c1b844e39", "comment": "Malware payload (AgentTesla)", "value": "81122e3cc8c44d2b56be4db91f1c2566", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629907996, "uuid": "e79d259f-0848-41f2-9641-1a822d60aa9b", "comment": "Malware payload (AgentTesla)", "value": "97c708e7298dcce63e9fb22835bff60a2b25326dd928e1b8032794480013a31f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629907996, "uuid": "a0d143e1-84ad-4c6d-ad4b-91bec0f0da6e", "comment": "Malware payload (AgentTesla)", "value": "4f8bad5ac57e847ed88e4c3ccf224e0bd84aaa5f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629907996, "uuid": "325436d6-19e4-4199-90a8-11096496b8d2", "comment": "Malware payload (AgentTesla)", "value": "63027f46070f9f9619436f5ac7317e6ea61e22473d3c01e0e3992eeb06468f237e9dc3cb76ad752bce26edea7320bd9b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629907996, "uuid": "804910c9-6189-4541-842e-3f0c30e5a537", "value": "T10A25278DAC9C51CCE02D97D01B7286D4635ED7FF28062536B4ADF2722D5BA29DFA3804", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629907996, "uuid": "43af8da1-6ca7-430e-96eb-ad3bc1a617c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629907996, "uuid": "a90d59b6-c0c0-4501-8404-abba95c52146", "value": "6144:OQEPnqCJCLSEHwyjclpiXB1Ob9OloWUDnvupZZiwfm+dMKUQ/C0VKtaf03bgBFqk:R2J32oZMJ6Bgg16NiJMN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629907996, "uuid": "659e8458-f64c-401c-b22e-b0f6c9576a41", "value": 1003008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629907996, "uuid": "180af17a-39ae-49a1-a191-62fc3cc653b7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629907996, "uuid": "f81c1d77-4176-4dfb-9bdc-94e2d103e138", "value": "DHL_Aug 2021 at 1.M_9B7290_PDF.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd9ced8c-05de-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629921530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629921530, "uuid": "f04a5cd8-2eda-4006-b789-58b6a5371eff", "comment": "Malware payload", "value": "f432143eef13263ec5956b7db2242c2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629921530, "uuid": "924b3cb0-e8a6-4304-a458-140b950cf760", "comment": "Malware payload", "value": "98d74cdbcf31e2166ee1beca480bb0110278ab7ae76a5355d5fd6d63b909f101", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629921530, "uuid": "7fc4b374-5864-43c3-9a8d-37d3bf644326", "comment": "Malware payload", "value": "61cfba11d6e0ceac08a8e2afc43d0fd1afa8b9b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629921530, "uuid": "43d6dfaf-fc88-4dda-9510-00cc5bab6f69", "comment": "Malware payload", "value": "1018aaf5382622d8b3b0a43370464cded0413998f4538be16273558ddc677500625f25b651f5e81799967c601b64fd95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629921530, "uuid": "10a0ee87-38f3-400e-aa25-0c1df8977b41", "value": "T150A523A6364B56FEC45B25321AF6E69DE0FD3D336A72A103F7083D9E2A611424257F03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629921530, "uuid": "fda0ea46-db6d-4ec0-ab30-7b9ca585e559", "value": "dbb1eb5c3476069287a73206929932fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629921530, "uuid": "f6434e9f-d028-4420-9981-9bffadd359eb", "value": "49152:O9AmFHzPIldt9QFm0yfR0MRhYHAoniaq01LOXLtF81o:OCZldQyHhYbBd1L0XAo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629921530, "uuid": "a99affeb-44f3-4fc0-8f17-9584e8ed6fc0", "value": 2068915, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629921530, "uuid": "e426b89f-b721-43b3-86dd-f20b97418be1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629921530, "uuid": "23721add-c48f-469a-8321-70ff28ea516f", "value": "get.php.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c10920fd-0589-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1629884974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629884974, "uuid": "4c395428-0ede-4108-b1ad-53870380e5d7", "comment": "Malware payload (ArkeiStealer)", "value": "5a477a75b75da83db604c89a6d0a087d", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629884974, "uuid": "22f23676-bcc4-4777-be29-6df053e05987", "comment": "Malware payload (ArkeiStealer)", "value": "993d05a9ad2b7acff877ec8cb60f6e6aef61192d9843a3733789909bf9cf4d2d", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629884974, "uuid": "7ac03dda-40ae-474e-81dd-12c55e00239e", "comment": "Malware payload (ArkeiStealer)", "value": "83a55a12fb3951fef6c7d6e5fa518a65bd7b7a31", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629884974, "uuid": "8b05a30b-104e-4144-961f-a58406b1c172", "comment": "Malware payload (ArkeiStealer)", "value": "1c2ed8324dae8ef7495e8a2bac88e7c19c2a2ee87773c61968597c83f2323baf23eef2333de3a07197bcd8bfec4dab9f", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629884974, "uuid": "4fab7837-649f-4914-9041-560718630a3f", "value": "T175D4F130AAA1C034F5B211F855BA83BDB5393AB1677450CB63F126FE62386E4AC31757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629884974, "uuid": "976f598c-49ae-4190-a414-380a8d6398a6", "value": "b1f244737f482f7370a4248faac2bcb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629884974, "uuid": "6fc19511-9f05-4f22-901a-8d9a7c2559d8", "value": "12288:+z+VAPUnWIW4u8sSA00gaOMfzjwT7yXW35/jU4kS6QUndca6:aUnWuArg/MfzUTXljrkS6jndca6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629884974, "uuid": "e50a6e06-9872-48d6-9031-7e69a338f39d", "value": 624640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629884974, "uuid": "f77f44db-1da0-42b1-9411-30a5e58aaf79", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629884974, "uuid": "ee4c1ea3-8efe-49e4-a565-33b3878d0235", "value": "Wed07822bae91a1521.exe1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f55d1563-0564-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869171, "uuid": "9b5a3ddb-5a83-4659-aec1-f3f33c248c1b", "comment": "Malware payload (Dridex)", "value": "b022b36862b56d9da2303ffcbb4a67ab", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869171, "uuid": "2ff762d8-423b-4616-a066-7ac7e871bd6c", "comment": "Malware payload (Dridex)", "value": "999c5f5c362b730f9abaf43fe6f8a8e162c0f98ff9523f2e3fc22698ab5acb09", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869171, "uuid": "b42a81d4-87e9-4091-b953-fd7b575d9367", "comment": "Malware payload (Dridex)", "value": "e3af13c011041ca7acbe9c72f1307cf83d8fdc1e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869171, "uuid": "7b5e4c8c-54c4-4827-8450-0ee76afde733", "comment": "Malware payload (Dridex)", "value": "682ad236df782a8113f5f11766764f90141b5d511f8bb57efeb6381b48a0278886213ccf586921cd1356a14ebed06960", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869171, "uuid": "138cf1c7-c1ec-4d69-b9ae-f0d8d263a47b", "value": "T1F474121E89BBD87ACE864CFF8DBC14E273A78633C1A449C648C971DC2E1307A5559AC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869171, "uuid": "05ba6564-88f2-42b0-9b54-49feaa74ba40", "value": "6144:oWD8oGJwuWXO/J6t/VYfASkKTzZYwPMPFde/Qxx2u+OA+NT5AQ:F8v6X7ifASkKTzSwkPFduQx0uD+Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869171, "uuid": "79bb5554-2931-4a97-9a4f-e81bf7866a62", "value": 350615, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869171, "uuid": "73e86542-1770-42e9-86f2-4e2a0d8f296d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869171, "uuid": "d97729d2-2bfd-4fe7-90b5-1c67aa24761d", "value": "Details-01103_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6c96c37-0564-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629869173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869173, "uuid": "afb1691b-e80f-490e-a33e-db6662a1ffa7", "comment": "Malware payload", "value": "cb3874cfc9d1edeb86c2d3b14856a4ee", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869173, "uuid": "6f14ff65-e051-4366-9c92-f2c6315fc894", "comment": "Malware payload", "value": "99bdf26a2b704ac057a01d67854f08654dccec1145c784793d2a2a19f19bb3a0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869173, "uuid": "eb90b0f6-fbc3-47d7-8f68-200b0da095b5", "comment": "Malware payload", "value": "b26e7a014159d608c4c006dd20fde3c2ac2a1597", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869173, "uuid": "23112a66-abad-4add-a05d-9979a995cb40", "comment": "Malware payload", "value": "516f65e292d17e63ad8ed16e943957ff0d7e5c438d7421ce926b887e0c033cfe538f9cea84e9826be1c992d6504df617", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869173, "uuid": "9b733fb0-8d10-4ad8-8f89-387196bbbbcc", "value": "T10574123882F1C85CD94E403F91D74FB2DBB15A06A7C5771E92B1A70D9B03D3A8A6B09D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869173, "uuid": "63fded4e-d6e8-439b-8864-fe3283886b39", "value": "6144:o9PGVZyJwa2LohOGYw6CC5jTT453mjEIbWiGVAKSLFN+YInSCRvuPsxNFF:+dJwpL2OGY/TTy2jEIJc6FNu3uPmND", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869173, "uuid": "c91adc18-1c66-479a-bd17-2e4b37626a8d", "value": 362728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869173, "uuid": "8c069e2c-164b-41d0-9ecd-d410f0d2dde8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869173, "uuid": "66c7cf50-99c2-475f-b9e8-26e2e9e2c2a8", "value": "EoY_TAX_Notificaion-885406_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd87b123-0564-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869077, "uuid": "f9d4a0d7-88e9-41dd-b7b9-76c93b069553", "comment": "Malware payload (Dridex)", "value": "c9b81f7ea7055322512273aa1501e5f4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869077, "uuid": "42fd3fd8-d7a4-4feb-8ee2-6f4033ef7bdb", "comment": "Malware payload (Dridex)", "value": "99ca23cc10120110da72373e96842543e8983b5fa125acf662c89ada32b3c7b7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869077, "uuid": "4234d5f3-f7db-4f30-a74c-3dad5309fca4", "comment": "Malware payload (Dridex)", "value": "9302c3f4308ae78e802a0f036228824071655f33", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869077, "uuid": "8c9106b9-e8e0-4406-9b37-183f05d2dc2a", "comment": "Malware payload (Dridex)", "value": "7f10e85199654c16b7bb2a5a073dd6e3830103774ea567dbe510e06d836dfaf9f18aed0835af1f31b62c58fd4dae75ff", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869077, "uuid": "1754d196-9e6c-4155-967e-9e52b7b6f62e", "value": "T1AFE3E19B3533CA9CC02A923C45EE5E772FB88B9512E247571178F438AF268E7DB58118", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869077, "uuid": "4ea6030d-e176-4773-9550-a2be786cfebd", "value": "3072:oUiITwxSESp03tLOAzXX6Kp1i63LD6z2qoaaaaaaaaaaaaaaaaaaaaaaaaaaaaab:oxI8I03tyAbq8067MoaaaaaaaaaaaaaL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869077, "uuid": "9c32f231-f6d2-47c2-a0f4-15fc04b0041f", "value": 144646, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869077, "uuid": "054f0eb7-3152-4374-9dea-76522b166db8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869077, "uuid": "553e5a70-678c-4906-bef1-ad0ad8db06f6", "value": "Details-238735_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02f07016-0565-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869194, "uuid": "54f75d28-35ab-4532-9c52-00cf6244c2bc", "comment": "Malware payload (Dridex)", "value": "e8bf55ef26d48c220b838952d556b003", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869194, "uuid": "26b5dd69-3aef-4caa-8938-06e566929117", "comment": "Malware payload (Dridex)", "value": "9a60b0719e32df3d96a402f869c509ed0b630aa73ce11bfa7a0cb6e58c3a4d62", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869194, "uuid": "3e4b5aef-26fb-41cc-98dd-0270e361cb3c", "comment": "Malware payload (Dridex)", "value": "8f78bf4cf14ac19aba19ddb82a1150145eb653d1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869194, "uuid": "5f8608cf-1e8b-4a7f-9187-5506d3513751", "comment": "Malware payload (Dridex)", "value": "35addd05c7b6a5597669a4ca9413eff01c75a0db5c4b05b490656257dd2deff2f8b6f44b55a89f3de8f902014b7db402", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869194, "uuid": "d9225fbb-8c6b-4a6d-bbf3-fd47d0936c1f", "value": "T15EC3D0AA7072CA7DC12E933C56DE9EB72FB48B4442625706212CF56CBF635E7DB00129", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869194, "uuid": "196894c2-c2bb-47d6-b7c4-1a63a2b1e171", "value": "3072:oUo6ICafs/lj0I2nrBi63LD6z2qoaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa3Rk:oHJCEsNj0HnrI67MoaaaaaaaaaaaaaaJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869194, "uuid": "ee24acc6-d61c-4afb-a0e7-fb8f9271588d", "value": 119154, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869194, "uuid": "1d7d78bd-cd37-4899-940a-dd30acf48905", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869194, "uuid": "b0c15f9b-ffca-4415-938d-cb18f41f9a96", "value": "Details-07795563_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56ff2aec-05d5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1629917438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629917438, "uuid": "0ed4b4d8-ad23-408c-a55c-e18745d1052b", "comment": "Malware payload (AsyncRAT)", "value": "1177ecfa0e8843e2b468bf219b9f5a6e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629917438, "uuid": "a1f5aade-3e7c-4a09-87cd-e6b1de7a673a", "comment": "Malware payload (AsyncRAT)", "value": "9a8fd2998869405d6dd8a1e48d75c5bd072ab2768f80717b205115ec5303eb71", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629917438, "uuid": "90030033-4d68-42d0-a5a7-8f6e89e71358", "comment": "Malware payload (AsyncRAT)", "value": "07bebc09208f01142bbcb7baaf3eebb7c37f40af", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629917438, "uuid": "94166e2e-0293-456d-8b30-f95b0a601831", "comment": "Malware payload (AsyncRAT)", "value": "b17e9860e8ac420ca4662b99f6021dc3533df5c9afb76b462b20d6014be04a08355a7923c9ef884ac0adf8dc8af28fd7", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629917438, "uuid": "06498e58-7db5-4d87-b49e-6793d772cd59", "value": "T14B1267A593F801A7F6327E376CDBFD03A93635C31C29AA5D47428B192C22E16CDB1990", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629917438, "uuid": "ba243709-9ec7-43c8-b47b-f2f369a9322c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629917438, "uuid": "9334a979-74e7-470c-90dd-a6e770fa6883", "value": "192:FwgknpyLYtHniDUUUUUPUU7AiQceasxD1:F9EpyLYtHiDUUUUUPUUuJV1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629917438, "uuid": "7a1f33e7-f6d4-4f01-bc88-4a26cd1931e5", "value": 9216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629917438, "uuid": "614401b7-6693-47dc-9d76-0ebdd506f859", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629917438, "uuid": "c9e270ca-81d1-4de0-a14d-45b0248a0bdf", "value": "1177ecfa0e8843e2b468bf219b9f5a6e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ccaea02-056d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629872727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872727, "uuid": "c31be5f7-305a-4d9a-8b4e-88a1e467f066", "comment": "Malware payload (Mirai)", "value": "1c250dbde4617a29ed9362ab7661a19f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872727, "uuid": "5cee472f-061c-48dd-9e09-6416a94a83fd", "comment": "Malware payload (Mirai)", "value": "9ac701b37b400493ff92dc7ef9291af9829456acf2d379231b45cdd142498175", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872727, "uuid": "92bb7013-b4b0-43dc-8f3d-4b95f87cca5c", "comment": "Malware payload (Mirai)", "value": "2e7aef7e6922a564c6a0d8683aa90ec27da1df93", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872727, "uuid": "bfc77ea0-5d29-41a7-beaa-79f1f1826cfc", "comment": "Malware payload (Mirai)", "value": "98249bdb4b8a5fce64bd2f8614474e2a6bde5a0772038c246640bd5316457fdea46dd0a0eec58e54554fd3bbb39d4ab8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629872727, "uuid": "bf0e4b79-c5da-447b-baab-3956d8eb28b5", "value": "T15523022D1F12C53893E18D73F179C1A3B7E24BA954A0648A061045F7E6DF10EDED8747", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629872727, "uuid": "e9738623-b833-47e7-b174-0867c6b33437", "value": "768:0sz7QhccjSzR30dED9yYYBLgSUZeL1VSOqtbVpxxikhHXGMgvjQs3UozF:dDcjSh0A8zBxQeL1sOqtr+kdeRzF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629872727, "uuid": "631c853f-aefb-402f-b103-76d4068439a3", "value": 46756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629872727, "uuid": "c7cbaf90-22c9-475e-8f8a-cfafb1be2eaf", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629872727, "uuid": "1597e51c-4f75-4fbe-b313-462ca0abd69c", "value": "1c250dbde4617a29ed9362ab7661a19f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de47122e-0564-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869132, "uuid": "3d3c7c88-bd7b-4e9f-93c8-f7c21f4dcebc", "comment": "Malware payload (Dridex)", "value": "80a965f1f5b889db9d3368b9b9abc6e0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869132, "uuid": "388dab43-16a3-4625-8805-b043079308cc", "comment": "Malware payload (Dridex)", "value": "9ad54fe21026737bb876934163d8644c501d8f7fd056616a3ae17e4c9654a4d8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869132, "uuid": "35fcfb1d-3ac4-4624-9bcb-24555613fd76", "comment": "Malware payload (Dridex)", "value": "5c71cf47874f340e7f11429bdf202202c5700093", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869132, "uuid": "e9a7b15d-c328-4941-8edc-a90e48d13563", "comment": "Malware payload (Dridex)", "value": "74d9697c6b68bc7ce640d45454e5ae4269270999d43005492b8aaaf22e4a24c4ade0a7ad5d5111ed289adacb62f49806", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869132, "uuid": "c65b56dc-b106-4427-aaa3-6d0120008881", "value": "T16CD3E09E3522DE4CC53E973C44EE5E733BB48F4461A1171B2169F828AF239E7DB46209", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869132, "uuid": "54ed34ae-6bd4-4502-bff5-7283d25e590d", "value": "3072:oUzqzxDIrDnnz/viR7Yifi63LD6z2qoaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa9:oWQAj6g67MoaaaaaaaaaaaaaaaaaaaaZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869132, "uuid": "fa00b538-ef7a-4008-8743-9a364d88c73b", "value": 140112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869132, "uuid": "a5bdebd4-752b-4b21-8fc2-fbab3addbee8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869132, "uuid": "32c25145-3995-454e-8127-57149dc5c653", "value": "Details-148575063_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5326d91a-058e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1629886938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629886938, "uuid": "af1f22c7-712a-450b-89fa-465086c75fb8", "comment": "Malware payload (RemcosRAT)", "value": "25fbd65bf5c530521de378c27f794a14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629886938, "uuid": "c4b2bd51-76e5-4ba2-833e-aa66ec09b4b2", "comment": "Malware payload (RemcosRAT)", "value": "9b230ecb2de41faed1f6977799a2e7e03f4411fefbcf2e8b2e92a989f6bdd685", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629886938, "uuid": "6e491a40-36c7-47a5-96f9-db836e052540", "comment": "Malware payload (RemcosRAT)", "value": "96d4139816ca2c6bda73d32d2cb875ce2214e983", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629886938, "uuid": "510c02e6-0fb2-4fb6-a0c9-e2b79db8ea78", "comment": "Malware payload (RemcosRAT)", "value": "288bf8eb64e626051a7bfe7d2ce8c38997a7e48962de9403a1f44dc2c00e10e461e20e4ad76a0fcd90ca1f391d1c1509", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629886938, "uuid": "f863f615-6cda-49d9-99a6-856533404de7", "value": "T1C1F47CA7FCAD45FBD25715368C569FA89473AE127A09A84227F4780CEF7C321743422B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629886938, "uuid": "3c8a0f21-3e07-4512-93a3-060966472aaf", "value": "95ca75521f0d84796bcc75c19eb91d03", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629886938, "uuid": "822d9e49-be16-4458-80c2-9fea70c164c0", "value": "12288:HG0z7gLLMuRN/tMvdEAwM3nrkaoUfpACXDoVttivrl45g1+yVt:HfzMzRxtMEqAP0iCXDvvrlQ8xV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629886938, "uuid": "dc5616a6-66ce-4bab-89df-c3bb3b3e2273", "value": 757760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629886938, "uuid": "622fbaa1-8429-4236-84da-640b7be5ac54", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629886938, "uuid": "0b58907b-74e3-420c-a54e-6a0b20e62258", "value": "Urgent RFQ_AP65425652_032421,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09d8a5cf-0565-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869205, "uuid": "9b8d2e17-377c-4101-a092-cc566a1d8c80", "comment": "Malware payload (Dridex)", "value": "f96bb6ad94a93f11b7ee2573ca12fc59", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869205, "uuid": "cbddb607-4da4-4954-8d31-f800162344c4", "comment": "Malware payload (Dridex)", "value": "9bbc73e7a3ff9e02bb72e6f4f1cbdddc0a479f9d76e68118b54a89ce478ca1cd", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869205, "uuid": "355d3a9e-aa0d-4be6-ab85-b07a269bd7e1", "comment": "Malware payload (Dridex)", "value": "e01514e7fc0bcc63740b54f63a2aeb3f75ed3e58", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869205, "uuid": "ecdb42a8-1747-4974-9f56-76e0b51cad3f", "comment": "Malware payload (Dridex)", "value": "ddb665ffaa20e4a3edccfa89dd6ecd998eb2dafef54af3b4c84e656ee2f8f33a6bd968422211e1188ffb3d4084b17efb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869205, "uuid": "41fd373d-dab8-4263-9b18-1a6e16c0da49", "value": "T185B3D0A67273DAACC03D423C95EF9FB77BF44B8557A25206026CF42CAF225A39F51019", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869205, "uuid": "3d19bed8-9f4a-4200-b41a-e471cdbdde3c", "value": "3072:oUpuwTFU17LXELEi63LD6z2qoaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa3RY3Pj:oS9TY7mF67MoaaaaaaaaaaaaaaaaaaaI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869205, "uuid": "0e7fec4e-75a4-4a1c-9e40-3a41f0eeb918", "value": 110920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869205, "uuid": "91e361cd-daa9-4bc7-aa21-a3d7bc4c080c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869205, "uuid": "ff8a01d6-9342-4eb2-a5d4-49f8960dfa16", "value": "Scan-50157_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c435e3ca-0541-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629854056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629854056, "uuid": "9739d51b-fa2c-43b8-a127-6a72322f9bea", "comment": "Malware payload", "value": "be96bc81faa3e75205ee83fa7043a0c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629854056, "uuid": "654545f7-ead7-4baf-ab72-a502e081971a", "comment": "Malware payload", "value": "9cd9c5ac40c0f03d57430fce91255be7be9a7d1881dcedf9d48a79bae51e91d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629854056, "uuid": "d35cba0a-516d-41a9-accf-2ffd3372e3f9", "comment": "Malware payload", "value": "677d9a9a53e1d4fcc75162e3a6189da1f5db44ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629854056, "uuid": "3cd6c29f-a9e4-4f3b-a57c-91707a8c2094", "comment": "Malware payload", "value": "c8b4a7a24395b47283360a1e421f4419aa44358443df25aa71275c9ea1b3faf38e6f563034999182c1c7ec66c3716850", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629854056, "uuid": "7af29729-732e-465f-8b61-8bfc53a6aa72", "value": "T10ED633BDBAAA4D82C50777F40184D58C97F3407A3520CA99D8A671EA3F86B87EC1F417", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629854056, "uuid": "295a8e89-7587-4b54-bbe8-053ceaae75b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629854056, "uuid": "4dfa6276-b72c-4c69-9056-32465f5b06ec", "value": "196608:hkqnYXCQzR7a8IPnJzadcbMulGiQKCoGhMVZxcey3ixxSkWdj++16:hk8YLF7GPJzadkMuzCoJxceyyZWdjD6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629854056, "uuid": "0b2254d6-7da3-4be7-a265-f8059f18ce3e", "value": 13629952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629854056, "uuid": "163e03ba-e578-4230-bd0f-bc7f2379d12c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629854056, "uuid": "4803cdc2-6ccd-4604-a9b6-ccae46c61d3e", "value": "Strip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5973ea18-0572-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629874922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629874922, "uuid": "daf4f958-7c59-4c3d-b673-210759606e33", "comment": "Malware payload (RaccoonStealer)", "value": "86bcdfa605349d0f0bf37b03182293a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629874922, "uuid": "170a7432-6c7f-4d80-bf7e-15089603d636", "comment": "Malware payload (RaccoonStealer)", "value": "9d63d50505f69c1653c84333ea9e08974a740ce52be2626c39ac5f27565d765b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629874922, "uuid": "68475e09-fdd1-4061-8baf-19a74f19eeda", "comment": "Malware payload (RaccoonStealer)", "value": "3f22f8b5d54448c8d1a3207c310cef7c13cded68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629874922, "uuid": "a9b25bd7-cd7e-43ba-b00d-7204b4d0b209", "comment": "Malware payload (RaccoonStealer)", "value": "0d530c05d4727247b10456f500ced63712b91063719821981037b3fa976201220a946d0b5a3280acb04aaed3a5e5644b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629874922, "uuid": "33e5cd0c-35e8-45b2-80a8-fb2a70d875a3", "value": "T110A412017E60C977CA2541B20D61CAA8EB7BB9544A7647873FE86F6F1F742D0391B382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629874922, "uuid": "4170860e-267e-4896-8a34-7bd43a27be80", "value": "bd3c9edf948deca79ee5e78523f1a042", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629874922, "uuid": "ae268fe6-de5c-4eb3-af95-c6f58c19310e", "value": "12288:VxH4sPq9WO4eG2YL3Cy5NJPVNWGd/RSi0VEyGvcF:VxH4sPqMde6V5LjW8H0WS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629874922, "uuid": "db3d598e-0f16-4e6e-8efc-7841a541e791", "value": 467456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629874922, "uuid": "19108ca7-402a-4d7b-925e-070be97ccc98", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629874922, "uuid": "8a553781-a608-4541-9e60-71be7c9c820d", "value": "86bcdfa605349d0f0bf37b03182293a7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b8f5523-0589-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629884831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629884831, "uuid": "1b8eeea4-6af0-4ff6-9185-f26ca372db7f", "comment": "Malware payload (RaccoonStealer)", "value": "9fee6ab45edd8c66f946c8c6badd9c38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629884831, "uuid": "b0ea6185-4871-4231-b980-2040a0dc7777", "comment": "Malware payload (RaccoonStealer)", "value": "9dfbcff1c5605c693056996f862431e025862eb0bcc7ac3231fdc89854b4bf08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629884831, "uuid": "46f2e965-5475-43a4-8028-a0050c1b44e3", "comment": "Malware payload (RaccoonStealer)", "value": "68ad57a10ef40fc01429c7928f9c50875973ac28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629884831, "uuid": "97b149a9-2f1f-4524-b2e9-388ad7b619ea", "comment": "Malware payload (RaccoonStealer)", "value": "058d1d1874371d7380a452634f4a97fa6dd02e451dc5d9ebde14912129d7c4b8bfe5602fe53a616e09b3e3d3b99536f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629884831, "uuid": "b1d8062b-6a8b-4215-9dc5-7e5b2568bef1", "value": "T1B8B4D020AA91C035E4F712F849B693BCB53A7AB15B3410CF92D926EE13345E9EC3175B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629884831, "uuid": "71dcb062-e095-4268-bf7a-a3315c04a28f", "value": "35372ade599ee63db174ac99307517b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629884831, "uuid": "0e2451ed-6f1e-44c9-9249-19f2f266a0fa", "value": "12288:ov8L1RQRIocIL+I6a+AMXnw6XQ501wJJYkDvyKwDXF:r1RQ8I6RDXnNg57Dv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629884831, "uuid": "4473b0ca-07f0-457c-b728-b0119715a16c", "value": 532480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629884831, "uuid": "75d1dfa4-f61c-454e-b90e-e55e742c6046", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629884831, "uuid": "81c75ea4-cb02-4c35-b163-02399283cb38", "value": "9fee6ab45edd8c66f946c8c6badd9c38.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b13d80b6-0582-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1629881941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629881941, "uuid": "a74dc77b-9d9a-430e-88d1-a7f1e114eefe", "comment": "Malware payload (RemcosRAT)", "value": "380b5cef1ab6152e0b08c3dc34bb8dbe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629881941, "uuid": "3754961b-5053-48d7-a657-1fadc654d47c", "comment": "Malware payload (RemcosRAT)", "value": "9f0c13034df95e3af02c98c025e517e4648c5a229217533f936cf811f61995e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629881941, "uuid": "3bd23817-6b95-488b-9715-af2f1077b568", "comment": "Malware payload (RemcosRAT)", "value": "75295cf8b49f8329081c7a3d3ef17e706db622b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629881941, "uuid": "8b9dc63f-c738-4c81-9b01-c06ecdf781a4", "comment": "Malware payload (RemcosRAT)", "value": "a8314ccccd48e9e72b9662a91854e0553299086f114dd68d3100018afde5c46d2d417d3fb58f094627bc64a26bb04bfe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629881941, "uuid": "0ae9be8b-4f4a-4e26-81c6-ded698fb91e0", "value": "T18EF48EE33DBD44B7F3C158B98DA78B725619BF0236B4BC8516E43D8CEB7AB001895192", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629881941, "uuid": "3f6f8d05-fa10-4bc9-92d8-46d40a912e2a", "value": "95ca75521f0d84796bcc75c19eb91d03", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629881941, "uuid": "03bda8c2-9122-40b9-b965-09d99c3f6acc", "value": "12288:HG0z7gLLMuRN/tMvdEAwM3nrkaoUfpACXDoVttivrlQ5g1+yVt:HfzMzRxtMEqAP0iCXDvvrlY8xV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629881941, "uuid": "831ea494-16d8-47ba-8d5e-a3fb4a07ce2f", "value": 757760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629881941, "uuid": "82768e80-bfdf-448e-902b-46519af051f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629881941, "uuid": "3e324824-d062-4fe8-bc7f-f9e4a2c1b801", "value": "RFQ_EW14416 Novi poredak,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e912097f-0564-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869150, "uuid": "130a09e3-0f3e-4c0f-8051-c9936c377e00", "comment": "Malware payload (Dridex)", "value": "8698a1c8193ceb1ffc794765ad352071", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869150, "uuid": "1ca186af-a842-44fc-b640-0e065cc9c323", "comment": "Malware payload (Dridex)", "value": "9fe3300212bcdbba2d67e270808735d17d9311f6b0076edf8b00b354fe5d4f65", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869150, "uuid": "9fae6e70-56b7-470b-86c8-3c0831fad84f", "comment": "Malware payload (Dridex)", "value": "6961071be47540d894e3d268e9bc2f8af6fc692e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869150, "uuid": "1043e5eb-43aa-486e-a39f-e5f694f05e64", "comment": "Malware payload (Dridex)", "value": "2e4f5fd781f835d9e67821fc5610101ecf0d9afc4feb280cbc01fe9cc0182e34ac7e86897f7aa21c566d4e442f229115", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869150, "uuid": "dc69ea02-4160-4ac4-a9da-5ac0969f1f60", "value": "T1A8740209C9F3E87ACE4A08FF4D7814E173A78637D59149DA48D4709C2FA207A925AFC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869150, "uuid": "d9d1a63b-fe82-4de5-816d-3b0df8553c5d", "value": "6144:oWi2C8rVDAKHXO/J6t/VYfASkKTzZYwPMPFde/Qxx2u+OA+NT5AVbCbD:1i2C8rpHX7ifASkKTzSwkPFduQx0uD+o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869150, "uuid": "ddc4401e-0bdf-4c7b-924d-e8380c2d8810", "value": 346741, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869150, "uuid": "b05423da-dab3-434a-b9e0-31fee736efbf", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869150, "uuid": "81b96bd6-625a-49a5-9196-f19154db4cb6", "value": "Invoice-75322_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e671451b-0564-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869146, "uuid": "91ce7bb7-ae76-410d-a01c-49a7f199e3a6", "comment": "Malware payload (Dridex)", "value": "9b870b29feb59e068e36322768028a0b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869146, "uuid": "e6babb19-5c22-411c-bfc9-d17ad5d90510", "comment": "Malware payload (Dridex)", "value": "a28ad733503ce285489c9e997a320b1e411e5990242bc77fbf70393820c501e8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869146, "uuid": "8e11a029-9163-4669-8e3c-c57a45183733", "comment": "Malware payload (Dridex)", "value": "69e76a29393347424053a21da9a6a52c681ec7bd", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869146, "uuid": "ceb33425-b08d-48dc-8efa-84e80bb3f92a", "comment": "Malware payload (Dridex)", "value": "0605a4eecf3b31b7b69750594b9ac567b1d22fcb49ca163c99404c644c14aff160d7c4f430ccae4dfc63567abb2c5e74", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869146, "uuid": "21f40004-3016-481a-bf6f-26d18e458f1e", "value": "T1ABB3CF9A7632CA9DC53C933C80EF5FB76BB48B812192570A513CE91CAF221D7DF40259", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869146, "uuid": "7ef39403-3439-4e57-b599-df8456202756", "value": "3072:oU9EllrwW1aji63LD6z2qoaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa3RY3Paaax:oIEbn767Moaaaaaaaaaaaaaaaaaaaaa5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869146, "uuid": "55bea944-6ea3-4757-8bea-5dd3f0b1e9cb", "value": 110844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869146, "uuid": "6553672e-e3d6-488b-ada7-77a99a43254a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869146, "uuid": "48401c47-69a8-4011-a9ea-a4e5aee52329", "value": "Scan-6615_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db05b86b-0570-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629874281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629874281, "uuid": "f6eb7e20-ab3f-43d5-8cec-814c557c84c6", "comment": "Malware payload (RaccoonStealer)", "value": "f493e9377ec11f1854eed4ad76991b4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629874281, "uuid": "3972a358-41dd-4c30-80f7-b70b34e931a6", "comment": "Malware payload (RaccoonStealer)", "value": "a38ab2981af3a4b092722586161bd010b62843fde5b70db6ffdaf21f62bbf3bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629874281, "uuid": "6973ce11-dd3d-43fb-9718-b0e491a8bacb", "comment": "Malware payload (RaccoonStealer)", "value": "e7bee19e8244032b2ae0bb4acc2a7b3741d4789c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629874281, "uuid": "350ea4dc-5ebf-4b8c-9579-f51f5232628d", "comment": "Malware payload (RaccoonStealer)", "value": "f1c1dc535b4703fe1b5f354a217e99785056f334a46c361992775b80b253460a8115c5927671fd4b001cf86b40053f21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629874281, "uuid": "283530a5-85bc-4456-8099-15ddaa8e4cd8", "value": "T18EA412C0BEA0C8B7D56181774CA1C951A73E79942C6046833BE6EFAF2E667D076132C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629874281, "uuid": "2d39d0bd-f5a0-4e42-a7a9-89039fdcc0c9", "value": "bd3c9edf948deca79ee5e78523f1a042", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629874281, "uuid": "9bb4794a-be98-486a-b162-6fc943f33482", "value": "6144:jYmldq0/7DOC78uZB2Q4Y4iyBrhUQbds8gl3HN4l8mS4MFHYNgWfk2cxb:jegKVu/4lfhUQ1gHNt4MuNbvcF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629874281, "uuid": "c24d1907-d52f-4fab-80ce-d215c5c8f05c", "value": 467456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629874281, "uuid": "65829fdc-ca2b-44b4-b537-622848ac655a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629874281, "uuid": "46001572-4028-47aa-bd53-1232885ec7df", "value": "f493e9377ec11f1854eed4ad76991b4d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af05ca29-05cf-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1629915009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629915009, "uuid": "2fb72d35-d0af-4674-9cff-52d115e9c032", "comment": "Malware payload (AsyncRAT)", "value": "16c018fdff00cce26e92fe0a07d00ab2", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629915009, "uuid": "346be72e-0f83-4df3-96b0-736c7b7b6744", "comment": "Malware payload (AsyncRAT)", "value": "a3b2cafa928f4fb6d88fe1988d38ae5c7a5323f65739925394d4b641bca02f49", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629915009, "uuid": "a5bcc138-8906-4aeb-ac0c-480edfbfa5d8", "comment": "Malware payload (AsyncRAT)", "value": "c5193427c4536baad43300b9dd1f0e2f26f8962d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629915009, "uuid": "56b1451f-6555-4dba-a149-4cc054db2c2b", "comment": "Malware payload (AsyncRAT)", "value": "e135b276c07a10266017d0db389a67e4d93ec2bb21f3b4ba29dcfb2c2b118758c2a6bc16c66110a9192c2cb1368d9641", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629915009, "uuid": "4a0b9bce-fe7f-4978-a854-02f37e4af877", "value": "T152A4F4919EEFDECEC26F323FA40A4D8214DEC7060757A2E48B464E35B7905239D661E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629915009, "uuid": "56367fdc-ecc3-4484-bc2b-9e27d01995a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629915009, "uuid": "5abf3ebf-e455-453f-94b0-f44e43ad3618", "value": "12288:O8xsa+taaa5T5DBx8nLugc/y9EwyWGkYQk7:Ov1taVNBxw6y9oQk7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629915009, "uuid": "3dfcb407-9bf0-4fd2-9f6d-02b84fd996b5", "value": 456192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629915009, "uuid": "b3c86dbd-407e-4412-9f61-6d180b781597", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629915009, "uuid": "5e456b7a-74e3-4e36-b82f-81b560cf80dc", "value": "16c018fdff00cce26e92fe0a07d00ab2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "892d9e3a-059a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1629892182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892182, "uuid": "50bb0dc3-79f5-4cb5-a248-e16d1ecfb823", "comment": "Malware payload (RemcosRAT)", "value": "332c970b02124fbcb67ba1034e6fb4a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892182, "uuid": "2f6dfa51-b99a-4305-8088-1da4846c457b", "comment": "Malware payload (RemcosRAT)", "value": "a3dbda9e244c0a7a63e9d669c838c9c290fd8bca5b1d35fa7add5a1950f578bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892182, "uuid": "5eede472-e5c0-4566-a0e4-56b7d848ea29", "comment": "Malware payload (RemcosRAT)", "value": "6cb0743daf97a603c56662fc674a08582c47ddad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892182, "uuid": "40289075-9ee1-4920-898e-94bf4b74784d", "comment": "Malware payload (RemcosRAT)", "value": "daa724bd92f9cb073e2e09dd96747f0d67b6bfd67b429e8d80496803905acbdfba4d529d86d65341ecaf46d1e97725a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892182, "uuid": "89965785-9e4b-426e-85b8-2ae2d82c1520", "value": "T182F46C27EEEC4437C21724399E664EA2993A7EE835157B091BF0BD4ECE79301749A4C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892182, "uuid": "9e58ab40-07c2-41cf-838c-102619441e9d", "value": "95ca75521f0d84796bcc75c19eb91d03", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892182, "uuid": "9176c9b2-1e3b-428c-b787-bc1dafcfdd28", "value": "12288:HG0z7gLLMuRN/tMvdEAwM3nrkaoUfpACXDoVttivrlM5g1+yVt:HfzMzRxtMEqAP0iCXDvvrlc8xV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629892182, "uuid": "5461ac06-f29e-41fc-be14-fbe8783ec76d", "value": 757760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629892182, "uuid": "90ea0b47-e0f9-492b-9c51-4c54d8c4e12a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892182, "uuid": "1e811318-235b-4102-a272-5a02e3b205e1", "value": "RFQ_AP65425652_032421 dringend,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92e495ee-05b5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NetSupport)", "timestamp": 1629903795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629903795, "uuid": "e4282157-ad89-4fbb-b524-1c7b85c4134f", "comment": "Malware payload (NetSupport)", "value": "8e0bad4368699d031fe5ae4ced5ca7fb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629903795, "uuid": "af50db11-f181-4fb8-bfdb-c6a16bf82f49", "comment": "Malware payload (NetSupport)", "value": "a44f2174ec2ff1dacca5ef9e4f30705bd95930a4153adb7e4b8f30ef7d586551", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629903795, "uuid": "fc76916a-61b3-4582-a1aa-d041e25b5070", "comment": "Malware payload (NetSupport)", "value": "62429e7ff3449395218d8a4a296374465ebfb172", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629903795, "uuid": "2a29b75c-4420-49c9-9942-ac6f473c4a31", "comment": "Malware payload (NetSupport)", "value": "401189e05cabdd20a14e2b4f673c72a188439a252b470a8243d0ef676adcb48ce450d6f00c8112aac2ad841f341ea524", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629903795, "uuid": "a55c1fca-1801-427e-8ed5-520290fcb8f8", "value": "T1EE6318D43791E40366CD1A83BF15BDEDF12AA8B659C8A603C6A47E9C24BD407C6B4DF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629903795, "uuid": "3b57637c-9280-4717-be42-35d269364a57", "value": "1536:S1ejjocIPANHkM9laVS83yvXkwcDROfQl:Sz5P2EOaVS8CvXFfQl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629903795, "uuid": "cb50c3f1-4928-4f2f-a0ba-078fb941cdb1", "value": 66947, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629903795, "uuid": "b79c8cb0-0fc3-489c-bcc7-ad5608b6dc5b", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629903795, "uuid": "c1e771e7-42d0-4cde-bd0d-34da45c9b141", "value": "document.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d265999b-05ba-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629906049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629906049, "uuid": "f405e1df-aa04-40f8-a012-a269d3f3728e", "comment": "Malware payload (Dridex)", "value": "8f61479cf0003dd2af9bdc1ca1d09791", "object_relation": "md5", "Tag": [ { "name": "22202", "colour": "#655FAE", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629906049, "uuid": "f8b31ead-dc2b-4fe2-b1f1-27af733b9170", "comment": "Malware payload (Dridex)", "value": "a484ce1a1ed13cfee6d1ffe86397f5241bde9d781dc25e7347bde0f5f42c85ba", "object_relation": "sha256", "Tag": [ { "name": "22202", "colour": "#655FAE", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629906049, "uuid": "5aa422f5-d73e-4e49-acb8-4151197d43a2", "comment": "Malware payload (Dridex)", "value": "1ee568a321f9ee682602f064524065d7c8f955c4", "object_relation": "sha1", "Tag": [ { "name": "22202", "colour": "#655FAE", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629906049, "uuid": "259395fb-053e-47ba-bbd5-f82cf4c93195", "comment": "Malware payload (Dridex)", "value": "10a10bd5f0dc7179590077e6e97751c280c2fd6ca6218516b6d3df5c022f87fe297847d8a1e9d6a33b2dc63e3e38d77b", "object_relation": "sha3-384", "Tag": [ { "name": "22202", "colour": "#655FAE", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629906049, "uuid": "927b7ce3-8529-4179-8c4d-69f18152f3f4", "value": "T119341202C9F37868D91D417540EF1BD6DB811B998250FB4FD6E0B2A43FC91E9FA046AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629906049, "uuid": "94a08437-037c-453c-b3b4-c6cbfb026112", "value": "6144:oO6syniWYRBg+oxpp/g0q+8TsU7AY5LrasAoXNg:D6synJ4Bl0I078TstBsAgg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629906049, "uuid": "addce05d-b34d-478b-bec2-3a471bebe8f2", "value": 244701, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629906049, "uuid": "0ee7553c-a6e7-49cd-8fe9-1bb2134e6b7e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629906049, "uuid": "b7fba59c-b20b-4733-91cc-6f25bd584ffe", "value": "Invoice_Due-IN-1024_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96fb0a92-0576-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629876743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629876743, "uuid": "248d1ede-e36e-4b98-a40c-1ac61c59f9ca", "comment": "Malware payload (Loki)", "value": "256c0f80e6b94ab97d677ca562bb6fa6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629876743, "uuid": "02b8bd56-2a5c-446a-bcc8-9555d6b6f010", "comment": "Malware payload (Loki)", "value": "a4bbac6b142c63da7c64937cc5beda93009b5be72481e98d514d62ee29801b12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629876743, "uuid": "f7160fb0-9707-4e1e-aed4-95a52202e6a1", "comment": "Malware payload (Loki)", "value": "364eefcea93d7d4315c4e62e56c3f99063ea4106", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629876743, "uuid": "48d9f0b4-cc30-4e3a-9f34-83114357d3d4", "comment": "Malware payload (Loki)", "value": "ab528e053aaa3fb6ff1ea0d58c67597e0f266a43964b7f61fb9d4a128fab2cd869224af704b847d0d8fa0ec67b151c2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629876743, "uuid": "479a1c7b-48e2-4ba1-a6e0-6d69ce50fb9d", "value": "T1C1240246719C7364C941A33E25091C45EA06FDD9A3B8FDF3A993B4A802BFD7888F5172", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629876743, "uuid": "6d79a8ef-3af7-45c3-ade0-ddadf6517718", "value": "35807dcde258f88fa3ce5c21adc607fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629876743, "uuid": "1036d63e-a028-4842-a14c-9db5449e9bf2", "value": "3072:bsNDx0HQJJdrGKJxLAITWYtop/nqsXYeMZiYEQ6B7YV5k3eLGtvMy2+Uf7pdh:bIJLGGOI98Pl3MUYEJMV5k3eytfL8j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629876743, "uuid": "24d52145-16d1-4607-852f-5fca2369a1b3", "value": 230048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629876743, "uuid": "613119c2-fd98-493e-8c8f-5ac13075b345", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629876743, "uuid": "c46b42ba-6fb2-4162-b179-9dc6a8392f2e", "value": "256c0f80e6b94ab97d677ca562bb6fa6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28aa0edf-056d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629872693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872693, "uuid": "778f6cd4-f90e-4972-a4a4-788be789f5b8", "comment": "Malware payload (Mirai)", "value": "c65705fc87475c244da86137310e0f2e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872693, "uuid": "13191295-b4b6-480e-afdb-16e72fe2d503", "comment": "Malware payload (Mirai)", "value": "a6793692c3759c0a93dd33df9b599ddc7e9219b24a443747059836ce5408dbc4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872693, "uuid": "962f6ebf-63be-43a7-9719-24bad416f4be", "comment": "Malware payload (Mirai)", "value": "8935c0ba80796264dcd049566e316d2fe31ce1c4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872693, "uuid": "ff96f8f4-7d48-4d1f-a119-08289ad2e386", "comment": "Malware payload (Mirai)", "value": "94004c65b5a9a619be70d39ad5b0effac9e950f988bcd8d77698402cf019fbad96ccc0e5582a546a181ab4549a503a7b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629872693, "uuid": "bf56cf55-194b-4886-8e5c-36a56d584236", "value": "T1CF23F1905768AF72E0309A7597E18DC6525B63A5A4E3708BEF0CB4F4AD5418AC0FD2CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629872693, "uuid": "9d69fc85-12e6-415a-9a76-54b1102745e1", "value": "768:v/ASkwic2njbfJykD1ILze/tzVCsGSGjTyV6+XLpaT0w3QX1jNoHqI8s3Uozg:nAKi3n3Pp/tJzGh6LpDvj2qI5zg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629872693, "uuid": "434ded57-7673-436b-b189-e04b2f4b4c7a", "value": 46764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629872693, "uuid": "b6ef76d3-b376-45f4-9848-675b4f66dc05", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629872693, "uuid": "6f2c9a67-2888-4d80-8732-13a72a01110c", "value": "c65705fc87475c244da86137310e0f2e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a15603b-0582-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629881795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629881795, "uuid": "9c88da39-c542-41f4-9872-cff10466e866", "comment": "Malware payload (RaccoonStealer)", "value": "a512da24e861e97025eeea48a1222ff8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629881795, "uuid": "e7dd4f74-d0aa-4321-bbc7-1d12d8e6f3b3", "comment": "Malware payload (RaccoonStealer)", "value": "a6d5c07284e688a58b9eed0c6f44c2d846c6ef6e182b41ba19d6427aaf55239c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629881795, "uuid": "e57e7f8c-001c-4b6e-b75c-d528af7b44c6", "comment": "Malware payload (RaccoonStealer)", "value": "a7811bebd6c28906ee7416c5d267502a84e18c6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629881795, "uuid": "422d58db-62f5-46ae-bdf5-3e331408e385", "comment": "Malware payload (RaccoonStealer)", "value": "346719b628cefc6d07c8a138682024bc634911662818c919eb4453ff43ce05b2b3f895f8c5a4565bb409f4cf10b5b69f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629881795, "uuid": "fbef4b2a-89a8-44d5-a91a-ee2f33d03222", "value": "T16CB4D030AA91C035E0F351F859BA82ACB43D7AB05B7450CB63E626F95734AE4EC3175B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629881795, "uuid": "7b66a898-8be3-4b75-b1c1-3e416e5a5862", "value": "1f6e2c775b734b85a15accb3c4cb4a32", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629881795, "uuid": "57537a9d-7c2f-4b12-9b41-24f328c2f870", "value": "12288:Sw9CFwvniwE5xneMTM6FdllJdTX/9/Hh31sFk3p:GFwqf7dllHxZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629881795, "uuid": "a0abd9cd-9044-4484-be5b-dfb4bbd33239", "value": 534016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629881795, "uuid": "4d98a777-c0ca-4786-87c1-e62b4559ff60", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629881795, "uuid": "bcdc74e8-c975-4e8c-b982-44a89c3bd1c1", "value": "a512da24e861e97025eeea48a1222ff8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0470c3b1-0565-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869196, "uuid": "dcf7af5b-0b92-49a8-8f12-1a1b233870dd", "comment": "Malware payload (Dridex)", "value": "c3b98da917bab86ac4bf76209067e249", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869196, "uuid": "7474b30d-8b3f-4489-8ac9-798a9d19f8bc", "comment": "Malware payload (Dridex)", "value": "a7b947b431b98989d962e5256cdcb9c0acad62a4ca2a760b004993d232a57b14", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869196, "uuid": "398e4675-6ba3-44c1-b175-7c93c2b1129e", "comment": "Malware payload (Dridex)", "value": "e3ead4ac71129fdaeb7ce6e40bf5f4ee60e9d155", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869196, "uuid": "2d07edbb-9bca-4897-ba02-da8e3778fe99", "comment": "Malware payload (Dridex)", "value": "3aaddfec7743ea673fd81bd6af95c34b17d1841ff506453bf4c57dbb2e39e26721f43be789ec28edc69842c68e9f7785", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869196, "uuid": "f8a85c7b-7eca-4206-96c5-3c3a6f5316c1", "value": "T15B74126893E5C81CC84F403F61D70F72EB722A0596827B1F95B2A70D5F13D7E4B6A0A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869196, "uuid": "63c5a6da-0e52-48e3-b673-13a6dfda9fdb", "value": "6144:of7/WANuYM72LohOGYw6CC5jTT453mjEIbWiGVAKSLFN+YInSCRvuPsxN3H:e7xNucL2OGY/TTy2jEIJc6FNu3uPmN3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869196, "uuid": "37d837d1-05af-4fe3-a004-1d421c8dc79d", "value": 354548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869196, "uuid": "45fd4099-8bab-497e-a362-1ef9a582d617", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869196, "uuid": "0dac6623-5e51-4105-961e-5484d38ecd0d", "value": "EoY_TAX_Details-157152_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bea5c5e-059c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629892858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892858, "uuid": "ea3e419a-28b4-4c83-a5f7-34ecf05d0e6f", "comment": "Malware payload (RedLineStealer)", "value": "66ed7911b556dc812d083cc4717aa6a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892858, "uuid": "69bd20fa-f1a2-4994-82f5-9ff94ee23b69", "comment": "Malware payload (RedLineStealer)", "value": "a8434f68a31083c67359af9407aa3b54503d42974b46679125464605581fea9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892858, "uuid": "7a65f72b-57dc-43cc-90a4-ddd53192544e", "comment": "Malware payload (RedLineStealer)", "value": "2868a9e3f7929cd5dcc835d8d8366eb5adc7885c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892858, "uuid": "744b20b2-003d-4b86-a3e5-23fd0ffa5753", "comment": "Malware payload (RedLineStealer)", "value": "83ab70cc2bbaa75a3bd9170f0fa566a88157123405eb59ccf43847314adaac18af17cc81988d4e47732f45b5bd46e599", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892858, "uuid": "070a4a46-5ef7-418e-a347-416d68ef9d5d", "value": "T171168E722ACB91DFC9BA0836DA02AD5FA678A7F1D514D0E2FD983CBC8416F4508D136D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892858, "uuid": "54a643e5-2d1f-4d55-86f2-518dc06c4d7f", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892858, "uuid": "df6d2aa9-36bc-49ac-a7ae-d0a9047db4a1", "value": "98304:XhAQ1tWEJSsDqTgBndBx7svxuEy1pe+GsYjqx:XhAmtVJ+4nbKvxByqvjq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629892858, "uuid": "2d97379e-f82b-4889-9dd1-edcaf1244872", "value": 4176568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629892858, "uuid": "535b31f3-2f11-4498-a099-9c12d952d272", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892858, "uuid": "16e364f2-c912-440d-9c47-40a72b5fdbb2", "value": "66ed7911b556dc812d083cc4717aa6a0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55ec4868-05e8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629925597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629925597, "uuid": "62745ee7-3d38-415a-9788-69af4406e9dd", "comment": "Malware payload (RedLineStealer)", "value": "de0537fdb628b37b97cae78eb82ba098", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629925597, "uuid": "3c4735d3-e32a-499e-9388-db31e7b47caf", "comment": "Malware payload (RedLineStealer)", "value": "a958a5956297e2ff6ebe698756a401563736aa63fd3c44ff0c5e7deb82134740", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629925597, "uuid": "0cd38407-e48f-46cb-9528-dc503a4222ea", "comment": "Malware payload (RedLineStealer)", "value": "445de185a41ae94ab12daa3f03169c9e6f6b6600", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629925597, "uuid": "9cfb8f62-3607-44a2-bbdd-a4d18aab804b", "comment": "Malware payload (RedLineStealer)", "value": "1b963efd66301e885f54e050c9c68da9a7cc0c64823daa68de85d9672cd4d3772003f1cda9da59a6a9d5c5e498052d71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629925597, "uuid": "9fc791ba-c8eb-4a45-a890-082fabca4ab2", "value": "T10C750D18657FC019C0E7EEB22DDC94BAE99A95E3644E723B1074A37B4B11B94CE0F079", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629925597, "uuid": "615841b9-d7dc-4c38-be7e-e4c01eba76f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629925597, "uuid": "3c6b783e-1306-4029-84ea-0d2526a20cc2", "value": "12288:zIbXvnRC7QprpJAWte0mfTtP6fGn4SFVkF8Ql:M+x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629925597, "uuid": "5279e614-849c-4de8-a03b-ae963e41f19e", "value": 1602111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629925597, "uuid": "7866b94b-c65e-436c-bbab-8ab00f44cc62", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629925597, "uuid": "6967baca-460a-4f05-ad48-52aef174715f", "value": "Fortnite exploit 0.4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cc21b9c-0565-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869210, "uuid": "637cb587-fe09-4739-9ad1-c01328fd3a6d", "comment": "Malware payload (Dridex)", "value": "8a1655df75fe7e02d683cbcb5d8ab847", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869210, "uuid": "3cd4112c-74ae-450d-9c9f-01af654f52a6", "comment": "Malware payload (Dridex)", "value": "aa7b7a89879444c907f78fdb2905a98904d0412142b21a1931504f0ca6032455", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869210, "uuid": "bee1740c-f3a4-4a52-bd68-a292e5b6c246", "comment": "Malware payload (Dridex)", "value": "9b63458977821f5ad6bba463b01d77df8c7c18ba", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869210, "uuid": "c41e5da6-c43e-4e93-b227-124ace6aa5c4", "comment": "Malware payload (Dridex)", "value": "a110a335113b8771325e469178c309f7e1647562aa8c485f775ef182951a8aafdb5f1d7fdf885ab66cd3db399055c359", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869210, "uuid": "aa80a524-8a47-4674-afa0-2034e3b7f813", "value": "T1E78412BC92E1C80CC44E803F92E64F72D3A15605A6C5772F95B2E5096B13C7E8F6B1AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869210, "uuid": "a46b1172-171e-4191-aea7-4afe74e70f62", "value": "6144:oJK1yVEn6bMB2LohOGYw6CC5jTT453mjEIbWiGVAKSLFN+YInSCRvuPsxNdb:EPIMMgL2OGY/TTy2jEIJc6FNu3uPmNl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869210, "uuid": "aee715b7-96d9-4285-a710-0e9c0b9fb511", "value": 377365, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869210, "uuid": "0cebd4f4-d36b-425e-b2c6-1c6edab75a3e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869210, "uuid": "3f6f5749-c12d-4111-b44d-b141785be294", "value": "EoY_TAX_Details-4508949085_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c192457b-0564-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869084, "uuid": "b9f66408-66d4-405a-bc6f-e6260b9d7e78", "comment": "Malware payload (Dridex)", "value": "cb69bff05888a366bf8e5d7fd5c88076", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869084, "uuid": "9985cedd-66b8-4987-a62a-057eb0944de2", "comment": "Malware payload (Dridex)", "value": "ab9ee3ab5b96f7963cc7eea4e99db84b981c79121f5ef21abe05443714c539d6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869084, "uuid": "3c342087-da08-498a-9c68-abe0f058a7c5", "comment": "Malware payload (Dridex)", "value": "48a382afea4cf56aa5224d657051ee285cacf96d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869084, "uuid": "e4f2d31a-2189-47ce-8b14-9bb1d06a8efb", "comment": "Malware payload (Dridex)", "value": "cafc649752479d08bc7e31244b0b5f01d86153791fe7b91338949300b8e34e5d4826373904b33379c32960e57fdd396e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869084, "uuid": "9d5bcff7-a3f1-4c8b-845b-3b3f96bd1521", "value": "T1F084127C53B2C85CC94F813E95E74F7297A11905A295672F91B0E6086F43D3ECB2B0AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869084, "uuid": "c470b018-ab88-403e-bdbd-9875281d196a", "value": "6144:ocMi+b/ePrWugR1JuO2LohOGYw6CC5jTT453mjEIbWiGVAKSLFN+YInSCRvuPsxn:vM3zmE1JudL2OGY/TTy2jEIJc6FNu3uC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869084, "uuid": "f6c803a4-4a3e-4c2e-9946-f80352bc447e", "value": 384830, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869084, "uuid": "6a550997-226f-40cb-bb62-e3fb4c8e6d82", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869084, "uuid": "b459f1a1-e9ed-48af-864a-ff03a0ddd119", "value": "EoY_TAX_Document-73785947_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a207c94-059b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CryptBot)", "timestamp": 1629892613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892613, "uuid": "adea126e-a092-4658-825a-e6994b8ac05a", "comment": "Malware payload (CryptBot)", "value": "9b18cb86b0184580d06ab5ded4ada4cd", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892613, "uuid": "122149eb-9462-407b-9b3c-b953c442b588", "comment": "Malware payload (CryptBot)", "value": "abc87c7b821bb7bba854958ecd20760e63c9365aff2091edc2b8449040263a67", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892613, "uuid": "fef7bc02-61ab-46f4-aa45-0ce705dadd8d", "comment": "Malware payload (CryptBot)", "value": "095e0ee9f683ff950fcc6bcff4426905c10f8891", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892613, "uuid": "c9498f84-a2c0-4d0f-80fe-dadf97788d09", "comment": "Malware payload (CryptBot)", "value": "9dfb4b58482653a57181075f24ec728c67caa31737f76ad8a82e1a80b49d0785c2c51e166e47f0a27594ef4fb6a45687", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892613, "uuid": "d870e8b1-12f4-4b9f-ba0f-500c64431707", "value": "T1E0E533E14F8934C5C8815DFBAF27272F7191B9C060644B3B8EDE54BD4200A9CBB9ADB5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892613, "uuid": "a6c5ec59-9688-480c-b214-4ddff3fd518d", "value": "f8d9e6f58bdad8d3f277d01c805576b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892613, "uuid": "ebb63c03-1972-492f-85cc-24ee104a6898", "value": "49152:Wix/rQKLtrmeIRJWlnwpjNn8g9r5yTZyqMkgyRgbIlcqbwfwElbZlXjCI2:FxEKxrmUlYxt5aZyegy1cqKbZVOI2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629892613, "uuid": "1e32538c-8d44-4786-9317-aaee40ddac15", "value": 3271168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629892613, "uuid": "7decbe5f-1793-4b04-8932-50a53cb47538", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892613, "uuid": "f425efc8-db7d-43a5-bd94-840acdef3dd9", "value": "9b18cb86b0184580d06ab5ded4ada4cd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74e3c5a7-05e8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629925649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629925649, "uuid": "7a29e663-526f-451c-9830-d48e0c3f0872", "comment": "Malware payload (RedLineStealer)", "value": "1913802183052371c8d31ce43ee2d12c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629925649, "uuid": "1cf400ca-4264-4ad6-aa79-8752824f3c24", "comment": "Malware payload (RedLineStealer)", "value": "abf5f21325081eb71335a56c5b72ec05bea94c7cc133abfb46f073227230f835", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629925649, "uuid": "e0291f6a-ef29-4a17-b0ae-84335d344ac8", "comment": "Malware payload (RedLineStealer)", "value": "e3de13be9fbd0a0a076dcb2de7d0aec157bad61c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629925649, "uuid": "cb20a309-4489-4f59-acc8-50ad3238edcb", "comment": "Malware payload (RedLineStealer)", "value": "315f4e9be30c3c6bff6e02fd9da372e279c37608e5f9eef943dede63703dd957706bfac2c63ff4048895382113ec3d90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629925649, "uuid": "679fc7ea-f69f-4af8-ba02-cf73e87826b8", "value": "T1E23533539BFF32F1E42BBD32CFE496700448CDA1B50E9239235236D74DE96A4541AAF8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629925649, "uuid": "9f5a6501-1707-4189-becd-26d36cf14552", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629925649, "uuid": "e6347989-64a0-411e-9a71-42e6308a4ce6", "value": "24576:qOlhPGacRWfqiwvvC4L2mIeP/f5V1nRGOgGs0T4:bQR6EnC9mIeD1YO20E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629925649, "uuid": "96e88875-ffeb-46c2-8af4-e388960707de", "value": 1158144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629925649, "uuid": "d17159d4-98d1-4765-b2e2-b567e05f9eb7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629925649, "uuid": "bc35921a-abd3-4777-b3c8-c7903b2a37cf", "value": "FortniteModMenulnstallerV3.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c01ee1ae-0564-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869081, "uuid": "f05d7cc6-2176-427f-a8c4-0d7513e56512", "comment": "Malware payload (Dridex)", "value": "7eed5b6401506aadfaa55ec9ae2a7c51", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869081, "uuid": "3ca55d11-93e2-4310-b740-9b681c7f1ec7", "comment": "Malware payload (Dridex)", "value": "ac7133fa7c21ab84c34595a9e8ee299342bb9f6a542d33abbc4fb3d5490e0818", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869081, "uuid": "25aab66a-6ccf-46d1-8f04-2cdc4cc3b60e", "comment": "Malware payload (Dridex)", "value": "d695092cd230476747644c7cb96933400ea371ca", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869081, "uuid": "2dbe36fd-43a2-4a97-aae3-f7c0862eb360", "comment": "Malware payload (Dridex)", "value": "07640c8bf939b0a5e1b78f36cef1538bdc5fce385be656a7ad09994ef7e507f2510d9972f599979ff9174e1667ae8be4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869081, "uuid": "439e656d-4403-44f8-9a97-216e02deddb5", "value": "T1A2B3E0EA7263CA9CC12D933C51DE1FB76BB48B8813A24706126DF91CAF125E7DB1815C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869081, "uuid": "ae8c428a-3a11-4dcc-b4bf-c7e35e0851e4", "value": "3072:oUTMcfb0XEi63LD6z2qoaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa3RY3PaaaaaA:oHmb0V67Moaaaaaaaaaaaaaaaaaaaaae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869081, "uuid": "2e834673-9acb-4193-9eb7-391ab49860df", "value": 111270, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869081, "uuid": "1f5844dd-4d6d-409f-882d-7b4e27325d21", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869081, "uuid": "7785c5a6-3677-45a9-9670-f68e75678b29", "value": "Scan-8845_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efcdd22e-0564-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869161, "uuid": "c6e3af81-333d-43af-bcc8-de2a8c15a0b5", "comment": "Malware payload (Dridex)", "value": "c1935e6db0ce006177ead8ca7f3f677e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869161, "uuid": "91e7f98c-1e71-4d3d-bd6f-3c0e16ea7109", "comment": "Malware payload (Dridex)", "value": "acf90db47063ca44a71c7539b2e3e8a902fd7fe7b35e918229a1f327d821353b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869161, "uuid": "8f859550-a70a-4fa9-9078-bbb1879772a1", "comment": "Malware payload (Dridex)", "value": "c85b5c25865ac329dfac6bc349c21235ac505b9d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869161, "uuid": "f4e869b2-3ed6-4759-b321-aebd27273e72", "comment": "Malware payload (Dridex)", "value": "050d9158127fe2b81d389ea3b2ac9577ea35dcc22ca9079f913016d48c0b1882a8a231d0ff44146ddcd5e91eeb47ab5a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869161, "uuid": "7a60acf4-ad84-490d-ad71-4aebc001c045", "value": "T11ED3D0AE7567DD89C03D523C44EE4FB27FF88B8812A112171269F82CAF179979A4831D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869161, "uuid": "6329578a-90fa-45ab-a5fe-04c313d71eaa", "value": "3072:oUk7vgprZXx1pxPxKi63LD6z2qoaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa3RYc:oPvAdXPPl67MoaaaaaaaaaaaaaaaaaaG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869161, "uuid": "5d04f63a-fbcf-42b7-919a-709248dde81b", "value": 138830, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869161, "uuid": "32a2230a-f2fe-40fe-b1ef-b2a7cffba161", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869161, "uuid": "4e235c04-790c-488b-a220-f604f669de26", "value": "Details-68840341_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d05051f4-05b7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629904757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629904757, "uuid": "8c8786af-375a-4061-890b-977fe9236f9a", "comment": "Malware payload (Dridex)", "value": "0fb1ad77eb98e6392eacf32b831b69d9", "object_relation": "md5", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629904757, "uuid": "74844b94-2b96-43af-9520-6c73a05704af", "comment": "Malware payload (Dridex)", "value": "adc4b7f058762aabd2b1219a7f18d54b81d740c7ccb23dfb4dac7a83c8443351", "object_relation": "sha256", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629904757, "uuid": "e4ff88c3-3bd2-43c1-a17c-26494a5c4be6", "comment": "Malware payload (Dridex)", "value": "b8315bfb4f56891a17c4c887939e825ce24f8b3c", "object_relation": "sha1", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629904757, "uuid": "5799dc95-e89a-4aa4-b541-da45b73fe83b", "comment": "Malware payload (Dridex)", "value": "109ae5d9073f4e8fd6cb881ae3d5317cec591a55f27e039b7414ef736a9ea9e49e7db2d29781e02fccd1f71433d6510f", "object_relation": "sha3-384", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629904757, "uuid": "6f4b5c6f-736c-4b25-ac66-9635f342f017", "value": "T18F14DF82CD9F46F9C21B167139F531BE21E84605A769CC2BCADAD2FBF47D300D46261A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629904757, "uuid": "dcbdb665-82f9-42ae-960f-f149b1b812f6", "value": "15d931f2533164c416970d03fa5b5c88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629904757, "uuid": "a28b781a-daf3-4177-93ca-7ab08877f19f", "value": "3072:BH0uyjZqEpAK+Gf78TBdrXkTM5vhRg9Esf0DwvtyMpVnpA+z6tX8sxKViWH7dU:BUua/Pv7YNhRIEZDeXVpAxtMsxK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629904757, "uuid": "13ee4f9f-18be-4fe7-9723-30f703b8c232", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629904757, "uuid": "dbc0986b-8f83-4617-9994-7a62297cefbf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629904757, "uuid": "f5c655bc-84f2-4295-a93e-2be0aa68d1f0", "value": "prl_location.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e52f5648-0564-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869144, "uuid": "050d9b02-47e1-473b-b7dc-08b2b6f98bd0", "comment": "Malware payload (Dridex)", "value": "557e74c327db2b0d810b945283983c53", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869144, "uuid": "f473b9f4-a617-4b93-a945-d091df153b4e", "comment": "Malware payload (Dridex)", "value": "aeacfc5c498bad54ee45c1fe5686b598f11f94b8cf77c86cf8b49525a211efc9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869144, "uuid": "b8be6c24-61d3-40a8-85d3-e7013bbf15d1", "comment": "Malware payload (Dridex)", "value": "b198b388d03be5a56143b6d927e5193307f5fff8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869144, "uuid": "d5e8c3ac-ba12-4b63-86ef-59198da37eda", "comment": "Malware payload (Dridex)", "value": "ac6f95a43b61dfc3193ff565780175dce86a4031e5960992a5e254d2333dd6532858223ff74a89ecfead4fae64f08926", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869144, "uuid": "8cb90128-a87c-4ecf-9899-9871950cdc17", "value": "T1E68412AC86E5CC1CC94F813E50E74F71D7712906E6906B1F91A1E6096F13E3A8E6F09D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869144, "uuid": "1028d150-069e-4c34-81a2-eea84111590c", "value": "6144:on/p4zcvUE03kFeaES2LohOGYw6CC5jTT453mjEIbWiGVAKSLFN+YInSCRvuPsx6:4p4iU6FERL2OGY/TTy2jEIJc6FNu3uPD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869144, "uuid": "d252a737-07af-4672-a17f-d93ea1acba04", "value": 382137, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869144, "uuid": "0dd6746b-7b4a-451b-ae30-e2bfe8dad9f6", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869144, "uuid": "6cc258c3-67b1-4808-bacf-0726f1daf006", "value": "EoY_TAX_Notificaion-13636431_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f613f57b-05a0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629894942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629894942, "uuid": "fcff6467-3619-42ca-b6bc-a31449025d72", "comment": "Malware payload (RedLineStealer)", "value": "10bbe1678a0d35b1f8de8a5034559cb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629894942, "uuid": "fc30ca6f-019b-414a-b06b-0c92ff529c12", "comment": "Malware payload (RedLineStealer)", "value": "af0a40308f6a64c3e58eea10500ce78a4354e50cc9db3141820d0ff942be8f44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629894942, "uuid": "6f3ed9c2-5554-4723-9e60-ccc2eaab0cfe", "comment": "Malware payload (RedLineStealer)", "value": "183f59e82bdb2ed652b06f2150f5e6f999c06883", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629894942, "uuid": "b7008997-0f67-4a59-b4a5-5d709d9aa36b", "comment": "Malware payload (RedLineStealer)", "value": "b8d6f5d14d5e7f5fa6d0b1b4eb8d480493c14d3510dfdd94471602ca332308cc9cd2e12aa88d2c689a48680555e18f1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629894942, "uuid": "28d7c010-aa88-412d-86a8-e6def537929c", "value": "T17B25B2BE26BDA627C062D6B59BEB8413F050AB5F30109D1936C31726427267B74F732E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629894942, "uuid": "f42c8d36-85bf-4855-be76-2b6937d99036", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629894942, "uuid": "3dda9b64-aebd-4f88-a316-53dfe07266e9", "value": "12288:C0WCsIj581jGI8gZXSv6e6HxqQBLOh4RPxEj9Kw4LWSSiyyjK:XWCsIj53I8gZiUR9luQBw4Ltd8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629894942, "uuid": "3a61412b-d1ce-4337-b3c8-8f75735b728d", "value": 989696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629894942, "uuid": "a8a48f70-b93a-4016-9f27-bc41a21c1150", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629894942, "uuid": "661d8d1d-8b4d-4b06-97c1-30ea34ad464a", "value": "DOCU_SIGN8289292930001028838.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c21297b7-059b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1629892707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892707, "uuid": "3fcebfed-2c82-418d-9bc9-5bb9c7840f9c", "comment": "Malware payload (Smoke Loader)", "value": "6186d4437e0aff98ad4e2df8b7bc5ce1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892707, "uuid": "299db96c-2904-41a6-bc24-7ed66d014da3", "comment": "Malware payload (Smoke Loader)", "value": "af416b9b0b8c91937ee895050038b9de17f25735faa984c1d6dcf8d130c9d29b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892707, "uuid": "d540e177-a5f6-4f2b-836d-a22cd7826402", "comment": "Malware payload (Smoke Loader)", "value": "a54ed4c0ef2067a727eed832492055b063fc1983", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892707, "uuid": "ce16f608-2720-4f8f-9223-024153393431", "comment": "Malware payload (Smoke Loader)", "value": "47079c9eba0cfdffccaefed6676d8c53e42f97edb226544a905cb84721266a6cdabbebd8ef8cac606de1032ebe558c03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892707, "uuid": "0854e6c8-6fd4-46d4-a864-abf1f0f8507f", "value": "T1A7548D30B6A1C434F5F211F849B983B9A9393AB16B3440CF53E52AFA16346E4EC31757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892707, "uuid": "5ec5afb5-bad3-4c71-a5d2-1269d9a98861", "value": "b1f244737f482f7370a4248faac2bcb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892707, "uuid": "dd6e415f-c4c3-48b6-ae0f-7b326a56536c", "value": "6144:Dc4n4tIASjXdo4FglbOhloM1SvJX9Bh12Wci:HnoIA+toC0OhlooSR7h1tci", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629892707, "uuid": "b922aa9f-878c-49d4-a39d-6ec451801ed6", "value": 280576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629892707, "uuid": "a2454a7f-3c65-49e1-ba75-b8308109500e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892707, "uuid": "806dd409-a6e2-4912-8b5a-0287724d9d52", "value": "6186d4437e0aff98ad4e2df8b7bc5ce1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0612a493-05b6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629903988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629903988, "uuid": "b949a9c7-4551-4c1c-a3aa-1802b302b01f", "comment": "Malware payload (Dridex)", "value": "6e0693d6908bd5f3b096a2e345464bf2", "object_relation": "md5", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629903988, "uuid": "33e74431-7beb-4f2b-a42e-7de9d971ff3e", "comment": "Malware payload (Dridex)", "value": "af7015aa503a6ee762e11b6858966afd6593ed2cf9ca4ce6f13297d976616c82", "object_relation": "sha256", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629903988, "uuid": "9b051cbb-9d4e-4058-af7f-456ca1960f11", "comment": "Malware payload (Dridex)", "value": "5e2c71e9afbcaf318f1b582f8af2bd58409013c5", "object_relation": "sha1", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629903988, "uuid": "87b8cb23-cf19-4737-9d81-161deeb1a8a1", "comment": "Malware payload (Dridex)", "value": "aea6a12befef8b7f1afaf5674a309d645e7e3f476980c5026b9f3ae4b994942046cbdb388479fe3ba5a8e8728542caf6", "object_relation": "sha3-384", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629903988, "uuid": "058dd7d2-ded5-4017-9e43-1bb577909a36", "value": "T1002412095EBB5829DE5E80B804DF9FC7E70119550201A74E99B0F2E83F8F0F5764E9AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629903988, "uuid": "db1b71f9-03c7-4ba6-9bbe-a7986dbc6aea", "value": "3072:oUQcfXUBnfjKp7i0acrTqvKhUfWiAY5FOc1/8ulBugHQXa3ticHXlXcnrb:oLcvWnfjGiTiTnU7AY5LrasAoXNi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629903988, "uuid": "fb873a1d-10e8-4645-8d33-9b8b6ebdd2de", "value": 230044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629903988, "uuid": "77fea7ab-09f7-4108-a451-a84555f316cc", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629903988, "uuid": "bb28b3e8-f773-4027-be42-4192b1e91a28", "value": "Invoice_Due-IN-180636_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "608014a8-0567-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1629870210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629870210, "uuid": "d4894ca6-9646-4308-9594-427d369153b4", "comment": "Malware payload (RemcosRAT)", "value": "a973600cfe33321d420dd0362ee77093", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629870210, "uuid": "e202d45b-c862-4d67-92bb-703910d51ccd", "comment": "Malware payload (RemcosRAT)", "value": "af8ee88bf85615f2c305ce230560485be949dbb7355640e0498bf93f154df714", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629870210, "uuid": "95d2e908-8336-4472-b036-6843707987ac", "comment": "Malware payload (RemcosRAT)", "value": "0d9e6ee9cc496829cf345fd2d46e819691ad10b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629870210, "uuid": "d8633492-6223-410c-abcd-527a8efe11ea", "comment": "Malware payload (RemcosRAT)", "value": "cc6f527926f8bb1838c208dba39fe8f8ddcbe9319e424e6a60fa76d2e2a9b0bdc04616afcf366d251815ce1541554300", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629870210, "uuid": "0d30f42b-c8ca-41d2-97ac-1e6018a4523f", "value": "T1CDF48DB27D7DC573C56A26308D2FA66D2934BE11795C66CA01EA3D8CCE35BD02728363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629870210, "uuid": "d04c9e43-590d-4491-9cb9-f06744f2809e", "value": "95ca75521f0d84796bcc75c19eb91d03", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629870210, "uuid": "f260d866-7f3e-41d8-87e5-2bffea95ee4d", "value": "12288:HG0z7gLLMuRN/tMvdEAwM3nrkaoUfpACXDoVttivrlG5g1+yVt:HfzMzRxtMEqAP0iCXDvvrly8xV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629870210, "uuid": "5658c279-de36-429e-9f03-45bec0a6eb26", "value": 757760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629870210, "uuid": "c2155050-5a5e-4195-9ad2-f95f595e802d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629870210, "uuid": "ed39528a-7f0a-404c-b630-fb2eaa268f64", "value": "Dhl Frachtbrief Dokument.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6493ca9-0578-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1629877709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629877709, "uuid": "27a88c5d-489f-4c55-83e0-7c311ba14ebd", "comment": "Malware payload (SnakeKeylogger)", "value": "ab97ee154a937d34b50ae29d28f6ccf0", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629877709, "uuid": "087abeca-0ee9-4acf-b56a-4876d5ad75c1", "comment": "Malware payload (SnakeKeylogger)", "value": "afc332ce1dab4c20a2b22d3306eba9cd0ced28993ae8d2704349b7293d4646e2", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629877709, "uuid": "61bf249f-22f3-4375-941f-6453fe113ad0", "comment": "Malware payload (SnakeKeylogger)", "value": "35fb52cb6877d14cc760ab35d22704f2af53f9c0", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629877709, "uuid": "e525c702-a077-48f5-b3f8-84043483d4b9", "comment": "Malware payload (SnakeKeylogger)", "value": "1881e41d51f23c77e3499e806635a058baa2be196161250e73fa2ea72001465cb2fee5d5dcb0faec2323708e35011248", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629877709, "uuid": "c1f76c24-8e07-4fd6-8dfb-eac3a4c88c6a", "value": "T13393E76CC4D30199CF4557F8AB2B6E44119C726EF79996333638A7346BC2E7A061A83C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629877709, "uuid": "d2588328-b2ff-4f66-b26c-b6366eb7498c", "value": "384:lMUXqtfPe1gphG4JcQ+W71izWVgsWZqojb/b2jtYsKSA:lM2qBempE4J3xizVb2R7A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629877709, "uuid": "4cf68fcb-aa4d-433c-b8e8-23dc6738f7a1", "value": 93908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629877709, "uuid": "f8e83d6e-c0f9-4647-a877-99e61997ce3d", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629877709, "uuid": "143aaadb-8bd4-46e6-aaa4-2a5f854cbeaf", "value": "items.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "347bc5f4-056d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629872713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872713, "uuid": "a9ce32eb-9719-4c66-b6c1-10c054c2e141", "comment": "Malware payload (Mirai)", "value": "a4d452d75f4cf01b1cc346803526e27d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872713, "uuid": "aa994ef7-2a10-4126-b026-414e0c254d17", "comment": "Malware payload (Mirai)", "value": "afed144029f5b63c0e8d3d17a8d29b47afd80dfdb099cef1ceebe1329816fdd3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872713, "uuid": "23ac746d-57a9-4137-ae50-f637a70de55b", "comment": "Malware payload (Mirai)", "value": "ac9ea59c4b529c16cfef4282a934f668ee7a1f77", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872713, "uuid": "4aae7a8a-4285-434b-a127-ea7a70bba6ad", "comment": "Malware payload (Mirai)", "value": "7ea631b59d093553b7d8e0278cb8b0aff40bb3c81e7f90f1b3e2ad3e25e078b0cd49c28c3c4d545103a7e035196492af", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629872713, "uuid": "4b044478-0e85-421a-b4cb-28ef2b6c7a39", "value": "T15D13F117712E1EE0CA20263FA57DC453854B0BF470A9BA968A2DB2B5F147B4F357C487", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629872713, "uuid": "d920d636-87ce-42a3-ac4e-1255ce0b5817", "value": "768:kbMJFji72iXVKxq7jv7BEK9SMmvi9I+s8VR9oI0rHWCqllCmR+rzLd1s3UozS:kgDj821i7BrSiy+sM9oLWCqlAmsrzJ42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629872713, "uuid": "b37847c3-c97f-4e5d-aea0-62fd61f160d8", "value": 45316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629872713, "uuid": "dbeb4092-65cf-46a0-b917-fc3745729af6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629872713, "uuid": "081b9358-bfbb-4d0c-b6e0-cb6472c9958c", "value": "a4d452d75f4cf01b1cc346803526e27d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7b2684c-0564-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869121, "uuid": "573fd6e6-4e7f-44ef-a3cd-5b4e12ead2a8", "comment": "Malware payload (Dridex)", "value": "f820bc2bb27f36796ee0379061632511", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869121, "uuid": "2cb64cf2-e643-4785-b1a1-6161decf0e08", "comment": "Malware payload (Dridex)", "value": "b214193acfdcd49438a1c40ab18ff00e8c6774295e920c6e51ae662946fd4deb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869121, "uuid": "df9264bc-a253-434d-90d0-a3831d089698", "comment": "Malware payload (Dridex)", "value": "8559b5899ba0e7bdc4fe0877b39faa9e3a7d5760", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869121, "uuid": "b5757e61-705d-4a85-937b-f11899a71ada", "comment": "Malware payload (Dridex)", "value": "74e91c800a0628d1b105579a03183c689813ab0101c1f3e781e51ae7f76408c6e78494d906d16fb2def92eb29436395c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869121, "uuid": "eacffccc-742c-4932-ada9-bcff9f8d5a9c", "value": "T178B3D0D63232D69CC03D833D91CF2F776FB48F5952A25716026DE42CAF225E79B44228", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869121, "uuid": "9abc58ef-2f69-430c-b1ce-cc68e1f7a6e2", "value": "3072:oUSxVX8Zi63LD6z2qoaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa3RY3PaaaaaaaH:oxb8Q67Moaaaaaaaaaaaaaaaaaaaaaao", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869121, "uuid": "7a526f32-de41-4e6c-ba94-b251b3201a65", "value": 113324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869121, "uuid": "20703662-58b8-4e39-9b63-a94c63b5985e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869121, "uuid": "43842b29-01a4-4d59-80d3-2904a618f588", "value": "Scan-4645503014_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8e772c2-05ae-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CobaltStrike)", "timestamp": 1629900879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629900879, "uuid": "2078c3d6-c4c6-4472-8ff4-5ee64c17215a", "comment": "Malware payload (CobaltStrike)", "value": "a86310371a18d3cdbe1e452145557480", "object_relation": "md5", "Tag": [ { "name": "1359593325", "colour": "#0C1016", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629900879, "uuid": "0c625744-175e-4b5d-b6fd-40a72460f3c2", "comment": "Malware payload (CobaltStrike)", "value": "b2146ce57cfa6785eb1c9a405abc48e844c15a5431b85c653f2bda57e03f7449", "object_relation": "sha256", "Tag": [ { "name": "1359593325", "colour": "#0C1016", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629900879, "uuid": "c170ec0f-9224-4fa0-b725-9febe5f4b329", "comment": "Malware payload (CobaltStrike)", "value": "2b8c6d9943bf07fe8dd2cdcdff187cc0f582aef2", "object_relation": "sha1", "Tag": [ { "name": "1359593325", "colour": "#0C1016", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629900879, "uuid": "4653587c-1da8-43bd-83f0-a0b3bd320b71", "comment": "Malware payload (CobaltStrike)", "value": "a8a3283a1cf5e62fcf7af9930e90efcd1c01fa7455aacf0d78c2cd08034b35312034bb739ba9b81733749f520f6ff627", "object_relation": "sha3-384", "Tag": [ { "name": "1359593325", "colour": "#0C1016", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629900879, "uuid": "f0b2a54e-e488-4eb0-8b5b-f4439fb90cc7", "value": "T14BF3E03A0971E5EDC8390C7C26FB2DF063113A35C980BFE815A4B4955B9E2F792C92E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629900879, "uuid": "caa6fd3e-b7f5-4635-9566-681b6207750b", "value": "3072:oUCvK98aP+ZfxEhAH+lW1Z/z+OVQaw4+rJDEU/H7DcYtEeGTE:ozc8amNquH+0zQFHr5/bDc8j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629900879, "uuid": "7e0bb3bc-48ff-4b3d-8047-0891d13d3fc1", "value": 166866, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629900879, "uuid": "22ecf07a-2f3e-40df-90ad-868ed48c065d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629900879, "uuid": "a9839509-6f59-45b5-b4df-de87a78a295f", "value": "Invoice_Due-IN-45662958_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d29609a0-059b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (a310Logger)", "timestamp": 1629892735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892735, "uuid": "b3ecd3e5-2655-4e21-8f4f-39b05fba1ec8", "comment": "Malware payload (a310Logger)", "value": "53f6d4b448f270023ee30f231c53cf5d", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892735, "uuid": "5a7983fa-04fd-4786-a81f-d189d029cc96", "comment": "Malware payload (a310Logger)", "value": "b281be38a190ca97b700202096f56b29ff68740c0d40273f286e03d52685321e", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892735, "uuid": "f7de4850-5391-4980-88bc-e9ad39b9f313", "comment": "Malware payload (a310Logger)", "value": "c58946d81281aa1907c8e31273f67e14f3c8ba3b", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892735, "uuid": "2d41698a-3e4a-4019-a96d-192c65565c4f", "comment": "Malware payload (a310Logger)", "value": "8a14478aea7d736a44fc6f86cf6d2866191b1dfd736cf721f0765f0e785718649b608d00dacfc50d50e6478e604419c2", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892735, "uuid": "05ee94b3-8aa9-472a-bac0-6ec0b2f10ea8", "value": "T145B41218E8F212B4C5751936E99699DCD4319D2F3889E8D7FA82F8F791B44ABC8D081C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892735, "uuid": "6d07962c-efc6-456c-840b-70fa6976db82", "value": "35807dcde258f88fa3ce5c21adc607fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892735, "uuid": "c74a8500-7bd3-47df-97cb-feb806a8a57e", "value": "12288:mxDp/GBC1aNaJ+W3YQyaOfujHwx7Eqi9gPQeuab:mdBGsQN49ozxIqJruw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629892735, "uuid": "f80a9a82-3c19-49af-af9d-06712c1cade8", "value": 498633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629892735, "uuid": "739fa917-5d01-4e9c-8d40-77087d299888", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892735, "uuid": "86e61c5f-9aa6-4c3e-b7b5-354589a396cd", "value": "53f6d4b448f270023ee30f231c53cf5d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c19c0698-05cf-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1629915040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629915040, "uuid": "654d398c-4eab-4987-b505-61c4e090bd7c", "comment": "Malware payload (Smoke Loader)", "value": "ceeff50f7b8e9066f99e59e6583c5bf6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629915040, "uuid": "576ba17a-2a5c-4f16-8840-d21c9c70c5ed", "comment": "Malware payload (Smoke Loader)", "value": "b3001343a5ef8b5a947822a15cc2e983f63ede88598b70c317ae453899786227", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629915040, "uuid": "24f518e3-1614-4140-a7b0-8714c6950eea", "comment": "Malware payload (Smoke Loader)", "value": "da0f2de7f2cb2c9b748a40b79e230060cd9dbb2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629915040, "uuid": "62e72b84-6067-4ebd-82a9-c13a499e7e76", "comment": "Malware payload (Smoke Loader)", "value": "2f8cfaf866f28c494f4cf8a0e9ca07a9b68b78588f1cfd7c6a356893d9e76425254de4456c7f32ecee1deef48e87d3e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629915040, "uuid": "ed71d03d-84e2-4370-a9f5-5358152e1527", "value": "T1BA449C30AAA1C035E5F762F855B683BDA83A79B16B3450CF53D126EE06346E4EC30797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629915040, "uuid": "cb84a604-ff11-49e8-a635-528298a09a71", "value": "1d03ad9b9e9a9068c266e5f5e715b4b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629915040, "uuid": "433d0a18-187b-4261-9622-8dea9e8122a6", "value": "6144:Niq46G0D6s3OS0qpPsafvfmxgdjtbJ5KS:Tc0D64O+pPsafmqjVJ5KS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629915040, "uuid": "a2ee4c01-ef41-4412-9b39-10ae20cab3d6", "value": 278528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629915040, "uuid": "9a2b4eb4-167e-417c-a7f1-5fcfbdf87b8b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629915040, "uuid": "13aa5a60-5ad4-47b4-bf4d-d9f8bb4def0f", "value": "ceeff50f7b8e9066f99e59e6583c5bf6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6f21b4a-059b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (a310Logger)", "timestamp": 1629892769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892769, "uuid": "346d24c7-b8b6-4f8e-b8c6-e77e4e43ca16", "comment": "Malware payload (a310Logger)", "value": "eaa78dfab0f235571b8eafbb39332927", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892769, "uuid": "02fa231e-0be8-49ea-96b4-9a274bf54896", "comment": "Malware payload (a310Logger)", "value": "b301185f13c9f20441ebbbcf360bdd06174cff01b5da49cee874347206a5cdcb", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892769, "uuid": "8183ca7e-7db3-4be1-ad54-29750a686bfa", "comment": "Malware payload (a310Logger)", "value": "09faf4a86e0fdddffb84b86911ad01ce1292174b", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892769, "uuid": "3859484b-eaad-47dc-baf9-9fed48ba373c", "comment": "Malware payload (a310Logger)", "value": "91efe07f3cc549cc23072a1b907295f93463924459622a8698cedc37150f48424fc1b1ab21dd04a231430fedadeb6b03", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892769, "uuid": "e5ebe4cc-5f03-4737-ae1f-fefcf2d1173e", "value": "T135B41285C321A7FAF7129B721259E5145E9BDF001A6485E4073733F8B9BCC0ABC4B91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892769, "uuid": "c82a2148-0ac8-4e75-92e9-4aa1a0cc3ba1", "value": "35807dcde258f88fa3ce5c21adc607fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892769, "uuid": "ddff5585-89f0-4234-8dbe-2661268b6fe2", "value": "12288:wi1hkIMIy6U4+/2F7wJQHC8lBmV4pcWi6y9zrAYIMKXPkxwpaND+Ifr:wi1hU94+YAQHC8HmVoi6KzrldKXPkxwM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629892769, "uuid": "3a757e2f-4098-4068-b770-52205fd35dd5", "value": 498696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629892769, "uuid": "5b3b3986-c19c-4798-87ec-3c001e4e485a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892769, "uuid": "20fc141d-0d9f-4ac4-8fa2-70219a9ff8dd", "value": "eaa78dfab0f235571b8eafbb39332927.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf590cad-0564-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869107, "uuid": "3cee48f6-b785-4a6c-8797-32e86f80e4aa", "comment": "Malware payload (Dridex)", "value": "e049ebf053a2af12997d932864460793", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869107, "uuid": "b670a9e5-4422-4a7e-9db4-dacc1275d41c", "comment": "Malware payload (Dridex)", "value": "b3a4ef5a4d3a9f35b23c6d2d6f8e1f433cc0084ebccf859b02da67ab8592988f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869107, "uuid": "525b6266-a7f7-4fe5-a76e-a4084261a150", "comment": "Malware payload (Dridex)", "value": "0797a29d357b8b2e134b787e4c5ce7dd34ea2e09", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869107, "uuid": "9c77d1fb-6071-49ed-9697-57fcf87d65da", "comment": "Malware payload (Dridex)", "value": "46df112c0e7f1b332fc69c85d454f2df4777579986ab1ead6e5aa1c9a951976dceedb2077c42502894e83e08457bfb21", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869107, "uuid": "2a994f54-33ae-4570-aeb5-1353ea85b543", "value": "T15F641219C5F3D57BCA8A09FF4D7C14E2A3678A37C2918AD68C8570EC2F520794398AD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869107, "uuid": "94c79461-1810-44a8-ba8e-d14ce3a3c863", "value": "6144:ookEXO/J6t/VYfASkKTzZYwPMPFde/Qxx2u+OA+NT5AL:VkEX7ifASkKTzSwkPFduQx0uD+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869107, "uuid": "fe3597ba-c1e5-450a-be7d-e46c1594e8f3", "value": 327788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869107, "uuid": "5d84264b-d36d-4d5f-8a90-ee70d3564cc8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869107, "uuid": "c3b82e85-5ba6-4ad1-a308-b4f51cfa91f1", "value": "Scan-9402118_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afe02462-05b7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629904702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629904702, "uuid": "c1851857-9450-4250-802e-6ae2f101cb36", "comment": "Malware payload (Dridex)", "value": "9584cb8b99a3b196bb35176329c86c12", "object_relation": "md5", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629904702, "uuid": "245ddc13-4203-4f4f-946a-dc3ebbdb934d", "comment": "Malware payload (Dridex)", "value": "b402a3128b9526a670ce9e7d725fd5875c809d51e3e51036eb36722e7c59ee0d", "object_relation": "sha256", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629904702, "uuid": "4613cabc-4ae3-4321-ba32-830a8a8ee986", "comment": "Malware payload (Dridex)", "value": "7bf6be086b50604eae40ec51bd6bdcc73cfc0143", "object_relation": "sha1", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629904702, "uuid": "ded6350c-de3c-4e1e-8734-af7ca87785c8", "comment": "Malware payload (Dridex)", "value": "b7d2a17129db5241003e65d1698c08f66aaf5017d04c5d3228abe3bedadf6f04a4c44eda03984796b69f0cb8672d14e2", "object_relation": "sha3-384", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629904702, "uuid": "4d3cd695-55bb-47d3-ad68-eb836734ff58", "value": "T14344120C89FB6E6DCE2F947D84DB5B86870006085292B3DB59E0E1A43BDE1FC7D6918D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629904702, "uuid": "7395f51e-e8b1-484f-abd2-0cec451d5c10", "value": "6144:o6efiIE/i0JriGhi/Da/U7AY5LrasAoXNW:e+rrhiLa/tBsAgW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629904702, "uuid": "6f919cfe-cd80-412f-a40a-5b4204b42dcb", "value": 278440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629904702, "uuid": "56974710-bee6-4dc5-adc6-6a18c59d52ca", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629904702, "uuid": "8d0b1e40-8934-4ccf-ae58-f28551dcd392", "value": "Invoice_Due-IN-04071_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a18ca846-05b4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629903390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629903390, "uuid": "27fe9dda-5dc3-4afd-8da2-32a3ea9af060", "comment": "Malware payload (Formbook)", "value": "73ffae92ff232fcf40db39fe1a8ec773", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629903390, "uuid": "9314f689-a0f0-44ee-9f04-26b78d5fdd53", "comment": "Malware payload (Formbook)", "value": "b5225e4f19b8f43d98a52808829087a9019cf247fb6a3f6acd6ae30eccb9e8b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629903390, "uuid": "be49c0f2-7644-4379-b468-44734df8965a", "comment": "Malware payload (Formbook)", "value": "98ba8b8efae441724aed5a628d6604af16e578a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629903390, "uuid": "7b81110f-856f-4692-b764-1862916744aa", "comment": "Malware payload (Formbook)", "value": "c3a3473cb0fa3d266caef40b33333ff0e8fb4286fb8e70a3495319ef47623638fbad1eb953046344da549aba6044b46b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629903390, "uuid": "64ca2492-3d91-4c56-9be0-a04421f904fa", "value": "T17284231288CD4CE5FB1AD131A0D3C7692ABBA3134CA78FD09A64CE6C59D754539E38B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629903390, "uuid": "f1cb4785-91cc-413c-b541-50ef35fbd398", "value": "ef471c0edf1877cd5a881a6a8bf647b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629903390, "uuid": "b62f098c-39f7-4d8e-94b9-90d6bbaf4400", "value": "6144:S4XrK9PX7Fp6Gh2wWRGl0EDDf1PisZQ5rAGQwg1QtP1f4paaYlsdcaMJEdbI0Pzq:JXe9PPlowWX0t6mOQwg1Qd15CcYk0Wea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629903390, "uuid": "61e5908d-3b27-4321-a8ef-a0cb1b1bbbed", "value": 391680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629903390, "uuid": "99f564f3-1e67-4a46-b93f-3bf61389b98f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629903390, "uuid": "97f6bcfa-8c85-470b-94f6-aebc3f89332f", "value": "Bori ordine 25082021,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a00aa2d-059c-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629892881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892881, "uuid": "5e99a30d-7317-4b15-94ba-4f68d415a555", "comment": "Malware payload", "value": "e447555a706d82fad55d962c18c89ce8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892881, "uuid": "1d6fa747-d397-4654-a230-cfb09aeab523", "comment": "Malware payload", "value": "b616bf69d390a44e05e1fb7c1cc764fc2c397237f813b9911cd2de1e4feb4129", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892881, "uuid": "4f82524f-9cdc-4fbc-a624-6e095cc9e5a4", "comment": "Malware payload", "value": "ce31a788d5dc8b57aa402d39c6d136ddcaec2721", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892881, "uuid": "b37d852f-3262-45c5-8c88-f8fb232d331e", "comment": "Malware payload", "value": "07e901ea91fcda29be53e09f2b019019d37b0c9c683a8090bfe8359628085b67ce1fa85ab53b8f4975f8707bbe855e90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892881, "uuid": "fdc10386-7518-46a6-a7ce-cf1fd71816c3", "value": "T17BF4233DFE9A6FC3D66DA8BD4900124217F41118A962D3493EE2D2FDACD6B80974F1E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892881, "uuid": "ebc67cdd-36a6-43ac-9e67-4f2ab5cff4b5", "value": "12288:vWvx8Bb6U2MKeyuL/cP1D0OLmOMTTu31RKWJ58sCmupcPBi6a9KK:Sx8B0MKe9L/K1DwOqm7KWJas0pcPE6ad", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629892881, "uuid": "f469ed01-47fd-4618-a9a1-392d3584285a", "value": 725116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629892881, "uuid": "dfc9577b-a6e9-4434-8eb8-04a8223a75a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892881, "uuid": "95eca793-44ae-4b7a-884f-cabbf1816872", "value": "e447555a706d82fad55d962c18c89ce8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8425328-0564-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869176, "uuid": "df3fe362-dca7-4b06-a873-9b1df3d20a02", "comment": "Malware payload (Dridex)", "value": "13404d1fe15edcc425a9f6aeefd71ec4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869176, "uuid": "a7b61106-9ba4-408f-8740-b5a45985d97f", "comment": "Malware payload (Dridex)", "value": "b6dbddefa0291fb8b401968e6ab25709fa8bc752b8495721f8d4407062a1c204", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869176, "uuid": "007b8b7c-88fd-41e4-9cfb-e7d2484c5449", "comment": "Malware payload (Dridex)", "value": "6d0c44575bd3ebe5bee46bd41952f3263207204d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869176, "uuid": "636720f9-bc5e-4af2-9bf2-0ca143a5b4d9", "comment": "Malware payload (Dridex)", "value": "2da3e09431888f2c3b321480eb8de0a01e087a32a37dc81cca25c4e50c6e833c1071f1bd82fff8919d7dbf6eae094e3a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869176, "uuid": "e3305535-ee8b-419a-9b2a-27bd469a5c44", "value": "T13E7412A892E1C81CD94E413F61DB0FB2DBB657069785771FC2B1B7095B03C3E8BAA059", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869176, "uuid": "f6dc7664-e4f7-48fa-8360-5189ad7a2397", "value": "6144:oT+CgZUN2LohOGYw6CC5jTT453mjEIbWiGVAKSLFN+YInSCRvuPsxNj:qfgZUML2OGY/TTy2jEIJc6FNu3uPmNj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869176, "uuid": "4c7d608b-2fb7-4a74-b977-2562b029b572", "value": 366499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869176, "uuid": "051584dc-7d4b-4d88-aa65-5df596b1967b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869176, "uuid": "fa917c06-a66b-4166-b4e7-97df448b631f", "value": "EoY_TAX_Export-6335157_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa0c7e6b-0564-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869044, "uuid": "beeea525-3c04-4110-af39-ac707ee0c5db", "comment": "Malware payload (Dridex)", "value": "81ba2eb2f45b19970f564129fbb9f0e4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869044, "uuid": "05e8980a-4138-4632-b013-deab3b8a1145", "comment": "Malware payload (Dridex)", "value": "b7e7a71b28c025c4150c48b44add09b24c959f3675a02ab852c6fe38e5045a93", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869044, "uuid": "79e365ab-a161-452e-ba84-9d4413cf82a2", "comment": "Malware payload (Dridex)", "value": "42b53db95d3883301b4d5564fc0497d2da0d9f23", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869044, "uuid": "22c50daa-9796-4575-976c-5251667fa1f2", "comment": "Malware payload (Dridex)", "value": "259776a06a578f9d23d651a26f5bec5ff884d6f279be68ee532ca4859449c5099b9d6757fac4a04e2176965f06761f2d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869044, "uuid": "3376425f-15f5-45bb-a3da-c8ad3cc22dbf", "value": "T123B3DFE97672EA98C03D523D51DF2FB72BF48B8926934706127CF51CAF224E7DA00129", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869044, "uuid": "7698dfb6-f257-4978-81c2-461348e419d2", "value": "3072:oUomhyIzLaSBi63LD6z2qoaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa3RY3PaaaQ:oTmhpzLa967Moaaaaaaaaaaaaaaaaaab", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869044, "uuid": "5ce58851-ea55-4be4-bb50-01953a9ae779", "value": 113079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869044, "uuid": "18b48feb-e36e-4a45-a4c3-c68ce10373db", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869044, "uuid": "2dfa0f2f-1ad1-481b-a707-d4f2bea1320a", "value": "Scan-6222119827_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a07129d-0565-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629869447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869447, "uuid": "e41168e6-e5d8-4b36-87e3-9e73355c5eff", "comment": "Malware payload (Loki)", "value": "b2ddcb7e038eda725b9bdae5b5b97dfc", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869447, "uuid": "fa1c978a-f82c-41c2-91b5-1956c9693b83", "comment": "Malware payload (Loki)", "value": "b81ab749a594612a4d18813627b1f08aafa332e09521bd143461052614b6262b", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869447, "uuid": "85f24a04-8a5a-4298-8c74-98cdfe98b7c1", "comment": "Malware payload (Loki)", "value": "8875b3c7dbf066d4fad93c79f212aa12acaedf82", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869447, "uuid": "6e00a9de-e847-4d9f-9fe8-28f590946dcf", "comment": "Malware payload (Loki)", "value": "772b84f0f8018a697b4d1000445f2f022e8d24e9736b0b3b2edbb6c3cf59f52f6bb88656f48e034e6d75f23e93f747ea", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869447, "uuid": "0ff3246e-d3cd-4fe4-b878-fdd3f6f4c27c", "value": "T1A455122270834E98E455B6B40A0918B43116FD98D731B64A597F72E2293DE30FEEBF1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869447, "uuid": "d0b73ae1-97c7-4ff5-b5c8-9cba96414fb0", "value": "24576:d+LQ8ZfXHblZozyuDba0RHKieE63HDavVU7fp6I4WueAI+0:Cf7luzyuDe0Zw2vVY4Lhm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869447, "uuid": "eb7c6400-a5b7-4d6d-af4e-54cfb85fe4fc", "value": 1291264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869447, "uuid": "710f94fe-666e-4539-844f-749cbdc48585", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869447, "uuid": "d63c134f-72d7-494d-87ba-83ef72d2ed54", "value": "TT COPY.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54434264-055d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629865894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629865894, "uuid": "32ba772a-fbe7-48fc-ae1c-fb817370d656", "comment": "Malware payload (RedLineStealer)", "value": "33e4d906579d1842adbddc6e3be27b5b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629865894, "uuid": "cb852c66-b4d1-4855-8678-20bbd244504c", "comment": "Malware payload (RedLineStealer)", "value": "b9025aef29f9f9d3126d390e66df8c55a9c9f7c15520f9a59a963932ee86b815", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629865894, "uuid": "420b70b9-d51f-4c8f-9828-d74fa132e52c", "comment": "Malware payload (RedLineStealer)", "value": "9cc464b63f810e929cbb383de751bcac70d22020", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629865894, "uuid": "09b29cea-7dc3-41d0-80ea-2163b834c369", "comment": "Malware payload (RedLineStealer)", "value": "1c77ad157d9965639628f5f698863e779ac7ab8815490182247c777c8f4ab39d1e7641e9ef0c152c2a730f0006af3bfb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629865894, "uuid": "6d58b73e-c66d-4215-91a4-5c4747f7cf2a", "value": "T1D0046B7B2AB8C466C1091A74E8A10E1F76B8DE340985F285F447B6EDCC3D38D5DF92A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629865894, "uuid": "bfb36229-6045-4685-b2ab-9dd3247e7f16", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629865894, "uuid": "8ab14c68-a85b-422c-99ce-e657899843b2", "value": "3072:VwdaX66YJyEkmxEQaMruDMlv5//FLiP2dUXQI8Gd171jpxszmiGAGRC2:Z66Xmx3aMAM5/dmedUXKGNHszmiGxRC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629865894, "uuid": "6f59e5bf-224d-4b44-a1fc-2b17d27f4938", "value": 188928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629865894, "uuid": "ab38f42b-e594-41bb-b56d-e75c8f11be2a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629865894, "uuid": "7c7d321c-87df-4250-a520-675fb064f8f0", "value": "33e4d906579d1842adbddc6e3be27b5b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d30e0fc-05d0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CobaltStrike)", "timestamp": 1629915247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629915247, "uuid": "a8a38195-c3bc-4808-964a-308f02afb1cb", "comment": "Malware payload (CobaltStrike)", "value": "74bda73eeceaf995e126c5a725aa4565", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629915247, "uuid": "cc19cc6c-417a-441d-801f-dadd3a4eaaf9", "comment": "Malware payload (CobaltStrike)", "value": "b972f1622bdf57455e43a2a74094be6478e89dac55c570c1f26d1da8455d35bc", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629915247, "uuid": "04491a87-e3ee-43ae-92f5-d2ba7c2483a4", "comment": "Malware payload (CobaltStrike)", "value": "5fabdbd4a448cc94cc8f92ecc495af1d1da213cc", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629915247, "uuid": "30230d29-d712-4e10-a01b-a5be31fb080a", "comment": "Malware payload (CobaltStrike)", "value": "2192530784ecfcf7509df4f7592a116ab86865621dd93019a77ace9ace5ef1d7fa06dbb8a7f4d8ee6120baa96eaba1d8", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629915247, "uuid": "d9be5d0d-924e-4cf9-8459-1874c0482521", "value": "T136740160E7EA6555F5F77731A93A0721572E7D82A838F50C871042CE8A71AA5CDB0F33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629915247, "uuid": "66dd55d5-6b4d-48a9-8baa-c09e388366d8", "value": "e218f655f036f569d7a87ccfa333d177", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629915247, "uuid": "5b363a9a-ef5e-4191-ac2f-92828c30703e", "value": "6144:r61FoHY1j12PbimfGsE6m4FtWfAvpofL0tJ1PDi7wfaZwln/6kgUB9Z5Dr5kCvjf:lcj12PGYEgvIE9Di7orlikjOCvjbD0vz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629915247, "uuid": "c475f1ff-4e7b-4035-a313-1e9105258630", "value": 364544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629915247, "uuid": "02ac16e3-ad79-4252-856f-631ec3f34a61", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629915247, "uuid": "66cc106f-42e0-4c79-a9ac-07e01fb10bc2", "value": "74bda73eeceaf995e126c5a725aa4565.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4594fc16-059c-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629892928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892928, "uuid": "822ce5fa-2494-4214-95e8-8854c7a2e521", "comment": "Malware payload", "value": "24c4788a737cda143d0edac9c711994d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892928, "uuid": "2cdd1d57-e7ce-47cb-83ee-21b260afb86d", "comment": "Malware payload", "value": "bb025003b58ee61c3d6805cd3974844ca21224c8fd64c0678b19864453137a58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892928, "uuid": "5f94e503-d07d-4fc7-a985-4bf9e179a146", "comment": "Malware payload", "value": "0d5882dc300fcec47db1b48d774311cba4f80932", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892928, "uuid": "f3fd4cc4-705b-4905-bcdd-77ff29701363", "comment": "Malware payload", "value": "6c9d1d6af5464139f876827165debe63c8f3bb86cd237b1044c27421d095aabd840750b4237f2a830b57b16eec76502b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892928, "uuid": "20d4f84e-9821-468e-9d60-f3d623adc39d", "value": "T1D084124548C4CCA6E729B371D0B3CF9819757832CCD56B689758EA2EB870243B853E6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892928, "uuid": "57e82e9d-fed1-482c-bee6-e2a2cd408646", "value": "ef471c0edf1877cd5a881a6a8bf647b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892928, "uuid": "52c890fc-137c-4eba-bdc3-5c683422316b", "value": "6144:l4XrK9PX7Fp6Gh2wWRGl0EDDf1PisZQ5rAGQwg1QtP1f4paaYlsdcaMJEdbI0Pzs:eXe9PPlowWX0t6mOQwg1Qd15CcYk0We8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629892928, "uuid": "4c08cd68-ce46-4990-b726-731aa8a5e5d1", "value": 376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629892928, "uuid": "f337c3d3-3b45-48eb-a4aa-a33b9f66e418", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892928, "uuid": "6f646f3b-e830-4486-8ba6-482265368bea", "value": "24c4788a737cda143d0edac9c711994d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53a05343-0572-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629874912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629874912, "uuid": "c9d14bd9-8f18-4faf-8e5a-0a4758aa742e", "comment": "Malware payload (RaccoonStealer)", "value": "5e8b587fcec78e0193ab432a8f60fdea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629874912, "uuid": "c9cd1417-b0f7-4d6d-9aef-21e349e77b9c", "comment": "Malware payload (RaccoonStealer)", "value": "bbba3f28facdb9d2e5fee7e4da7d1fa78a32ee0abe95b576184c873925d1156f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629874912, "uuid": "f89e830e-853b-42b1-a309-f93572af90cf", "comment": "Malware payload (RaccoonStealer)", "value": "b0bd565de48c0c47e70129ef6d35211173741dc2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629874912, "uuid": "4fb1d57a-5a53-41bd-a646-4cf25a3e895c", "comment": "Malware payload (RaccoonStealer)", "value": "3efd86e93dc07bc5ade41dcb6e0de4f22b55ca1ebb5a516dbf3a984184ea1d1fc4f1e58eeea020649012d8a5c5cfead5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629874912, "uuid": "543e809e-ece4-45b7-80eb-df4cd1698f7b", "value": "T17DB4DF30AAA1C435F8F711F44A7A83B9B53A39B16B7440CB63E126F952346E5EC30797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629874912, "uuid": "8ea76e8c-9703-4d3e-a086-f5c938923950", "value": "ddbb3eef631957f988f10b48742f9549", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629874912, "uuid": "5aafe653-13ca-4cf4-a590-bb5feb866607", "value": "12288:WQREinOT1h4h+OSh61b1zTZvWpmj1Ts/FIqxwuVWtG33Lquam/aa:bOTQpJTZvtuLxMc35a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629874912, "uuid": "afdb6a71-abda-45c5-893e-d458284178d8", "value": 540160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629874912, "uuid": "b8089f7e-5eb8-4124-94c0-f9c736ff8b05", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629874912, "uuid": "1358f6ce-9997-4e62-bb9a-53c2186775b9", "value": "5e8b587fcec78e0193ab432a8f60fdea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "905c9a10-05c9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1629912381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629912381, "uuid": "07008a4f-88dc-4d52-a98a-564b8cef1116", "comment": "Malware payload (NanoCore)", "value": "92104db29215653b89d33d9b22ce2d43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629912381, "uuid": "a317b637-e62b-4743-b4c4-9df3d37248e3", "comment": "Malware payload (NanoCore)", "value": "bbc2d59fe5903a0015ed42005006300c92cbc16456ecb7204c59c11b56307f83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629912381, "uuid": "1febf7a5-d98e-462d-92dc-c3d702c601fc", "comment": "Malware payload (NanoCore)", "value": "a0fc2428f999841f1a4b11248d7eadc166388df0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629912381, "uuid": "87df0cb7-1a87-4921-af3c-1d8e567f18c6", "comment": "Malware payload (NanoCore)", "value": "2e55cdc757f4d1bb68f71c5a5634445a7f9c014c05869fa3800c6c278e14807a41e3d502ead53d5a14aba4a0c5337f75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629912381, "uuid": "06334192-94c3-4327-bf61-dede9b6b5ccc", "value": "T123251202F6D28871E8731A328A3ABB146D7D79201E24DA2FE7D44C7DDA755906231BF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629912381, "uuid": "79e42398-2cd6-485b-b195-5e27f3ac6870", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629912381, "uuid": "34b82cd9-4ae7-4162-bd7f-9c69f7222f39", "value": "24576:rAOcZAhZG4VKP3l05HADNRLRX26C9lVH+hP9Thz9I6mi:te4cG5HADjt26C9lAZ91Ii", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629912381, "uuid": "fba1b7f1-6681-40f9-998c-07f81bde59a5", "value": 1001411, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629912381, "uuid": "71817730-e0c8-4221-a0d2-a712cf81d946", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629912381, "uuid": "f329af0c-d554-43ff-99bb-91afeb61ae34", "value": "STC8924578611.JPG.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f5b4d04-05d7-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629918204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629918204, "uuid": "4327da3b-cf84-43cc-9772-f938cc08e046", "comment": "Malware payload", "value": "02d5590fabba5fba6c36de045e144857", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629918204, "uuid": "52c74acc-2d83-4835-b998-723d5a8e4846", "comment": "Malware payload", "value": "bc99b42680a19379e7030dc0871c143afd142ccb9b12efd2942a97e706f7dd59", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629918204, "uuid": "ce6d21fc-c533-4a61-a75c-3197731588c1", "comment": "Malware payload", "value": "93a37faab4f76299b10cf4f3fa0379965942e152", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629918204, "uuid": "d8549eaa-6bf3-4c59-a077-63beab2c28b4", "comment": "Malware payload", "value": "58f7ad93731dd18367a725b1c47481c6f8d20fa5b47581f33d5e8dc3dc3743daca4a2c6d0b52c1aac1c2aace6af7b5e4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629918204, "uuid": "ce2a0df9-b599-416e-95cf-ecca0f9b7e9d", "value": "T18133E115C7848A6EFBB547BC5BB2410A6330EA13D69ECF6F30442E063C57AB1DAA125C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629918204, "uuid": "d6300c2c-0572-4626-962e-39c4f5d7b616", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629918204, "uuid": "3df5cc54-6419-4ba6-ba0e-24f2764ac12f", "value": "768:9lNiIgb/wpivbLBvt6eLitlVaDVZwnyKCEVejKdgLhyBzH6yh3ayq8uF:+MpILMlVaInQEoKdCaR3M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629918204, "uuid": "70406bb2-bb9c-4a9d-8274-7c6bf6cebf6f", "value": 53248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629918204, "uuid": "aa683d1e-dd0c-4ed7-a0e2-68aa447236ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629918204, "uuid": "41b325f0-3718-43c4-8f35-e8909d4021c4", "value": "02d5590fabba5fba6c36de045e144857", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93c8ecab-0574-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629875879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629875879, "uuid": "c4d475e9-c0d8-4dbb-9440-94edc85d3f47", "comment": "Malware payload (RaccoonStealer)", "value": "2cd9952322f6dfcb7792562aadaf4cae", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629875879, "uuid": "a2506cc9-ddf2-4c88-bc92-5267bab7536a", "comment": "Malware payload (RaccoonStealer)", "value": "bda3352972fc081cacc0f68f036685c84e45c7c355e2caf98f67772537224f50", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629875879, "uuid": "e15b9fe9-e5d2-45e7-bd4f-b0bf0509605e", "comment": "Malware payload (RaccoonStealer)", "value": "8dcf7cc5ce75f5c270abb09cd69b372428f7fffe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629875879, "uuid": "96e7bd08-53dd-4cd1-bdf4-4aaa85d2c7dc", "comment": "Malware payload (RaccoonStealer)", "value": "63c8e8ad5dc693c99a8a7b87e99fd3dd94e780ce2de12916db32a128502862c87a27d0d8b3a7633636e29622aea2aa4e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629875879, "uuid": "6a699efe-fca4-4539-b2ca-40a87a1686a4", "value": "T1A9B4E030AA92C430E9B201F445BA93BCB9397A716B3450CF92E12AFD57386E5EC31757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629875879, "uuid": "7ea1cb5e-ec35-4d87-8158-4b72cec5b7cd", "value": "b1f244737f482f7370a4248faac2bcb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629875879, "uuid": "49315056-7aa1-4b2f-ad67-4560cbe6095b", "value": "6144:32634ZcAmjXPIY08lzOPl80xKS3N2dsYV0rnaRgVPFsTO1f2IWGVXZPTDIwLIiW:738cAifIPIOPO0ES+sYgn3sM2I/JLS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629875879, "uuid": "e2415918-9ed3-40f2-abdf-9fd2c2647005", "value": 540672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629875879, "uuid": "4ebec844-83b1-4bff-b212-ea052678cb92", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629875879, "uuid": "7fe0d939-1dfd-46b0-b524-d46cfd2ff2e0", "value": "2cd9952322f6dfcb7792562aadaf4cae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95791428-05fa-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Glupteba)", "timestamp": 1629933434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629933434, "uuid": "c14f6b3c-0c3c-4db7-9f2a-4d3f36bf1d19", "comment": "Malware payload (Glupteba)", "value": "75e0392cb5d6ffad9d202aafbeaeab04", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629933434, "uuid": "d8180f53-7998-4892-ada4-f71fe28bc048", "comment": "Malware payload (Glupteba)", "value": "bda5266623b0fa7db75f2b4f4dcad50162b92ca3494e52b8305c48f0e4fa8a22", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629933434, "uuid": "b1d2717e-8a5b-4b7f-89e4-8181449be747", "comment": "Malware payload (Glupteba)", "value": "12015c6d454a5e34eab9e0fd0d1947b257780736", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629933434, "uuid": "310ccd53-099b-4ccf-a63b-35f24f33ef51", "comment": "Malware payload (Glupteba)", "value": "d5b0fd782d51734ad9ae84b240ad4709744d6dbbb86fcb861808afa5cf59c97eaaf922521ae89978dcc9f9a3c358773d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629933434, "uuid": "dd3b8742-94d8-4585-8969-e17939828cff", "value": "T10F2633862AF5842BDBC21836893CDD341B1B38E316F9C547B685047ABE5B360856CBF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629933434, "uuid": "d24764c0-de84-4e0e-ba1b-af207dd83158", "value": "c2177a2021a127fae92a922150801df7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629933434, "uuid": "c6c59c4c-7b14-4880-a465-e80d0f132dfe", "value": "98304:W4k4uKmwYOjbaFBfnLleT0Rnt3S9L2/4NAzWQtEx/rh8ATEYgiHI:64uYYOKDleT0RhS9L+PWMMDQkI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629933434, "uuid": "f1e460f4-acbd-4c5d-a32a-10272eaaf042", "value": 4586024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629933434, "uuid": "a5ab88d9-53c7-4d87-9478-88c91a3331ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629933434, "uuid": "ca244679-48b8-4e35-a7d9-560c3abde545", "value": "75e0392cb5d6ffad9d202aafbeaeab04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e7dc1c0-0565-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869240, "uuid": "18602c16-7169-4ea8-a7cd-7be079a15104", "comment": "Malware payload (Dridex)", "value": "74c22c82087697ee4344539d2b4f2867", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869240, "uuid": "a0d8d830-507a-454a-b4c5-f664a6f557ce", "comment": "Malware payload (Dridex)", "value": "bddac5e8756f90dbac0b74735f14f2ad797760c23cee26c10e8dedb7a6f95f61", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869240, "uuid": "59a4afd9-1cd0-46d4-887d-1ee51a1c55b3", "comment": "Malware payload (Dridex)", "value": "277cda33834cf0d225b70365f679e5221df11bd3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869240, "uuid": "bbcb271c-dd5a-4184-a06d-11087b37510e", "comment": "Malware payload (Dridex)", "value": "afe95bc1bbaa8fa8cca1db5a5e2fd3a75a4c8dbb42a15c4c50d73e8e653e56a5c1e179cf5f5fd93e258f2901410d4bda", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869240, "uuid": "8ccf3768-fa03-4c22-b5f7-48cc3f782034", "value": "T1BFD3E1DA7536CE98C029927C91EE6F765BF09B8453F243171468EC287F320EB9A4810D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869240, "uuid": "b14cfd04-e472-41ad-b05b-113be52b9db8", "value": "3072:oUr/rrYRX1v5xsBOZCHtZ5bE9jOi63LD6z2qoaaaaaaaaaaaaaaaaaaaaaaaaaaJ:o+/rUHhxsooNZ5bY67Moaaaaaaaaaaau", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869240, "uuid": "c677295a-5350-415c-a473-f0adb311cb40", "value": 135195, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869240, "uuid": "6f4134ce-3c3c-4daf-b28d-056eda40081c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869240, "uuid": "f9ffea8c-ff21-4984-9a44-6e9cb6bd3911", "value": "Invoice-243091868_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "211f92e7-056f-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629873539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629873539, "uuid": "dec5c106-d743-4cc2-a2d8-42194e16dd7c", "comment": "Malware payload", "value": "4214190ad234825c5019989942869a8e", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629873539, "uuid": "090d458a-5dde-4bee-bcf3-9d398570b9ae", "comment": "Malware payload", "value": "be14b7f860ecdf2ffdf4942bacabe4757714d7e0c9b8b7e6a8f958981154329f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629873539, "uuid": "6b3e1ab6-3e89-4f58-93c1-a4fc9413595f", "comment": "Malware payload", "value": "07ec7b874223fe974e737884b48c6f0164b81007", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629873539, "uuid": "2e6d5b04-47c8-49cc-983a-4e1e61c1d4d9", "comment": "Malware payload", "value": "a40a4d0570c02126b8a7c4dea97cec0fcfda9e10096c29d2cfabc16a676ce9826b06a5a873c6032f6081b6fc6f0fe861", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629873539, "uuid": "23b93af2-7c61-42f2-a759-8a72490ec636", "value": "T119A109A6833C2403DF0B41F2C1B4FEA206D1F17544CF6684B7ADF8790BAB751292A945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629873539, "uuid": "faf0f76f-111c-4cb6-b523-205e04957741", "value": "96:cdMQWescgRQGXR43s3igI0uhEsMp15ijzO0BqZfz1b6E/+B9k+x7q+Zd+U:vQWPNQGX+t0yEsMp15+zOCqhhr/GG0l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629873539, "uuid": "ab26e5d3-c764-4711-b47b-9bfa46ca7f9a", "value": 4859, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629873539, "uuid": "16b62cd5-c0ad-4985-9224-b11c77affb6d", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629873539, "uuid": "3830a188-686f-49ca-985b-501121c614fe", "value": "ASME SB 338 Grade 2H welded tubes.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d37866c-0591-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629888189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629888189, "uuid": "47f62524-a786-4199-9b5e-224a76f0aa23", "comment": "Malware payload (AgentTesla)", "value": "9d69545189a788517d64e405cecb4d97", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629888189, "uuid": "318b8914-8acf-4ccd-916c-4d4c4832cc5a", "comment": "Malware payload (AgentTesla)", "value": "be446de6d1c5ea29642e98a11cf7ad2b9fc64d2dbca79f499c56b81257ba7ced", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629888189, "uuid": "8c5adcf9-84e7-4496-a4be-539512d8c386", "comment": "Malware payload (AgentTesla)", "value": "db1705dff4e608ebddeba5677b33e2787d664158", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629888189, "uuid": "b0724b19-d9ea-4159-a1de-a756b52bb4a4", "comment": "Malware payload (AgentTesla)", "value": "b69b8c683e3dc1fb91bc41a3aff7a185d992e9812c326fee0bf7e078f9bd72d6fb096d029188cdd8c67bb02b2b09f4cd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629888189, "uuid": "2ca182df-4853-4e50-9c3c-70fa1af47f01", "value": "T1B6946B003BA86A6BF130D57B5B57863682B209CBD1D5D744CC14E3BE7931371AA8DA8F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629888189, "uuid": "0c3e4b58-7af4-4e18-9db6-d773dfda21e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629888189, "uuid": "afc5edec-9dc2-434b-bc4e-35dcb0e2507b", "value": "6144:I3+lr8cHr3nKFpy7T4cHG4K8ae8H2ntdnwkgljWMpcgacPR1NHSv0:I3qL6GTTAWntd5YPc8J1NHS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629888189, "uuid": "17478e44-cc37-4587-9bd5-1a56af27712b", "value": 425472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629888189, "uuid": "691845a1-bcc1-4abc-91f1-23f7622474fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629888189, "uuid": "15ae5fb0-ed42-4c25-ad83-09a55053841c", "value": "9d69545189a788517d64e405cecb4d97", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f8bcb7c-0566-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1629869644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869644, "uuid": "6b77c6ed-df47-4ae8-8bf3-0f244abbca65", "comment": "Malware payload (AveMariaRAT)", "value": "0eea1e8d277f15cbc745d0cc5e881710", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869644, "uuid": "37cd9cf6-3ee3-4ca2-ad94-439d029aeae1", "comment": "Malware payload (AveMariaRAT)", "value": "bfb9f1766b776109a3f29d3800def5793c69bd9653af08192885bb28fbb1d3bc", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869644, "uuid": "ba33fc34-944c-4d87-a226-84185d62962e", "comment": "Malware payload (AveMariaRAT)", "value": "dc5a0c897daeeae3bef6dd63740c2b34d50fe376", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869644, "uuid": "e4476a71-f719-4329-b912-3225ddc62034", "comment": "Malware payload (AveMariaRAT)", "value": "6e0c65c82e182614297c141410f0c200bac352af088fbe42e44aa7e18516f124f4b83913b37f92d3c2112c6bc24d7212", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869644, "uuid": "a9682d3f-a05a-483a-8815-e13b043f4be5", "value": "T10834EAE4684F48B2D2098C5E6494B144AE74FEE334C6987223AFD434DF5ABF29EC4583", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869644, "uuid": "3d0a1e9f-3fcc-4604-8354-5c1c381ebdf5", "value": "1536:iaG/LUB5P1l0vowEFIZ059Uv17RCVTdzFz76mAg5eeVhMDw5wfL0:ialz1BTdzFtr5RDAw5wfw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869644, "uuid": "260250d1-70bb-45dd-bdd7-4a8aaa186da6", "value": 233225, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869644, "uuid": "33c520a8-30dd-4c68-8948-0478abcac662", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869644, "uuid": "3a4999be-aea8-4e01-8000-7e295f737218", "value": "INQUIRY 1191-21 4000172746.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aef502d2-05ee-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1629928323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629928323, "uuid": "95d1053d-bf7c-4100-890e-1590a1597e7f", "comment": "Malware payload (RemcosRAT)", "value": "5b473537ad92a7687da8f62cc3534283", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629928323, "uuid": "5abb9a1e-9b5c-4729-816b-d23b53d013ac", "comment": "Malware payload (RemcosRAT)", "value": "c051b0ccdcb1d71dd1178412de70ad5f240a4f97ada53a54add41e1aadbe7694", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629928323, "uuid": "d4cb807e-e8e0-42c5-8299-84aab9a06f50", "comment": "Malware payload (RemcosRAT)", "value": "2012a774531e105e168a3d2e8fa2107af425d322", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629928323, "uuid": "b6057486-5a28-411b-894c-7e3343ec6bcc", "comment": "Malware payload (RemcosRAT)", "value": "62768bafb6ec756f0d22f2ece55df60301ae52896ac51d46ed229aa1d5255fc7f3d9f00acbe852c71a06ad0ec4c9b950", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629928323, "uuid": "353f3645-394b-4c19-961c-50a03ab6a21e", "value": "T18BF45B53B315913EC8329478AC577BB1DD3EAA101834AC9996E629480F38BDF3D76B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629928323, "uuid": "3be10c1e-d7eb-4e29-a900-819dd2f2952c", "value": "5a802a354982a97544e495df27ee8291", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629928323, "uuid": "3a36b403-3630-40ea-9a69-1248a2593d92", "value": "12288:vFtHRwMpWIIyKj9X1WxQ3jC0CJVYT+R0ws8YrX2ujF5JjFWVJq2O:vFtxwR9uwvQYYds2+TJ581O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629928323, "uuid": "34b7a758-5160-4e5b-bf6c-6d4885989c35", "value": 760320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629928323, "uuid": "0b857a02-844b-438d-a07d-d441ee557225", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629928323, "uuid": "0782bd84-79b1-4aad-ae48-82b1711e619c", "value": "BIOBARICA OC CVE6535 _TVOP-MIO 10 (C) 2019, pdf,exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5ef21ff-05e9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629926295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629926295, "uuid": "71942460-ec1b-4132-851a-5cc60f8ffeda", "comment": "Malware payload (Dridex)", "value": "ff21b8eb64d474799c99cd9e4aeebe85", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629926295, "uuid": "dc0daf80-0a59-4c54-9b54-b7144361123d", "comment": "Malware payload (Dridex)", "value": "c0a50610efbc33fb1eabf22c8117a9ac241d70791dfd8b148f9e4af8ba849c6f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629926295, "uuid": "0c5047b0-1539-4233-bf6b-6aa4207309f0", "comment": "Malware payload (Dridex)", "value": "a2c44cc27022f62f1cfcb439a79ca0e7aa98b40a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629926295, "uuid": "94abf2ee-4ca1-46c7-aeb7-9981dcaeb2dc", "comment": "Malware payload (Dridex)", "value": "5e649dc5e798eed79ba82cb1216a1001de60cfc7dd24b79e46b7e7d57ec8f630e59ad9d83d136b33815601282797d099", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629926295, "uuid": "8ade9689-0370-40d0-9775-30784e4755f2", "value": "T11F14BF07DF6788A4F9760C754476B237556D4C0E8219EB52CB8EFBB6D03268388B172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629926295, "uuid": "f405256b-3a05-4813-80aa-00cd052f4305", "value": "e14682cd580b5bc2ebf0ee1ec113cb1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629926295, "uuid": "da1ee6dd-ab4c-48eb-bca6-e54c47e80131", "value": "3072:5A8JmK7ATVfQeVqNFZa/9KzMXJ6jTFDlAwqWut5KZMzfeAAAoCo:5zIqATVfQeV2FZalKq6jtGJWuTmd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629926295, "uuid": "44d72a20-959c-4bba-bb68-5fa93180ce07", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629926295, "uuid": "f4f12c44-f666-4f20-8fd2-413bc5e225a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629926295, "uuid": "b0e5c699-9d5f-4d95-8566-533e51d95a65", "value": "ff21b8eb64d474799c99cd9e4aeebe85", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23f90bf6-056c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629872255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872255, "uuid": "24a5a160-59a0-4175-9c81-a30d15e762a8", "comment": "Malware payload (Mirai)", "value": "4b02ebe6d154bc02027089c84f5908c2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872255, "uuid": "a9316708-71e4-46c0-9c72-7aa0dc47306d", "comment": "Malware payload (Mirai)", "value": "c272d1c2f4dcbab311b064821a2a8ae6613e5e30eeb880c2eaa5d1be350c2154", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872255, "uuid": "e6b18a81-db2a-44db-92f7-6300700b740f", "comment": "Malware payload (Mirai)", "value": "760d2b5f0bf45ad3a5ae88b1750b0def4cc984e1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872255, "uuid": "9234ab74-064f-4682-8910-5d3c874c0338", "comment": "Malware payload (Mirai)", "value": "e6d9bdc455a9b1ba9785ff16386b1aafcd9512c42e3ddaad0a4d085f7b1a458cee9b0d253d45ed410411e073dffc8486", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629872255, "uuid": "8907bb39-803b-4fbc-88ae-645a6379f86b", "value": "T14723F2ECF6F03B90CF781474F1990A63251255C9738B0954AF06AED4F634E27BF564A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629872255, "uuid": "f737b38b-488e-43a0-817e-1de807b2d726", "value": "768:1Xu04w8OkKBmHk6ItvUmsWvkVii3XMe+8NJ8+5EN5yx0wbWWX:89cijIDAVii3t+8AC7X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629872255, "uuid": "8b6b179a-0877-462c-a497-1ec86417bbee", "value": 49868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629872255, "uuid": "6a1c5218-98f0-4286-ad8d-8af8b1f70f09", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629872255, "uuid": "ad2e2cc6-fb1d-4d4c-896e-69bb1bbaebc4", "value": "4b02ebe6d154bc02027089c84f5908c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6f8beaf-0555-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629862651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629862651, "uuid": "3ed4e694-c45a-4453-a445-98a29194c57c", "comment": "Malware payload", "value": "0ab21e0c95887e10cdc53de96d1cc58b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629862651, "uuid": "7cb149cc-db2c-4ab6-993a-e554db3999a6", "comment": "Malware payload", "value": "c2f8212dd355fe0ec8bffd8289bd79d5ba3ab1e20978e06ef93493c6513ab471", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629862651, "uuid": "78435215-9f10-4717-9a32-2ce03fa4edba", "comment": "Malware payload", "value": "c61077ec93c6a5125ed92e3b60a341c0894d623d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629862651, "uuid": "9ed1a675-4802-44b0-b18a-0de67b18c652", "comment": "Malware payload", "value": "177db603892dddf6e9e7fb9419d614af4c6e5b7a5e8f2faf9f54add048994e938cc051c42c8c169fccd844594baad033", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629862651, "uuid": "a714df2a-e175-47d5-9793-8ae700f8e12a", "value": "T156C66B027690CD25E0BAB732C7261CB0A3767C59EF63D7D71884BBD63836742AD05B1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629862651, "uuid": "eba0ac42-c08c-45b4-b073-7cb220ee61df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629862651, "uuid": "9dbc9fb6-5562-4659-a304-338b8035e5fb", "value": "196608:Xup+wMVgBZbBhTIhTChTBhTAhTZhT3hTbhTKhT3hTzK+qabhT8n4smE2CMgWeMyg:qMVgBZe+qamAE2Cug91fj6a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629862651, "uuid": "9156db61-ac5a-426c-aee5-8acc63f18ad7", "value": 12571648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629862651, "uuid": "37b698b9-4c22-4209-9d01-7ea10e9248bd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629862651, "uuid": "78f5645a-fbb6-4d58-9186-0c21266fe093", "value": "0ab21e0c95887e10cdc53de96d1cc58b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5a8c5e9-055e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Hancitor)", "timestamp": 1629866514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629866514, "uuid": "e77e9d3b-e294-4af6-b510-fe0cf7952337", "comment": "Malware payload (Hancitor)", "value": "9b4fcd22f6240318fa36a91922cfccf5", "object_relation": "md5", "Tag": [ { "name": "Chanitor", "colour": "#3242A0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "DocuSign", "colour": "#6C3C77", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629866514, "uuid": "7928ca09-7e16-49da-966b-04c92371fa72", "comment": "Malware payload (Hancitor)", "value": "c3c4f4f918261928351db2ed00da67c43e9cb96d54b232252165f95653767b4c", "object_relation": "sha256", "Tag": [ { "name": "Chanitor", "colour": "#3242A0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "DocuSign", "colour": "#6C3C77", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629866514, "uuid": "7dccc74b-01a4-478d-bc3b-7c2b549025b0", "comment": "Malware payload (Hancitor)", "value": "795bbe08e711ccd3d1b9d6e49d6d85612f8f8e6f", "object_relation": "sha1", "Tag": [ { "name": "Chanitor", "colour": "#3242A0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "DocuSign", "colour": "#6C3C77", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629866514, "uuid": "fc807571-a310-4b66-9526-a9968526ce11", "comment": "Malware payload (Hancitor)", "value": "240fdbdddea6db5143215985c7658af39b0b8871ec3a48fb8d471bb0f7da528aa30a51993405b639d349815e2439b310", "object_relation": "sha3-384", "Tag": [ { "name": "Chanitor", "colour": "#3242A0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "DocuSign", "colour": "#6C3C77", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629866514, "uuid": "22c8cbf0-f9ea-4807-b81f-e7c0633300fb", "value": "T1E6D40107B986DE03E04ACB397EA5CDA9376DAD059E08F3C771607B1E6BB13219D0354A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629866514, "uuid": "60e926dc-9049-4a5b-b0c2-3443ceef7f1b", "value": "12288:pV9iQsDr8NfEUYfwg8I3HMzNK3Rb+jC4xU4WhF:pVXkr8N8UYhR3HMBK3RMeF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629866514, "uuid": "d8093c74-5589-42c8-a856-8978b8f2ea76", "value": 638464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629866514, "uuid": "2448b8b5-5330-4ea9-94ae-79e7dc049129", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629866514, "uuid": "87081699-bb87-49c0-ab59-3a4983b895e9", "value": "0824_7552110168.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "534a366e-0586-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1629883502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629883502, "uuid": "56649f51-ce78-4778-a821-69b50435290f", "comment": "Malware payload (AveMariaRAT)", "value": "de6b46d86d773ad0ea18e3d7762a0279", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629883502, "uuid": "3adda61e-b08b-4e78-b8e6-c7fb88388f41", "comment": "Malware payload (AveMariaRAT)", "value": "c3eda1ec3ed1ef66e2aa1492f07a8f4ff3a5868e20dc344c3dfb1d90eec46fb2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629883502, "uuid": "e88ecb54-6856-40b7-ac86-a98a9b035fc6", "comment": "Malware payload (AveMariaRAT)", "value": "86d094d5086c53b3d185e0843c68faf16bf15896", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629883502, "uuid": "07f8ea99-07c7-4e8c-b01e-f4e6886a2f37", "comment": "Malware payload (AveMariaRAT)", "value": "d6602f7f6bc9bb434a61fd084df3128ea6b560fd18f6de3e920f97c07018c756a272c03663c3de6642bc777a6e9bae83", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629883502, "uuid": "481c1f36-7d0f-4034-b66d-829b70198885", "value": "T1FD6422207A7AD2B3E77E43BA1E3104409372AE757091E6813CD909DAA5BBF508907F4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629883502, "uuid": "8da372a2-e738-4ae4-ab7a-d6097e1146ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629883502, "uuid": "8b433e26-7f1e-47f4-9dd8-a04864fd77a3", "value": "6144:7ZbDfHRF2kvlg7cwdJVGVgyXY9dY7tGjOnUSwg0JqK0ZxIro:7d5FXC4wdPGfo9dY70DJqKi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629883502, "uuid": "7a676aea-f6de-4196-b25e-a8c57e74abf8", "value": 335360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629883502, "uuid": "9834410b-cf69-4747-be83-89edee829721", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629883502, "uuid": "473a6017-93e0-42d5-9665-0c4962b0bda4", "value": "de6b46d86d773ad0ea18e3d7762a0279", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50b6997f-056d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629872760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872760, "uuid": "1cb1238b-b1a6-44d3-a2f3-8f16d21d8415", "comment": "Malware payload (RaccoonStealer)", "value": "65dd682e3162578c2b0e62c9cd18e4e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872760, "uuid": "4c1633a1-db4c-4fa0-a58b-5cd5888d96ba", "comment": "Malware payload (RaccoonStealer)", "value": "c496418015059b9a51ed09dd0849efd8c8c4ef886bad6adb8a1ee41dc6b4195d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872760, "uuid": "8b54649a-5127-43d8-a49c-885407532175", "comment": "Malware payload (RaccoonStealer)", "value": "afad8b33a08a154da261cf19f51dde937c9f5ccf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872760, "uuid": "54e3403b-89aa-4068-813b-e26d930b7099", "comment": "Malware payload (RaccoonStealer)", "value": "62e657573ce1b857c6516d0ced51b5aebd63543f244f94f9c4adc827c622d4694a399cbb5a28146214560fca819424ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629872760, "uuid": "83569713-af1c-4b42-b912-760399f98e3a", "value": "T154B4E131AA91C435E8B261F4857A93B8A93D3EB15B3440CF63E626F953346E5EC30787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629872760, "uuid": "20f1a866-bfbd-49a8-961b-3d80d7871c14", "value": "ddbb3eef631957f988f10b48742f9549", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629872760, "uuid": "ed9e5682-ef01-499a-a6c3-1ea9dcb31514", "value": "12288:NZXhi6OIINaTFh61bSyLpOZECZD3zXC62WCdX5X2UewQv:1OIIVTO3xXtxCTXJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629872760, "uuid": "4deadb1d-7322-477e-964a-5bf9b58a21bb", "value": 540160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629872760, "uuid": "5dd11f25-8d71-4e14-843e-be61b5377930", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629872760, "uuid": "43750736-7e9f-4f2f-83c4-f3d583480e20", "value": "65dd682e3162578c2b0e62c9cd18e4e6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2275b84-0578-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629877648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629877648, "uuid": "28adc252-064a-4d08-b7af-f5223a1fbdaa", "comment": "Malware payload (AgentTesla)", "value": "6fc28f54b5a3b85ae1589c33dda67ea1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629877648, "uuid": "a5bd8bc9-36ea-40f3-b26a-3e87ca835580", "comment": "Malware payload (AgentTesla)", "value": "c511853d2df7a1c91ac2150f3f4973c1606db8f31a3aa5c676528c1779bc21a5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629877648, "uuid": "9995ad95-8ab5-4116-987a-e2de0d6bd55b", "comment": "Malware payload (AgentTesla)", "value": "283f84260667f1d76a434c7ba1bc21a1b8978abd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629877648, "uuid": "e0ff3c39-cab6-421d-bb6e-9264e9cb328a", "comment": "Malware payload (AgentTesla)", "value": "a6fb197ed54e796b594f4851838eb1299a703ddd69145d768bd1fb120adf8cd40917be74910fc9f5d6f254219d265ed9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629877648, "uuid": "4178d478-c484-4788-8bc0-19bc0690092c", "value": "T115C5BFF876047DE6266F576BDA96ACDC13B616339ACBA4CC4064BBC305A3375EE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629877648, "uuid": "1efc5f6f-74c5-4b0d-aaa9-92c3146e19e9", "value": "24576:UDOB3vEYconzQWbM8Vd97+t9WrtCxsCfMdyvXusAkpUrGD/LMEn3/Obw74eFlYoI:1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629877648, "uuid": "3b6d65b4-af4b-48ac-93cf-df4bf254e9f0", "value": 2631877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629877648, "uuid": "f4e53055-791b-41d8-8abb-8ae12d1ccbfe", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629877648, "uuid": "59c7afe3-1711-4ff1-b8da-21f3a83a72eb", "value": "ORDER-ASLF21T33.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bf982e2-0574-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629875785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629875785, "uuid": "3ecd607b-d45f-4336-ae3a-38fdfb639dde", "comment": "Malware payload (RaccoonStealer)", "value": "ba96158061a6539ba5e2b85e69609001", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629875785, "uuid": "dd6e8811-9847-4184-a304-5ddf36c34c18", "comment": "Malware payload (RaccoonStealer)", "value": "c5577bb5b44d4876cc6e6a0260dd0f0956bd70b945793df747fa2fa4e51ea33e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629875785, "uuid": "ea2214c2-92f9-4480-b688-aca615ca8100", "comment": "Malware payload (RaccoonStealer)", "value": "576ee820a00f3fee2b294618f15f8dbd946e9b4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629875785, "uuid": "e41c5d00-fb43-40f1-b48c-71f3b59654b0", "comment": "Malware payload (RaccoonStealer)", "value": "d6b219a3237932fa302b466051d25693e63b2bcbdb09d722954d0845fc6062520c6494a64d00e5da8e7b643048f68bbc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629875785, "uuid": "12671970-3485-4c80-870c-385761d69b86", "value": "T10D64F1013670CA73C5168AB248E2EBB2E63E7D515EA0814333E8EE9F7E352D07719755", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629875785, "uuid": "c86506f3-e4da-41d7-a5bc-208e5f6f5af8", "value": "bd3c9edf948deca79ee5e78523f1a042", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629875785, "uuid": "4d2c6b1a-a8db-41b2-a2d1-ab3580ce747e", "value": "6144:yQMG0zUBvM7qcQRqAnHsBs7snq8bEcxb:yQwzyvM7Sk+72lEcF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629875785, "uuid": "ca113d22-2aa7-42ab-a78c-e18a9dce6cad", "value": 336384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629875785, "uuid": "de041fae-1317-4134-bbb6-fab23b06bdd4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629875785, "uuid": "0ae56fba-dec8-4aba-aeda-0e61a9ad82f5", "value": "c5577bb5b44d4876cc6e6a0260dd0f0956bd70b945793.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea81ecc2-0564-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869153, "uuid": "758e940b-7b45-433d-9d8c-6e885ce66046", "comment": "Malware payload (Dridex)", "value": "a74fc66d1394d5338c30a3a8491c0ad8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869153, "uuid": "624945a7-dfb4-413a-aac1-e3839f5ab251", "comment": "Malware payload (Dridex)", "value": "c5f471cbef8a985a1c39d475bdc2e11b3f4360c939b7aa7588136c76a4d3ed3b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869153, "uuid": "4cbf7c0e-7015-4fe5-b7f4-009942ae4fb7", "comment": "Malware payload (Dridex)", "value": "ef58b332dee557c17827637ddd5cd68d5a046497", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869153, "uuid": "afc58317-4dfb-4d7e-9314-1a5707ba9474", "comment": "Malware payload (Dridex)", "value": "0daca5f1b89aeacc581f6c6ba8b12796f7cfb4d50feefdb01d327155055ce68b3fbebff9c0fe9c57980b3276d9c36806", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869153, "uuid": "56e13303-d60a-4ec0-aaee-0a5c3bca8c4b", "value": "T11D74122896A1C80CD45E413F92CB0FB2E7625E46A6C1BF1F95B1B30D5F0397DCA6A06D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869153, "uuid": "528c3df5-5972-4531-a059-97afc570cd48", "value": "6144:or5Gljb8Mp2LohOGYw6CC5jTT453mjEIbWiGVAKSLFN+YInSCRvuPsxNe:g4YL2OGY/TTy2jEIJc6FNu3uPmNe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869153, "uuid": "575f935e-cf8e-42ce-9320-1c042ecceca1", "value": 363764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869153, "uuid": "332a7e32-97ca-44fe-bae0-873da2a5892e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869153, "uuid": "d13cfd23-259b-4d27-b14f-ed485869100c", "value": "EoY_TAX_Export-15218_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd07063c-05fe-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1629935219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629935219, "uuid": "f6166378-77d8-4a90-99e5-6227c359296e", "comment": "Malware payload (RemcosRAT)", "value": "a33baab448aea76f5185ac829a93175f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629935219, "uuid": "3e41b8a3-fede-4db5-8fec-4632d9252261", "comment": "Malware payload (RemcosRAT)", "value": "c604a94098b0c9726cc0b6dba1df5693ff0e6cfbe28093f071d257671471d230", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629935219, "uuid": "4757458e-591f-42bc-bcb7-efdeaff67820", "comment": "Malware payload (RemcosRAT)", "value": "56004b1151939bd942b2d6d7009c44f04d4c65e1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629935219, "uuid": "d74560bd-5f97-4620-89bc-1912b5b614cc", "comment": "Malware payload (RemcosRAT)", "value": "e0cd0d696e435dd421e6fe54d660ac657c8f3568e7a78d488a8c081c84f433adcfbc29707fe898533fd108346bd69df8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629935219, "uuid": "085102e3-663a-470d-90e8-32eee776954d", "value": "T146A4AE12B4C1C032C57312700D6AFB65DABCB9202D3549BB73EA595AEE710D1FB2A673", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629935219, "uuid": "2bb8b467-7147-4fb2-b995-0cdfd948c1a1", "value": "ec8ea73e2aa6f868311acc5b792bc222", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629935219, "uuid": "d373e3af-89a4-4756-8933-64018c9349bf", "value": "12288:fYe6UWhaT5xnDdLv9rX+1jZJqxE/ZjEZyib:16UWUT5xDN9IjZJsCZiyg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629935219, "uuid": "552ca831-c0eb-44f2-a453-a3d26eeacc22", "value": 451072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629935219, "uuid": "a250b965-345e-4b63-a467-84c14cd9dc78", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629935219, "uuid": "34176d2d-7579-47f5-bc0d-4bde57d6c530", "value": "a33baab448aea76f5185ac829a93175f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a94ae92-05e8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629925658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629925658, "uuid": "7f07d674-f9f6-4e28-af9b-5e8604e1eb83", "comment": "Malware payload (RedLineStealer)", "value": "87f96f49a1dc87e26e81a02809fbd6e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629925658, "uuid": "dbcb3408-fc4a-4309-8dff-443fe5d2a367", "comment": "Malware payload (RedLineStealer)", "value": "c62b515006bc08b9c7e66fedb39b4751a20fe34f19a322d7e40447c70937a6d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629925658, "uuid": "a3966efb-40ef-4e60-86fd-6ca3d94e7380", "comment": "Malware payload (RedLineStealer)", "value": "df6bfd279925eb7ec07055dd673719967979b175", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629925658, "uuid": "a524effa-0498-4077-8257-0a9199641057", "comment": "Malware payload (RedLineStealer)", "value": "f8d8ef2f0168a0e3df80a39972da923ca235ff80d122b3047b99af31d3683f30537c8fcff714b24cc8d249c1f2dba1ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629925658, "uuid": "5cefabb5-dc5f-4d08-bd54-617978ee54ae", "value": "T104D4EC18797FC019C0E7EAB12DDC94BAE9AA95E3604D713710B4A37B8B11B94DE0F079", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629925658, "uuid": "eeda6e51-d1d9-4d8e-a263-a2cde367cab2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629925658, "uuid": "ffce2d83-1159-4a24-a26b-282c6b553f5c", "value": "12288:laZX7CRC7i49TAWtLZoiU7Pf9afc8wfFA:St7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629925658, "uuid": "67ff1985-fe8c-46d1-9f61-7da5e8826604", "value": 602112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629925658, "uuid": "c880145f-f724-46e9-aeb4-2f2e9c7c0d81", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629925658, "uuid": "9072627b-6232-4d8c-a64c-d0e0d822ef38", "value": "FOXHACK.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ff8cc6d-059a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629892220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892220, "uuid": "b409d745-55ab-481f-bd2c-3515832094e4", "comment": "Malware payload (Loki)", "value": "36185ec0950db83f2f8fc9543481cd3e", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892220, "uuid": "d34004c4-685e-422e-8498-9e2d52e9664d", "comment": "Malware payload (Loki)", "value": "c72431033202a9e4c4ad3428082a85d98ebab24d21e4a54dafeef9be4cafbc94", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892220, "uuid": "cd18b245-19c0-41b8-af60-624d1fa2c345", "comment": "Malware payload (Loki)", "value": "c4e5b55f2a0da2cc02d9aafd7890dc4c31438643", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892220, "uuid": "9bdf596a-f6ec-4e82-95d8-971bf87d63c5", "comment": "Malware payload (Loki)", "value": "ef3bd141cc7768289124b809c656bd8a5db5cab3bc846410876daae5f919077392d88bce80f16b456fb417df9bb96b88", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892220, "uuid": "123e61b4-c882-4b66-a103-eb24a35e7849", "value": "T1595512397AE29F42F406EB3DD8D1901D2986BCD437038C0D970C76A567F89B28BC9B59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892220, "uuid": "365b3f6a-5556-4c7d-a673-2e6e9d9d8516", "value": "24576:oKihu180D/sbucBdojFyp6/zwnbWw3jt3JI69CDiW:CK86zcgFypH3jlJ39ml", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629892220, "uuid": "54ed3f20-aa7f-418d-b6f4-ca2c2bd3a34f", "value": 1318400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629892220, "uuid": "f263be50-d6ae-4dc3-a9f4-3d8f1ce84908", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892220, "uuid": "bc338793-0768-4877-825b-9b102f67a67b", "value": "Swift copy_789654.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1fcf60f-05cf-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629914987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629914987, "uuid": "3c6a3cf5-3a92-403a-97aa-8dc11ae0d572", "comment": "Malware payload (RedLineStealer)", "value": "0d52fa8c79bf1d4da433a9b179dce597", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629914987, "uuid": "2739f1b6-e22f-4912-ab44-99ba0b25af83", "comment": "Malware payload (RedLineStealer)", "value": "c786f20d3e96a3c55f01d4c6b63b08f8b45bb4799303a15eaf0086e4d2ae87e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629914987, "uuid": "f8309647-a7fc-435f-bdc7-3867a709c299", "comment": "Malware payload (RedLineStealer)", "value": "ef030808356b4d042982c357ef9d67560cbc9b6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629914987, "uuid": "442936ca-ffae-46b7-8c35-18bf8f6aadbe", "comment": "Malware payload (RedLineStealer)", "value": "2768051004c8dd7be974fd0a5442970cf83322321a279a39cd4863bbee90aad75ad4546e25ba817f8d8fb50a7e59c12e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629914987, "uuid": "ccf31e4a-670a-459e-b82b-a9ca59c44c5d", "value": "T17AD43973344515F2F53D1BF12B86AA7259EE6E3B1DC0499A63DC31F8947226082AC27F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629914987, "uuid": "af0768f3-a97a-4137-8d11-21f600c6ad65", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629914987, "uuid": "68ff1b11-221a-4809-9e26-05dc215c94f1", "value": "12288:NRZ+IoG/n9IQxW3OBseESyzbX24nC5LNPmEq:F2G/nvxW3WFy3S55hq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629914987, "uuid": "9b0a32f3-41c9-406b-ad5d-6e274d6240c5", "value": 617195, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629914987, "uuid": "928e5daa-37f2-48eb-86ed-c426775215a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629914987, "uuid": "d589bc70-178e-4899-961e-1a402cc1728b", "value": "0d52fa8c79bf1d4da433a9b179dce597.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f56c015-0565-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629869375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869375, "uuid": "4b51d969-ce27-40cb-9801-54555904b7b1", "comment": "Malware payload", "value": "8a83a11876cab205c271bd7b6d554396", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869375, "uuid": "96f021cf-2c88-411d-84c1-a0e4a7fadc3d", "comment": "Malware payload", "value": "c8cdf41bf3adcc232c55c714be95978a2694abdf3d25b6cf68fb41ec50d8191f", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869375, "uuid": "3156ab5e-271c-4724-b9ae-6ddaf86ae291", "comment": "Malware payload", "value": "bd4b88b50a6b236af2eec236dc3f97cb86de4139", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869375, "uuid": "ffb7d2b7-50c4-4300-a84f-5acac52ddf36", "comment": "Malware payload", "value": "1c2957d0cab17f13051c2a60566996698a3483430a04732a2c657a8345b05cc5c7ce53797f8f311076fba15f2324d5c6", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869375, "uuid": "52a89eae-b988-4848-b83e-228c2590e52e", "value": "T10C546C06B3D98236D46F07725ACF83A2CB71EC64B71381176698BA4E3DF0640E6677D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869375, "uuid": "13a189c7-8531-4384-b7a8-fb8a71eef563", "value": "3072:7fFB9HAgYewgz88ereWn/7w05g0TIuYK6lIz2L9rQn4J9+3Z5yOV2n2:7f1AgYb8er1nzTNIKN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869375, "uuid": "d7caaed5-b33e-417b-b247-0224944419ea", "value": 293376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869375, "uuid": "edb19b59-0c49-4257-a473-30114eafee0c", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869375, "uuid": "3815a9d4-3273-4db4-94f3-d4ba698e195d", "value": "0195+judiciario+0048+_22208202101UCwJ.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3094afef-05d1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629915656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629915656, "uuid": "8b41dbed-fea5-43ad-9aec-ae35af8eeee0", "comment": "Malware payload (Mirai)", "value": "0e8dda8ce23dca4b6b11d16ed69e8e66", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629915656, "uuid": "74e834da-85e0-47bd-b8a7-834b579f60b8", "comment": "Malware payload (Mirai)", "value": "c981f1b31b74cb2c7c33f9d81ed8397a7eb741d720bb4f2ca96f5b339cdf504e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629915656, "uuid": "03c80c59-4f8c-47b2-b96d-218919fc1642", "comment": "Malware payload (Mirai)", "value": "d361fce77930ec4967d22c823be970f55afa0f2b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629915656, "uuid": "44ec16b1-220b-41b0-bfdb-f9d2c185f52e", "comment": "Malware payload (Mirai)", "value": "6ad24ffc010535da826875494939f011a79d49a683460ab5f9edc8665ff035a52e38d3657d6dbebc7249c97593b66244", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629915656, "uuid": "44061d95-0084-444c-be08-75b155f87a8e", "value": "T1E6634A82F9C2D212C5D5577AFB0E428C372257E8E2DE7203CE295F2237DB56A0EA7151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629915656, "uuid": "4a193631-f57a-4f2d-a410-e30677764a93", "value": "1536:6icfvtwaBwg95kv91gSAHefzxpGLX7F6TM+vlv:kHrungSAHe7xp+7g7lv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629915656, "uuid": "34a8edd3-8f2d-4677-a4cc-86ff6868bb41", "value": 71448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629915656, "uuid": "5ae1b726-23a5-4d01-93b0-a189ced937d2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629915656, "uuid": "7b2252d0-e2d5-48ea-9f06-d85cd4c1f3d1", "value": "0e8dda8ce23dca4b6b11d16ed69e8e66", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "355f9e6b-05d0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CryptBot)", "timestamp": 1629915234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629915234, "uuid": "73296edb-25c5-469c-a2fc-5ab0b9f8c475", "comment": "Malware payload (CryptBot)", "value": "eb6b6b4f0970c825bbde733784027a52", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629915234, "uuid": "f4abf850-9cca-48eb-a805-729552050c38", "comment": "Malware payload (CryptBot)", "value": "c9cf9521886aaa99c317b33c9fd5a8f82be1fe61d8616bc6ce8a10c4d26b6e21", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629915234, "uuid": "9168472d-d0be-4350-9e90-f7aeae1afa6e", "comment": "Malware payload (CryptBot)", "value": "33e928ccbe9fb3088a0e94ece28b39cc9ccac8ef", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629915234, "uuid": "2c9fdc28-a877-4168-8eb0-a1727730a847", "comment": "Malware payload (CryptBot)", "value": "4d221cb3b4acdbaf9e806622585aa0d3061e7f1d47f265fc40fadefe6ffd2eb7a91911d317d5345c938b7491f8012dce", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629915234, "uuid": "28e9eec2-4498-4e0e-8b49-406a5bc5875a", "value": "T127E5334DB50A7A02CE61197187B8C5C0BFA2D992A75F11702E0F59BE9A1223E4FFF711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629915234, "uuid": "0bbbb7b3-da65-46b1-8715-c37524065ae7", "value": "f8d9e6f58bdad8d3f277d01c805576b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629915234, "uuid": "805b3b24-6738-4867-9c30-dace1f70e150", "value": "49152:RPO2xOD0wD6XH67JeVIE1iplrlhwaT4dn/kFjkOWS356NhOHYGWOBJZ8bCd4YIg:R22a0oJeKEwBln4dcFjCC6NhEvWOvk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629915234, "uuid": "9af7664e-5b31-443d-9634-a049e6fb1ccf", "value": 3123712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629915234, "uuid": "eb70bd5c-cbd8-4412-a609-affd8c62198b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629915234, "uuid": "70889a28-bd34-45dc-a6ba-da1095144688", "value": "eb6b6b4f0970c825bbde733784027a52.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "073dc3c8-0565-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869201, "uuid": "382c3cd6-0271-470e-a845-676879c9ebf8", "comment": "Malware payload (Dridex)", "value": "ff0a64d14ae1c391908fb437ae651876", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869201, "uuid": "51cbc110-cbfe-4edc-b543-509cdb0da351", "comment": "Malware payload (Dridex)", "value": "ca4ca4a7381e4b88bcfc9f01a88f127f6e3628647f55d3c68164147a883977c0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869201, "uuid": "f806272e-9948-4637-9f28-412843543dc0", "comment": "Malware payload (Dridex)", "value": "75f143e8970b75bdb66cac242637cb85ab8e769f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869201, "uuid": "962f9a11-62bf-42c1-9999-c24bae00fc40", "comment": "Malware payload (Dridex)", "value": "a901296c424153260f71e7e0ecfbd80eb803835c7b4d2b5a0ce7d18d2d392db56d4f36dbd7865123ff22603a7e0b0c27", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869201, "uuid": "27e774f1-db8a-4556-8046-df7fc7fc45af", "value": "T189C3E09A7272DA9CC019433E61EF6FB76B748F8156D31B162129F81C6F124E3EF00528", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869201, "uuid": "ac635eda-b52b-49df-ab41-8758c51fb791", "value": "3072:oUmdmwL6iQU4IDSf7AAy+4i63LD6z2qoaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaay:oDdgjU4f7Aw67Moaaaaaaaaaaaaaaaa7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869201, "uuid": "65a3c48a-85ef-4e64-baac-201b5a41e348", "value": 122949, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869201, "uuid": "6a4da900-65d7-42f3-962c-a707984651fc", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869201, "uuid": "bfcfe5d5-119e-4ddb-a56c-4e6429fcb2cb", "value": "Details-9509227_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17f31468-05a3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629895858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629895858, "uuid": "a3156a38-601c-4990-b2b8-67a04666f729", "comment": "Malware payload (Formbook)", "value": "c518288f75b3d5ee671193c32f88be3c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629895858, "uuid": "1efb03d4-37e6-4b6e-81e6-95f55de1d031", "comment": "Malware payload (Formbook)", "value": "cab907df419f9a95b889719e1c302c9693f711ea74e2f73e60ce14f3284704a6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629895858, "uuid": "4edd9ca7-e2af-4f46-815c-f006918f411e", "comment": "Malware payload (Formbook)", "value": "28a87403823ad4f0d3a0a50f2a3b4357264cdea8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629895858, "uuid": "12d8c581-b8df-411e-8705-3efe98e08ed4", "comment": "Malware payload (Formbook)", "value": "c256bb51c80df335ac7a98cca5d9249bb7c6e7ffe2f74af9f49bd22218b2e0a3ea20105681998a4d46442af379a1e331", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629895858, "uuid": "decd8280-bae5-4759-ab06-11657c090554", "value": "T1AD73E19875B6A566CAAC89704F41BE3083F21D31E6CDF7A1EDB710B5DE693006520B8F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629895858, "uuid": "22eb11e5-769d-487d-bd82-eba33625848f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629895858, "uuid": "b66333c5-5ad8-49e8-b769-92f0369d8056", "value": "1536:OYNBAwAMglUoYAhMAYbcYMXgYUQ4ZQOFXh2M:OYowAMglUoYAhMAYbcY7YUQ4ZQOFx2M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629895858, "uuid": "9ad38ce7-be4d-44bc-a238-5d6adf63bd27", "value": 73728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629895858, "uuid": "a4610887-4423-4668-b100-b5cec0da17ed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629895858, "uuid": "58c712d0-aa44-459a-a912-49a954dcef2c", "value": "c518288f75b3d5ee671193c32f88be3c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87b248a2-0584-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629882731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629882731, "uuid": "ea0e7f4a-f3d9-40f4-b528-d6735bd2a89f", "comment": "Malware payload (RaccoonStealer)", "value": "7a12a2bbac62c80495e22248f22191d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629882731, "uuid": "25de977e-b9c4-43bd-bd4d-6a3678aedbbb", "comment": "Malware payload (RaccoonStealer)", "value": "cb2550692006b94a61134fe87345e79e1ab6a551aa667f45ad46954fee40e1d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629882731, "uuid": "17f094fb-7e13-41f5-b62c-519191b54d9f", "comment": "Malware payload (RaccoonStealer)", "value": "061125ff9f8ee0886d439e80986c2c6610f17429", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629882731, "uuid": "4ac04ce9-3796-40f5-9d87-0556eb72d1d2", "comment": "Malware payload (RaccoonStealer)", "value": "6a7a83925d07e2d43b8e47250c7ba710e977589c42fcc340ff0b77e322a1ea79dcef0b14593f31574592c00c7a44f4e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629882731, "uuid": "e6dbef08-0944-4b97-9cb1-11c19772612c", "value": "T1FCB4D0306A91C035E4F312F849B683A9B93A3AF16B7050CB53DA26ED57346E8EC31757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629882731, "uuid": "fe179200-2171-4f1b-b61e-5a143ccb501e", "value": "1f6e2c775b734b85a15accb3c4cb4a32", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629882731, "uuid": "78e099b0-2599-4842-a7da-11f9e64f5196", "value": "12288:Ffdx12zi8bAGRxA1fE0qbkoO7kbj89RTOXjEmXjP17:t12zZOfEZu9xOzj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629882731, "uuid": "d6f9a375-e123-4f19-8e3f-240455f788c1", "value": 534016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629882731, "uuid": "4ac69889-ef83-4d6a-a9e5-d2d384659bdc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629882731, "uuid": "4588291b-329a-4ab7-a3d7-e1579c7d042b", "value": "7a12a2bbac62c80495e22248f22191d1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea4d09bb-0578-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629877742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629877742, "uuid": "93b71538-7c8f-4d75-900b-f79c8ba2e114", "comment": "Malware payload", "value": "b01e74a2427b992018e231e9300eaea0", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629877742, "uuid": "bbf060ac-12cc-4266-9ce4-b04d7adbbd82", "comment": "Malware payload", "value": "cb4f55308ba1f8617c00505983b42da10d704960a1dbef03075f370015f6f21b", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629877742, "uuid": "cd6cdc21-7258-4864-adde-edf57bb11667", "comment": "Malware payload", "value": "89aa1ca3c6db091bf5769e9bdd21570ef5111aea", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629877742, "uuid": "f68bb035-423f-43aa-9810-85394580004a", "comment": "Malware payload", "value": "e4df5680c699d48096b84bc90452b2a35d4b8ba8865bd05af6901c2d87df63aa20a5d014ba38e47f09ac3f8d9b1acb92", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629877742, "uuid": "c077def2-eba9-42e3-afc4-431afd74eb5d", "value": "T177166C13B285953FE0AB1A3A89379694583F7B617A168C4F67F40D8C4F395803A3A74F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629877742, "uuid": "8e069495-4e52-44af-9ef4-08dc461e96a9", "value": "49152:KZAOYKOiVyyptfYSELBJuYM9Lnl102g7BXOrv28l7+GXCOON15Y655CTj780vZMJ:fOYKOi8BMdlG5OrwGlm15b5u780xhA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629877742, "uuid": "66b3a25b-d3b4-4ac7-bcfa-bc9f2e308272", "value": 4382208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629877742, "uuid": "3b791be8-2040-4e7d-8d2c-314e917347f6", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629877742, "uuid": "899e4ec1-d5df-4570-95ce-2a7b0d82d049", "value": "vencida_qzkvlnqvlyn.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d6cfd03-056c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629872271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872271, "uuid": "6cdf22a5-50d9-4251-b140-e0108a489a1d", "comment": "Malware payload (Mirai)", "value": "ba921f7222422595d2b4740096585110", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872271, "uuid": "dd2fe858-4b6b-436c-9e87-4ec40f623ea3", "comment": "Malware payload (Mirai)", "value": "cc5552ece5c5b4254162a574adcb559486f05c647b2b7aff42ec083c6c40761f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872271, "uuid": "60e14431-3bc8-44ec-a2dd-fcf076af9fbe", "comment": "Malware payload (Mirai)", "value": "207c7921413770b4f49ad762eb06a51b5cb1c43e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872271, "uuid": "0e287004-d4c9-4fc2-a5ce-0ffd64bec378", "comment": "Malware payload (Mirai)", "value": "e6ce56847f3311041a163aefac4ac78766077cf9809183e1d4adbe6ad89a9d6e0859e8c5190d39554ea9b541ed52e8d1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629872271, "uuid": "2628c859-c14b-4742-bf33-fde8a360c178", "value": "T1D12301BDE574388CCE2C4B7DE1A91377216110563AEE15FCF2059DD031A0FAABE1A8E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629872271, "uuid": "0b96bd0a-a922-4a5b-bed6-7f4dc1a9d961", "value": "768:tXu04w8OkKBmHkGqEflaFgNIxDW5WIA5a4ta9tJD3djWW3:E9cinzQD5W5TjJTV3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629872271, "uuid": "dd46bdea-b9ae-41a4-adda-84cd0b4a20dd", "value": 49876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629872271, "uuid": "5c9bea91-26d4-4444-a10f-34e25477b1b5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629872271, "uuid": "41b52892-dbe0-4eb7-a877-ae59711633c2", "value": "ba921f7222422595d2b4740096585110", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32c1c36f-059c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (KPOTStealer)", "timestamp": 1629892896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892896, "uuid": "4c83507b-b2d3-420d-90d5-4fbf51e94f25", "comment": "Malware payload (KPOTStealer)", "value": "4fde5496bc06e055df52b93f304b2bf1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KPOTStealer", "colour": "#42A642", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892896, "uuid": "81657da6-5300-4f19-a7ba-c9cd792be671", "comment": "Malware payload (KPOTStealer)", "value": "ccd975821967733598a3d588a2ac2f65fdb2dfbc254713d3726c0709976dc9f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KPOTStealer", "colour": "#42A642", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892896, "uuid": "a90a7864-0335-4f7a-8275-72196cf2cc36", "comment": "Malware payload (KPOTStealer)", "value": "799cad76d1798518e4f56efd7d3b3cf37da84e89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KPOTStealer", "colour": "#42A642", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892896, "uuid": "e77274f0-de15-4ae5-908e-17207b4fc618", "comment": "Malware payload (KPOTStealer)", "value": "08f46760430f7ce93d7b43fb74c03bf542d355b8c404bb1441b062dc10def30f7e887c8dd60e230c918ce50b15d6c652", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KPOTStealer", "colour": "#42A642", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892896, "uuid": "e3c27447-47f3-42bf-8058-ff8ddc8a4274", "value": "T1BA8401007AB0C577C756947149E6CEB0A63E74A16C264247B7DC9BEF2F61680BE37382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892896, "uuid": "386dc289-0326-4fb9-92b6-6790cc86e742", "value": "bd3c9edf948deca79ee5e78523f1a042", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892896, "uuid": "26e248c4-b0ad-4f27-ab3e-423d419773a0", "value": "6144:VgHQEKFoXw7uUb0Ht8g0920ipqyXAyldu8rk+9/s0Gw5ORk2cxb:VQ/Xw7uUbg0929qyXAsZrn5fORvcF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629892896, "uuid": "c1e41a2b-688b-450e-958a-e216f1c92274", "value": 380928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629892896, "uuid": "fa3ed2f2-a294-48d1-8893-25a35f9a2238", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892896, "uuid": "6cd86917-6354-4f13-a154-e01334e376f5", "value": "4fde5496bc06e055df52b93f304b2bf1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94ace85d-0578-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629877599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629877599, "uuid": "bc73cc9d-62f0-4189-9260-1c63fd795668", "comment": "Malware payload (RaccoonStealer)", "value": "4a9f5cd2d8b9a22678fcbcc175294e9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629877599, "uuid": "b74188ef-acdd-475b-a94a-98f7a1ce9c62", "comment": "Malware payload (RaccoonStealer)", "value": "cce62e69f1139265fbc3cab853c4398736491df59c7924c5b393d835822bb6cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629877599, "uuid": "0a2c68a8-29f0-49f1-9338-649720ae0d72", "comment": "Malware payload (RaccoonStealer)", "value": "7055bb38194d4fc21531b54305f1a8a0aea137bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629877599, "uuid": "5e91cb63-1cf4-437f-8074-bc3d8303deb4", "comment": "Malware payload (RaccoonStealer)", "value": "33eca79b3e4d1e53b3489ad3eb06cfee7c38148ffae27082534f61e093bdf56f09c9027151196d95178235d3e7576917", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629877599, "uuid": "cdf55e6e-7ff4-46f9-a937-70e73ae0e97e", "value": "T161B4E031BBA1C434E9F211F849BA8379B53939716B3540CBA3E61AE916386F4ED30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629877599, "uuid": "0c1c0139-af58-437e-bacd-a97cabbd3e50", "value": "b1f244737f482f7370a4248faac2bcb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629877599, "uuid": "7e6a47f3-9023-456a-8b7f-fe04ebeef328", "value": "12288:gx8cAHjaf0SzOE6OWSkMN22/il/mi4riL:rjaLnkIGMr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629877599, "uuid": "8831949c-1b9d-420e-97e2-4e49bf4e2d1d", "value": 540672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629877599, "uuid": "923393d2-4dfd-469c-9bd4-53722dfcd97f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629877599, "uuid": "7274f48c-f8a5-4602-94d0-678d441618d4", "value": "cce62e69f1139265fbc3cab853c4398736491df59c792.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed7b8c7c-0578-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1629877748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629877748, "uuid": "650266a0-d547-403f-9148-6011dddbd140", "comment": "Malware payload (AveMariaRAT)", "value": "ea6fbcd47d872d3ceacd40c45d3ee4ba", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629877748, "uuid": "79a4e88c-bb80-4303-b4f8-393ba8238e63", "comment": "Malware payload (AveMariaRAT)", "value": "cd0e52835bf5ae6007a06f479aa3e4ad207ba4a534bda613bdba6a4f682dc66b", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629877748, "uuid": "b6fd8065-a3c2-4f3c-a26f-7eb79036ac5e", "comment": "Malware payload (AveMariaRAT)", "value": "b866efe20852bbe47bf581c9676cca0d85a1effd", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629877748, "uuid": "dadf4c0c-69c2-4bae-a543-c3c94165c63f", "comment": "Malware payload (AveMariaRAT)", "value": "9839196d421905a0a461d45ec052de1bde7ca6895d9d05812e43db811db2523429439725e71e65511384669b67e1dc33", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629877748, "uuid": "b2776904-0bbd-4eb4-a0e3-8d61a05c77d2", "value": "T1A734EAE4684F48B2D2498C5E6494B144AE74FEE334C6987223AFD434DF5ABF29EC4583", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629877748, "uuid": "09c2164b-0a60-4620-b872-895d59826d07", "value": "1536:ijfxnljZwtNNxFJoUA5ydNRPNelndzFz76mAg5eeVhMDw5wfL0:idsujndzFtr5RDAw5wfw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629877748, "uuid": "1eedb2d5-2d5a-4bf7-9892-ae010c7326a5", "value": 232758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629877748, "uuid": "06061d09-d4ba-42b3-bcc1-5bd8c06c4426", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629877748, "uuid": "34cf8676-1128-4af5-baa0-9d8a1f7c7567", "value": "RFQ 09566765366449001.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baf283aa-0546-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629856188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629856188, "uuid": "95ee2f81-c61e-4aa7-a6ae-795829dd3989", "comment": "Malware payload (Mirai)", "value": "ab4d877e09ca8809335568226e992785", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629856188, "uuid": "f4a21324-110d-447d-a7b6-fca695f00411", "comment": "Malware payload (Mirai)", "value": "cd4f8c719e21cedceaa8fb45977e5dcfd61cbcb240943a61f9e07da8cdd7b36d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629856188, "uuid": "eec8de31-ba9a-4d89-9b85-04d3fbc549e2", "comment": "Malware payload (Mirai)", "value": "587c02b4c5b745a8224d42de5489717514f5593d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629856188, "uuid": "68a23821-6939-4d3a-bea3-6960649be590", "comment": "Malware payload (Mirai)", "value": "cdb3526ddc3769922158a95de35227a4aed03a802ccc92d20f3f5bccf69dd34470e0191bfbf231b5248e16bb8f449a9d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629856188, "uuid": "8c152f32-b66d-48e8-8ce0-165177a0fea1", "value": "T15D53A509BF614EBBD89FDD3745A9074629CC550B22A83B75B934D428F74B24F09E38B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629856188, "uuid": "0d780aef-6fef-4128-9902-ea2ee701bcdd", "value": "768:b/BpmF4qgwi00pndP3oJhJiHTF3T+52ee3eJheMwiXzZXbCXi6Y/OlN0Ito8:b/BpwTi0kdqilKNKkhbwijZXbfOMIto", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629856188, "uuid": "f6d677b4-fd7c-4054-9f4a-50185205c506", "value": 63668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629856188, "uuid": "d5fc657e-85d7-4904-8218-b67b7155f6ac", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629856188, "uuid": "e19f2243-0da3-43aa-9866-d707a729f22b", "value": "ab4d877e09ca8809335568226e992785", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5592c87d-0572-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629874916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629874916, "uuid": "0dcd2b4d-6e26-4bbc-86ce-1aebe481b6fd", "comment": "Malware payload (RaccoonStealer)", "value": "d8eb46ce3c8e829e00efe21030832aac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629874916, "uuid": "234e7f11-ec7b-4ac0-b482-c75cadfa44f6", "comment": "Malware payload (RaccoonStealer)", "value": "cdd15469adf504c208242ffa61c212b92eb387ddd259b625fa9326af2963e031", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629874916, "uuid": "b1034cf3-18c4-4a99-8fc3-c4cf68169554", "comment": "Malware payload (RaccoonStealer)", "value": "ad3accdecc5718d3748479b3aefe21ca1b42cedb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629874916, "uuid": "d7c33ee2-7aab-4876-bf1f-27489e5a1418", "comment": "Malware payload (RaccoonStealer)", "value": "b5ac38f24f9751d7df68fc55a257a4a530eb90cb5febd6d9b4d8ce8d939714863b4091ab80ccce96cd325915df8b2db6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629874916, "uuid": "00ef59fa-08d0-493a-aedb-61ccf5709fe3", "value": "T1D0B4D03166A1C035F8B221F856BA83BDB93D7EB16B7440CF53E516E906286E4EC30797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629874916, "uuid": "d81e2570-17ca-486b-abc7-e1e8127317d2", "value": "ddbb3eef631957f988f10b48742f9549", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629874916, "uuid": "4d142f6d-c5fa-4f1c-9910-b9c96f29dc43", "value": "12288:yK6Lib1ViVWVotVgbh8AwJ9PFG/RZioPzbOi1nM15+ohmYpFav:h1ViOaDJA7JQ5xHpk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629874916, "uuid": "5e6dbe86-3b6d-40ad-a8f2-01165e80d452", "value": 539136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629874916, "uuid": "8c9efb71-b676-44d4-9213-a0db00901f33", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629874916, "uuid": "b71c82dc-48d4-43aa-8a49-3d3ba2aa9471", "value": "d8eb46ce3c8e829e00efe21030832aac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26d907bd-0577-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629876985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629876985, "uuid": "d021034d-4645-445f-a2cf-d1e2017d1c46", "comment": "Malware payload (RaccoonStealer)", "value": "eccb5b84530b16cb694ebc962db24ee6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629876985, "uuid": "d483a91a-5e16-42b0-a7b7-89231ef416e3", "comment": "Malware payload (RaccoonStealer)", "value": "cde6f548b217193df0994f2ffbc1548623f5f7e34752ce91ac39183dc4617844", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629876985, "uuid": "cc02060e-200d-463a-9786-1b3e6328c145", "comment": "Malware payload (RaccoonStealer)", "value": "4ddc06ee04e5515eb0eaa09bda2256d62bea5895", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629876985, "uuid": "791575e0-c1a6-460d-acff-85390c420d2a", "comment": "Malware payload (RaccoonStealer)", "value": "97fab9ca6633ef97fb99c8d0751623822772bbd6c9a5a83fc91b9b00a940ae54091864f8814a83bfb7dd77adfbaee57b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629876985, "uuid": "3f8fdd8e-b996-48a5-ad30-5be38f5513b6", "value": "T11AB4D030BAA1C435E9F211F885BA83BCB5397A706B7440CF62E11AF956386E5EC30757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629876985, "uuid": "1a45fdef-042e-457b-9860-a5609a7585f3", "value": "b1f244737f482f7370a4248faac2bcb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629876985, "uuid": "edf58bd6-5eff-491d-8aee-7bf7591becca", "value": "12288:Z79VANEPBFalWnFSnESbzPy9P6WOXnM995bq45WNvdQKhcFZO:0EPBbnF8bzPy9WnoHbq45i7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629876985, "uuid": "34d0974f-150c-48f5-9309-ff1f83caf685", "value": 540672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629876985, "uuid": "b883ce7f-3d5c-4ad1-a092-042ade6e0946", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629876985, "uuid": "40cf77c2-2b2d-45a3-a057-3f435798ff7c", "value": "eccb5b84530b16cb694ebc962db24ee6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c19201a2-05b8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1629905162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629905162, "uuid": "aec19a2d-8804-4608-bea9-952682b549d3", "comment": "Malware payload (Smoke Loader)", "value": "a09a430e59106b44d98395a59985c8a2", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629905162, "uuid": "5a474ee8-8b21-478c-abb9-114966e45cd2", "comment": "Malware payload (Smoke Loader)", "value": "ce6bf312014f9bb28d9007d7eedb0c455f3bc98196d55955590b7a7af164612a", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629905162, "uuid": "b7a84ce6-3e68-415b-b426-0c2f68fae6d6", "comment": "Malware payload (Smoke Loader)", "value": "92e555d09c6ab494518482e825c9a54314a7527e", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629905162, "uuid": "340ff370-012d-40cc-b3f8-db7a37dd3848", "comment": "Malware payload (Smoke Loader)", "value": "ba5a2c85a9f8482965c18f58e6969089c186bdf44efc3bdd61ac59d86f06d2328880aa414eaaa694277d6fdc301041ff", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629905162, "uuid": "a1e3df25-c2db-4819-9dc5-ccb64ad713c9", "value": "T1F7548C30BA91C034F5B252F855B683BCA93A7AB16B7450CF53E526EE06346E4EC30B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629905162, "uuid": "824e7340-459d-4611-b064-f08ff2ce0398", "value": "1d03ad9b9e9a9068c266e5f5e715b4b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629905162, "uuid": "027d28e3-4d48-4788-bcf1-f82dee9cd43e", "value": "6144:yC6Rk4sGi/q3clELc0y1H6sjabmw8ysYpVbEPq96TpUKD:7mi/qysg1H6s+mWs4Sq0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629905162, "uuid": "4d08133c-cd64-4e23-9742-c9f5a91eedbd", "value": 279040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629905162, "uuid": "efac0f09-e67e-4bc6-847d-d65850bd51ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629905162, "uuid": "3a77d4b2-e9ea-4b31-8eb2-c65bd0a986ac", "value": "a09a430e59106b44d98395a59985c8a2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb642dd4-059a-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629892347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892347, "uuid": "0fa347de-d6dc-4eb4-a9f7-5066e8191c73", "comment": "Malware payload", "value": "6afc61ba747c6d7daaec505a1b0112ba", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892347, "uuid": "76e0679d-2a41-4e70-a628-ed8dd42a9bd0", "comment": "Malware payload", "value": "ceb3fe93d06fd0e4696b9357f642aa59d2708275a0ce646e8f52a92592c55846", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892347, "uuid": "8fd902c9-8f56-472f-981f-8051d324c0fa", "comment": "Malware payload", "value": "3d028e6df0199a13c6c7c9696bf42c5749698aa3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892347, "uuid": "c5388758-73e2-4e2b-96dc-9327ee5f341d", "comment": "Malware payload", "value": "85495cc6d5ffebb80848c532b7964a3bda0dcb54f785b0f87dc5a8c1e77614a93a5772fe18044013b52402a81c44ea53", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892347, "uuid": "c592bca5-a7c3-4775-b065-88a42f51b7cc", "value": "T1AAF595C8EE16E96210572BB7BF12D0F4E7ED2CA420C88DB8D548B065F14E9ECD5E9790", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892347, "uuid": "60d8a126-7960-41b2-acfd-2e1608ee6f0b", "value": "24576:jRlfoIFryN050uq9CKZkll503wU/9iaC59h4FZX4V3fABj64KJ9xXqEOlSTvzFb1:UaAA9ZBH9+8PH6g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629892347, "uuid": "ae95963b-f4a2-4cff-8ace-7b7d9447070e", "value": 3348754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629892347, "uuid": "f77ef88d-0162-41ff-ab21-f3f64bd2333d", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892347, "uuid": "02c5e335-f0bf-412d-bc2c-74dbb12a4b84", "value": "33TF10183813377_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebd5ae38-05b8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CoinMiner)", "timestamp": 1629905233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629905233, "uuid": "4b010a07-ea12-43a4-8a22-7765924360a2", "comment": "Malware payload (CoinMiner)", "value": "b40b2474c4cc44f5545dec1b9ab4f4b2", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629905233, "uuid": "326b62c1-f164-4c73-b438-d50ec821e1e4", "comment": "Malware payload (CoinMiner)", "value": "cedead0402b84528a99183467e491dd9c106847eaa9090853ccf6fa522e1bb42", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629905233, "uuid": "795254d2-e1bd-467f-97bd-85b9a38bdb2a", "comment": "Malware payload (CoinMiner)", "value": "73fd7c5009776f0001264d8041e9844a18630e00", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629905233, "uuid": "9bac88bc-a8f5-43f5-8396-5b56097971cc", "comment": "Malware payload (CoinMiner)", "value": "da410a1d997f0a3df4df289248fc3aad1c68d1382ebcaeb08442070c8022ff8fb46622eecf5fbf8c8c818fa491897004", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629905233, "uuid": "b2bf7e43-7806-4086-9e7f-728b5532f309", "value": "T1D3059E3133CA246DF2D551325D61A689FA76987E7B63832F24AE2D2D64F3058C3D1A0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629905233, "uuid": "fcbdc093-d66a-44f7-a8c0-59458f35bfc0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629905233, "uuid": "5990ca7d-8ecd-4569-91c8-cd746260775a", "value": "12288:hgu/N/E2iNadenef5+G9I1sQm2iNF2iNi4QissaMJcR/V:/W1M1j1esId", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629905233, "uuid": "5b3602cd-30a2-4a4b-b421-65197b82c6a0", "value": 855552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629905233, "uuid": "e4ab0d45-3b45-497b-bf67-4c6bc5afc7e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629905233, "uuid": "e9541240-2be4-4fe1-80e1-92fa54923f41", "value": "b40b2474c4cc44f5545dec1b9ab4f4b2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c845bf97-055e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Hancitor)", "timestamp": 1629866518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629866518, "uuid": "a3817571-39ad-4de7-a671-ff1ee1a6c08f", "comment": "Malware payload (Hancitor)", "value": "48463e9423607e7e5fbb05b42a3bc4ae", "object_relation": "md5", "Tag": [ { "name": "Chanitor", "colour": "#3242A0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "DocuSign", "colour": "#6C3C77", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629866518, "uuid": "0d01a2d2-ed48-4768-ad12-124a0418dc05", "comment": "Malware payload (Hancitor)", "value": "cef7ccf63ab0648d312c44000f29f93d672e6a99a8ab5d08b599719d3f2ac23d", "object_relation": "sha256", "Tag": [ { "name": "Chanitor", "colour": "#3242A0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "DocuSign", "colour": "#6C3C77", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629866518, "uuid": "a718d833-236c-40f1-946d-acfe76ad8260", "comment": "Malware payload (Hancitor)", "value": "922f69f07b42322123a3ff3f8f6e63277d0deb70", "object_relation": "sha1", "Tag": [ { "name": "Chanitor", "colour": "#3242A0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "DocuSign", "colour": "#6C3C77", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629866518, "uuid": "e65a5d22-720e-4b41-9e08-ecb40c91f950", "comment": "Malware payload (Hancitor)", "value": "89d0c893208f8d347dface383b7c9f35325a451573eaccf200e5912bf7a3fe48e910b0453aba089a62e5fcf4a83d28ee", "object_relation": "sha3-384", "Tag": [ { "name": "Chanitor", "colour": "#3242A0", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "DocuSign", "colour": "#6C3C77", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629866518, "uuid": "10423c68-a440-49b1-a26f-e33d35c775c3", "value": "T19BD40107B986DE03E04ACB397EA5CDA9376DAD059E08F3C771607B1E6BB13219D0354A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629866518, "uuid": "5db1ec19-c355-41dd-8c8d-29daa976e395", "value": "12288:zV9iQsDr8NREUYfwg8I3HMzNK3Rb+jC4xU4WhO:zVXkr8N+UYhR3HMBK3RMeO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629866518, "uuid": "df34eb58-28d7-43e8-8746-e012b431394b", "value": 638464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629866518, "uuid": "ef85236a-17d7-4ce8-841e-f358d79f26e6", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629866518, "uuid": "2608935d-1786-4d6c-b666-6efdfb743609", "value": "0824_0853746034.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc3a5d4f-0564-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869182, "uuid": "465b1bfc-d0fa-4578-b426-52003fb1a2c7", "comment": "Malware payload (Dridex)", "value": "eb3eb1d458d0dafa554eba427cdda2f1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869182, "uuid": "549b25db-3a23-4bb5-87d6-4c71810b72fe", "comment": "Malware payload (Dridex)", "value": "cf819b1bc16ec7bc4a669cd5942731f5525c2338c61d46824dac403014c4755f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869182, "uuid": "21697d3a-9d7d-4f54-a237-5bec0adc1c0a", "comment": "Malware payload (Dridex)", "value": "a1232e31f04ab669c00c8c1f6b067e08b12c6a0c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869182, "uuid": "9cb2b280-8b88-42c3-bda5-b55075ef0a40", "comment": "Malware payload (Dridex)", "value": "135b62a1e5489ece3cd8bfa631d9df3df0c793d67f32d79740681607b9a951afd5d177bfd204411bd8b582238571da7d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869182, "uuid": "bb60f607-cb00-49ba-9986-1ec6ed8a970a", "value": "T1A3641218C5B3E97ECE8A09FF8DBC14D263A78A33C25589DA888571EC1E520764258FD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869182, "uuid": "9a747e9f-da11-4128-861f-0835f21e525a", "value": "6144:oxQHUDARmUmyqXO/J6t/VYfASkKTzZYwPMPFde/Qxx2u+OA+NT5Aj:ZW/yqX7ifASkKTzSwkPFduQx0uD+j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869182, "uuid": "13cc7894-8d5e-434e-b1d3-f172cd80d147", "value": 328135, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869182, "uuid": "8bc5b4e6-0c20-407c-b34b-396d8984d0b1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869182, "uuid": "814e9e3e-fe3f-46bc-957a-b1175df5f9f6", "value": "Invoice-5562_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e6d01e2-05b9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (TrickBot)", "timestamp": 1629905291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629905291, "uuid": "bc81883e-3fc1-4d4e-85b7-584df7fb92e2", "comment": "Malware payload (TrickBot)", "value": "d3acd45aaa6eed5a2934cc72df172f8f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "top119", "colour": "#8EB001", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629905291, "uuid": "9f06bd29-dea7-4432-ad24-b8258baa0772", "comment": "Malware payload (TrickBot)", "value": "cfb7a576d253edc8cf78138e7b940b634e45fb73a8f863f4c2f34ff907fd4d03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "top119", "colour": "#8EB001", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629905291, "uuid": "8a80c837-8b9b-4e8b-b15c-97a1c2a424fe", "comment": "Malware payload (TrickBot)", "value": "b330100de9941a84502f7fb2f4ef333b7335ad90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "top119", "colour": "#8EB001", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629905291, "uuid": "a1f75603-4d69-4f57-b1e6-f5f05eef2a82", "comment": "Malware payload (TrickBot)", "value": "dccc48f54ded46e07dabf34e22609cfccc911772a65de828f98e2ce10f4b1ac6233a7b4ff5754a26a36a59329b3794a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "top119", "colour": "#8EB001", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629905291, "uuid": "773a5c5d-3d72-4462-9c2c-faf7b38ea2fe", "value": "T15F0519D0634CCA7FD6C33130F3A61633D2538B4E1AAB919BEB58F59AA86E5467413307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629905291, "uuid": "16ab363f-ed34-4d07-989f-6ea89d612daf", "value": "884c251bdbb51e23564add248435ff5c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629905291, "uuid": "79210d54-1307-40f4-8bfe-511b389ea08c", "value": "12288:QFuLe4nHJm79H5R51MKd3GydYLMcOCWvnJi7:QFF4nHJo9ZbnJc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629905291, "uuid": "95824d12-cad8-4da4-ae54-29dc669d5a55", "value": 839733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629905291, "uuid": "9f831b76-cad8-4fad-8448-fdeec4f5dea2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629905291, "uuid": "59e76400-4068-434f-aaf2-1045e99aaa3f", "value": "d3acd45aaa6eed5a2934cc72df172f8f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13a82c4a-0565-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869222, "uuid": "34f72239-3bb0-4277-a7ea-d75dfd4f7b27", "comment": "Malware payload (Dridex)", "value": "2d9d4c6eea61cc2141435f3dba81f073", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869222, "uuid": "c9c8a6c3-e9fa-4652-b2de-58f1f37014f3", "comment": "Malware payload (Dridex)", "value": "cfd08fb28c11ec1fdfe9efb6f9ec334d4ee9758005c65d331081bbef39f31122", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869222, "uuid": "46498953-21fc-47d7-8dfc-013437f3bfbb", "comment": "Malware payload (Dridex)", "value": "c68d564958e35101167032700aaf22a7a144b33a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869222, "uuid": "e0a6b9a9-bc43-4745-bb68-b4df7e408738", "comment": "Malware payload (Dridex)", "value": "1f41607ffbd2b9d1cb737e1d0c2d81b176e63989bd90b4165765863c45d2be78e019c780165bd436acf376bfd2b7e2df", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869222, "uuid": "0bb21fc3-7c3c-41d0-b89b-da7aa993fbae", "value": "T1B074126892B1C85CD84E403F61D74F72D7711A05EB42B71F92B2A70D5F02D7E4AAB0AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869222, "uuid": "abfc6a6b-61ef-4a8f-ae13-827ec8b92402", "value": "6144:o7p4jKGp2LohOGYw6CC5jTT453mjEIbWiGVAKSLFN+YInSCRvuPsxNH:1wL2OGY/TTy2jEIJc6FNu3uPmNH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869222, "uuid": "3deb0d5f-9c0c-4056-9f20-fd2dba4670e4", "value": 352317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869222, "uuid": "7b4ee5e9-e6cb-4976-a36c-7f6d8f0eb9bf", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869222, "uuid": "54faa4f7-585f-46d3-a736-62c6117a95b8", "value": "EoY_TAX_Export-626671470_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8bf78c2-0564-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869042, "uuid": "4c4304eb-ff4c-4542-9439-5d4c028a4a7d", "comment": "Malware payload (Dridex)", "value": "c06c6ee414a336c05312fd01951e41c9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869042, "uuid": "1527fa24-690e-4a20-9332-35c58447d400", "comment": "Malware payload (Dridex)", "value": "d0612a840b76e5ff85553fb1ba45daa9963cf027f4bbd3c842adb34d630e09c4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869042, "uuid": "14c31e47-6a8a-40a2-a760-1fa7aa1e5829", "comment": "Malware payload (Dridex)", "value": "7da75f9d17bde5b8b54a979d3f6b08fae8fa203e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869042, "uuid": "24fb3b21-20de-432c-9d70-15587c933870", "comment": "Malware payload (Dridex)", "value": "cf0da046c1ead34c3afb5786c3dc3d4ab6ebf25d25d327f4de3b0626757146fdcdf764da2e51b5c0f544ffd2912a1787", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869042, "uuid": "a7bf6d84-9c1e-48c6-9311-d59d4700adee", "value": "T1ACD3F1AB3537CA59C139933C45EF5F7267748B8452A213171229F86CBF239EBCB19209", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869042, "uuid": "3dd60897-c749-4434-b923-4243699a9929", "value": "3072:oUOsWhCN6pAOwCW+PT4Gc+3zoi63LD6z2qoaaaaaaaaaaaaaaaaaaaaaaaaaaaaY:ojsrO2i4rO67Moaaaaaaaaaaaaaaaaaz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869042, "uuid": "93e58c88-00a9-412a-a2af-7833146177ed", "value": 139074, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869042, "uuid": "9d0511a1-f4ef-43ec-9a3c-b0d7e3ed11d9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869042, "uuid": "e3f9587c-9514-4831-9f1a-5c761a338ce0", "value": "Scan-30484_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23fec209-0570-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629873974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629873974, "uuid": "156fc4be-ed56-4c65-b5bb-59354644e9a6", "comment": "Malware payload (RaccoonStealer)", "value": "b11622f0ab180366686de3d7d4d1e007", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629873974, "uuid": "a79ee8bd-5d70-409c-a8aa-08a650f7a865", "comment": "Malware payload (RaccoonStealer)", "value": "d13dde4821d278b24f417bc51b39197789197ec45af4b9ac7fba05819209167c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629873974, "uuid": "50b99abe-91f5-4b7e-8f0b-4ded40bef163", "comment": "Malware payload (RaccoonStealer)", "value": "539472aa133586b27c555f63f067e75e48649348", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629873974, "uuid": "bbdf2169-872c-4c54-a57f-03b2953b28e4", "comment": "Malware payload (RaccoonStealer)", "value": "576cceccc402a0bf5ec0c973a58af6fe3b4c8ede29b25379d3a476790be52c09c7fc53f704d6899508cd4c6d1f408a2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629873974, "uuid": "68e8cde5-c5fe-49de-938b-ca95a9b43dbb", "value": "T164B4E030AAA2C034E9F211F8457A83BDB83E7EB16B3550CF53E516F956386E4AC30756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629873974, "uuid": "622647b9-e842-4c16-a271-c0fb0465820d", "value": "b1f244737f482f7370a4248faac2bcb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629873974, "uuid": "6a7294f0-07b5-438a-a23a-dbb1494d321e", "value": "12288:Y3hcAi/xktuf+UcSlxDScqPb3ZuW9VYF3tC7Ga+u:H/xkmlBq/VYF3IR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629873974, "uuid": "7c7a3989-71bc-4e65-8411-f64b0cfecaac", "value": 540160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629873974, "uuid": "d8fcd809-dddd-49df-b708-7f78575e70d1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629873974, "uuid": "33db03d3-8a4b-4b97-a095-1eeaa05e8a3f", "value": "b11622f0ab180366686de3d7d4d1e007.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d032650-059a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629892215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892215, "uuid": "c882991d-a13c-45e1-8408-533d46d49882", "comment": "Malware payload (Loki)", "value": "f5b26672b3c4305768e1e311955c6c11", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892215, "uuid": "58018a7a-8dd7-4ae8-94a9-839e7a66403f", "comment": "Malware payload (Loki)", "value": "d1756b89f468c5b1d7b54b9d59205dcee6ce7f4f85bd2404c5e20e4d8cb002fe", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892215, "uuid": "6c9c577f-42cc-417a-9ff3-fe8fb54afadf", "comment": "Malware payload (Loki)", "value": "87b767f5dda34352a1ed2c7e154772e3773ff24a", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892215, "uuid": "5c497029-bc53-4f00-8436-6cb1323998bb", "comment": "Malware payload (Loki)", "value": "6c26b864e0db60f09cc7b20bec0e631c4f7e1077264e65e88a59f9aa38b9fe80c0c2274ae52c73276f87a814ddfe58fb", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892215, "uuid": "edd92294-f45f-4aa0-ba47-92f923a46dfd", "value": "T1CF55229B6E9F8B37C326407A1242D55082E77F107A728D61793B39B44DF79200E8B9BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892215, "uuid": "2e393c2b-a924-4fdf-ba4e-d2b8a6aaece3", "value": "24576:XvIdohqjRkWsXbmEAeD6PJAZpLbXc+TLaoX9I7Pdg7PxPdpSJjAR:/I4q9FAmNeI27sqL9NUdgNiJm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629892215, "uuid": "167f7c8b-231b-443c-9290-323f2fce7524", "value": 1363968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629892215, "uuid": "46e96c22-cd7f-4096-ad84-72d1e37c4f91", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892215, "uuid": "04a9905a-95ec-4511-a4b6-27b37a9b940b", "value": "MINDRAY_RFQ Defribillators by SEA.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecd4ed0c-059a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (STRRAT)", "timestamp": 1629892349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892349, "uuid": "8ad690b6-da27-4c73-b804-87c1edb550eb", "comment": "Malware payload (STRRAT)", "value": "a14320e418691e19a1dcc5fbb3a5c950", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892349, "uuid": "becedd23-e3bb-404f-8c9c-980b627fc7ae", "comment": "Malware payload (STRRAT)", "value": "d21387f0e105c87fbe306d01cecb7b157ee02978875af513fc0733cbc5a52cf5", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892349, "uuid": "9d716a46-3e4f-40c6-89d5-5a033026a9f7", "comment": "Malware payload (STRRAT)", "value": "753ad196ba9325963be982be083defa61e58e876", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892349, "uuid": "f7b1ef8f-e301-4589-9b3c-38881fe79af7", "comment": "Malware payload (STRRAT)", "value": "4fe466032fe80d1a1ce745e299230e9760c78c5637e7787fc0eca295df9e58f7b886b0b7fc349dd79406df1a35ba8166", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892349, "uuid": "80f7ae6c-9b07-4d7b-a2cc-4edd0d49929d", "value": "T149B3CF3F79AAC1FAC017913AA801D623A55D52A8D4E9D11F25FD68591C34E3A0B03EFF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892349, "uuid": "6285356c-041a-4a43-9d4f-f9c18dbc04ce", "value": "3072:bZ07hOYZ860cicigzJsJG+Aq1tb+xxgv6Y:tehOY/PicpCGnytb+xo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629892349, "uuid": "17b27cce-ea33-4873-a39b-7aca0d4e46e3", "value": 110769, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629892349, "uuid": "c8b47beb-fd93-495d-beb7-28543280a270", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892349, "uuid": "cfc52936-e443-48ad-b13a-78a43c88445a", "value": "invoice_payment.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b372ceeb-05b5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NetSupport)", "timestamp": 1629903849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629903849, "uuid": "3a31f7c3-eb17-44bd-8885-0d3eb394f46e", "comment": "Malware payload (NetSupport)", "value": "8514b0b62df68bb70dd3eddffe146108", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629903849, "uuid": "12bee062-81b7-4115-be97-90c32471387d", "comment": "Malware payload (NetSupport)", "value": "d2c0fe65b141b6eb265a448f52786fe153ecea688ff5f7fa3f1d5d46d45b11de", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629903849, "uuid": "4c7725d1-3832-418e-a1c5-d183b642461c", "comment": "Malware payload (NetSupport)", "value": "d6d014e9db0628391951d8944364766bcb89f6f6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629903849, "uuid": "75d5ffec-3967-4c67-b34a-1890c4992dba", "comment": "Malware payload (NetSupport)", "value": "be1a8d6ab1b750d6be1fb81ef363fe1b54721121186e5d783e94056b8139cb0780c30fe3606a0dc754bd7b3fd1796f52", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629903849, "uuid": "a4d1e26b-0104-4d91-8b11-15931be7f7dd", "value": "T110633AD46B90D44366CD1F53BF0A7DEDE12AB87268C8A643C2A47A8C24BD407C5B4EF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629903849, "uuid": "40755d4d-ff40-4288-98f2-faa432f95099", "value": "1536:L7swHrtgbuEBNOWU9eA5raP0hhs0aYg0G:L7swLtJEbOWU9eKaP04jYg0G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629903849, "uuid": "4b0105e7-3234-45fa-bbfb-1660a68f0e9b", "value": 67187, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629903849, "uuid": "233c78a2-3c4d-464b-aec0-373890adac9b", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629903849, "uuid": "0d39cbc4-0298-4fc0-a724-583290c1b935", "value": "info.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a276fcd-059a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629892211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892211, "uuid": "03874356-a7ad-484a-902e-9567810b06fc", "comment": "Malware payload (Formbook)", "value": "52c370c61ca1c2d65dd36286e45d7cf5", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892211, "uuid": "c2475694-47bb-4c4a-beb4-e2ce74c8d137", "comment": "Malware payload (Formbook)", "value": "d361c015f8263ae4072a34f2d74a98972edefb4e569919b1f4cd26e044d7ef6f", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892211, "uuid": "9421b3f6-7415-4032-8178-aab1c229a31e", "comment": "Malware payload (Formbook)", "value": "7b5903fef0781a18621cb454079b6ab1ca9693ec", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892211, "uuid": "8e6ec810-b189-4db0-a7d2-94c6742ae0f4", "comment": "Malware payload (Formbook)", "value": "136ddccabf8b0973bb5e5a20c567faad7539a12b37d35edc86c47f1979fc5ee3ea8f082fba577dfc5166ea4ad6c9ad57", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892211, "uuid": "2752d677-bf2e-4a97-9594-7a9603b2cf9f", "value": "T14045126176030716E1725FB99AD1375051F4ADFC2942CA02FA2F77082230F667BDEBA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892211, "uuid": "03345bd3-acae-45d9-a2cd-d25673853706", "value": "24576:ECZpQ1lZB8gJH2pXbcr7C/NEAaLxVZtBIng:ECZomkeWFbtBIg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629892211, "uuid": "fdba5a83-0d58-4bd4-8878-b02383a44d76", "value": 1217536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629892211, "uuid": "dfe6668f-5a18-4785-9621-41f6e8167eb6", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892211, "uuid": "63c37d3e-aa29-4123-8f0f-90c19ed9d787", "value": "Proforma Invoice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95d4ab4f-05c9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629912390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629912390, "uuid": "dfac6ef1-c7c8-4382-a27f-4cb5f61ddf66", "comment": "Malware payload (RedLineStealer)", "value": "d852bc138992fbe4c3bf95956def0b69", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629912390, "uuid": "20c4820c-1918-4dd3-9bd6-99f340d4b6b3", "comment": "Malware payload (RedLineStealer)", "value": "d4968072ed107486d2b505f5f0cb5ec4f5d166770ada4dc22c9f91600b739e59", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629912390, "uuid": "79727fd8-b6d3-4c71-acc9-974d06b8c510", "comment": "Malware payload (RedLineStealer)", "value": "e35085f4d47e8a790e11f454f9edab3a5e274876", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629912390, "uuid": "22f789fa-9211-4ce5-a1c9-fb8346cfbf10", "comment": "Malware payload (RedLineStealer)", "value": "0b8f20812f7f23ae49aebe237b43e3ad4a9463c99247210b4ac7abaddfe2714d4c0c89f3aec0175f06c788f20fe02aaa", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629912390, "uuid": "1aa13454-3b71-42a3-a28b-2447b0cf9275", "value": "T146838DA6B7D6D90AE858077909E6C7D22622FC921F62838B3245FB0F4F71FC08947657", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629912390, "uuid": "9336de78-f1f0-4c17-8b1c-26b4c2df6918", "value": "1536:ylk3hbdlylKsgqopeJBWhZFGkE+cL2NdAMEoYMymXForJVSt/xDAAgNvhxcF0fHe:ylk3hbdlylKsgqopeJBWhZFGkE+cL2N3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629912390, "uuid": "4fffd6bd-acfb-4266-b5e4-317402c59ba9", "value": 81408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629912390, "uuid": "067e6066-54f0-4cbb-b297-8b2ba67670cb", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629912390, "uuid": "c3e94ab6-4aa5-42f2-a7cf-ea36e5db4d80", "value": "DOCU_SIGN09986902077540087.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab68a5c0-05ce-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629914573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629914573, "uuid": "2b5901e4-6261-4c9a-afe7-594cb670d05c", "comment": "Malware payload (AgentTesla)", "value": "0012bcc9833984fe4d66b203fa320792", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629914573, "uuid": "7cf82e35-43d8-4ddd-9dd0-1be52bb432b4", "comment": "Malware payload (AgentTesla)", "value": "d5b08d278c54f8c7e2f62ada15837a48929c569376e9f2e3160f10cb0b610472", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629914573, "uuid": "da0a6e4f-686d-4ca3-9731-7f53d8e752c0", "comment": "Malware payload (AgentTesla)", "value": "f39848e2b37a37d549a8561da8f09f581f4217ec", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629914573, "uuid": "7d0b36ca-c384-4a20-a707-2506eb1766b1", "comment": "Malware payload (AgentTesla)", "value": "806bc5676c5b6cf384677c44730410e7bd4487560dbc5695fc44ace4c54621072cc49f5666e117aa396b5c66e3eed80e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629914573, "uuid": "a26d7230-2cba-4c40-b18f-e88fbf951fed", "value": "T1F87423FD7A79A237C2E1F034B82DB4664709FD087266A2795CC878CD35B578D8C266C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629914573, "uuid": "0259dd63-6f83-4a79-95ff-ffc2d1f28236", "value": "6144:DFir/0o9CUvnEwi0ekx3Q0uuJy9a79mbMK7hSdzUpiidGN18UbO1Gvfx63o7Jt:oL0o9CU/EwHekW2y9MmRh86iide9/fxp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629914573, "uuid": "9a456c0f-8d19-4c2e-a30f-5b301656b2c3", "value": 357376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629914573, "uuid": "95fcc211-409b-4fbc-8aa6-401e8d1cd6b8", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629914573, "uuid": "ae8b49ba-7314-40ee-9597-f912759c386b", "value": "New Order for Chu Dai Industrial Co.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae52ef21-053e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1629852731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629852731, "uuid": "c5f7734a-f3ae-482f-8e1a-11bf4ec2b933", "comment": "Malware payload (SnakeKeylogger)", "value": "6d31f5d6aed669946107e845c8037d9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629852731, "uuid": "07baa956-ee7a-43cf-8a95-12313af2a9f6", "comment": "Malware payload (SnakeKeylogger)", "value": "d5fdda0737798da29ffd5d88258a5e508b760dd571e367a5b72c699e0b9ed7c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629852731, "uuid": "df5cdd13-98cd-4177-8f76-327768df9cbb", "comment": "Malware payload (SnakeKeylogger)", "value": "2ce25138741ee1938d342cb619e04fafdee63b82", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629852731, "uuid": "c5601809-bc89-43ca-a061-bc636788eb7e", "comment": "Malware payload (SnakeKeylogger)", "value": "3d5df80978b81e0096d4493ade973d96a5e6c9ed49f88ad7de5be8f8d7dfbfbfadcb36239a1014429ecc93435c2de1be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629852731, "uuid": "39ac6b9b-1174-4ccd-9c89-06e47a38a2da", "value": "T189F481BE1ABD922781B5C6B5DBE79417F0409B5F3410AC257AC203660232A7BB5F732D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629852731, "uuid": "af025764-eba3-43f1-b6c1-db0f98b99604", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629852731, "uuid": "90afaae2-a0db-4f35-8e15-0fea88962923", "value": "12288:dYILpLnAPlYA1bTCPalx3UceycnOoSE04X3gagJUXo3uYfftzmcz8/ws:dr9nuFbTxgOE0W3grJUY3uYNbz8/w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629852731, "uuid": "5cce3c20-e771-477d-8bd6-645c1d359b35", "value": 771584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629852731, "uuid": "c8f2f7a9-377a-453a-92c3-b042b430601b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629852731, "uuid": "905e0b06-4cca-4472-84f7-998ac45390bf", "value": "alslLisqrdAYM3Z.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0554942b-05be-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Cerberus)", "timestamp": 1629907423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629907423, "uuid": "22e8a5e2-e0c5-4420-b4f7-43ecca037bf2", "comment": "Malware payload (Cerberus)", "value": "ac231b8de64b552696a21f32ed958485", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629907423, "uuid": "18713f66-2808-4faf-a737-6e4a4643bd45", "comment": "Malware payload (Cerberus)", "value": "d62ea27f4ef3cda3854a6e442753da28be399553d6b266b1f9a64dad6908c739", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629907423, "uuid": "0e2dfd55-a593-4ab5-be23-7018b0e329e9", "comment": "Malware payload (Cerberus)", "value": "099c1599f295189f1e06545b9392d8a816bc64c5", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629907423, "uuid": "605a11d9-ee1d-4428-8ca3-a7a6256a6653", "comment": "Malware payload (Cerberus)", "value": "be4d56e54c37d9ccee59add8c142faf7e7c548e7ee99f5e9579999464dc81039dfde0adf12a4446815dbceacbb62f7f2", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629907423, "uuid": "ec44a02c-bfe3-4b74-b054-f99125121851", "value": "T140E53319EB42D078DA5B42BA84D3909777CB250D8BEFA43F1A36408258FBC958E13DF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629907423, "uuid": "c2280c20-9b81-4664-a924-f3c119a262cf", "value": "49152:/dCoEUA3Vw9XAHQ57xMCtX460+EH1iRh1Tg66Vh/F51+swF2IOG2TT9kgFHOPQEP:S3OXPx/I6dySh1TgRVVFiswF2IOGaGdj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629907423, "uuid": "1d4303f1-ba55-47a4-b6bb-e6c125b04acf", "value": 3110193, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629907423, "uuid": "1fd9271f-404f-4ee2-a467-e626bd5df273", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629907423, "uuid": "57f49ada-10f2-47f2-bf17-fca3d4873142", "value": "Android build_obf.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd7bd5a1-0564-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869184, "uuid": "b1f730c8-8900-474f-a1b1-deefbd94455c", "comment": "Malware payload (Dridex)", "value": "f44ea0b7e1beca02370c8aa2d20000f6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869184, "uuid": "71fb095f-9fb0-447a-b310-0e92e79ea0b3", "comment": "Malware payload (Dridex)", "value": "d6dcc0a6e5a7a3985fab975e4da5a1cc4ca904f68556dd98b062430d53426bea", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869184, "uuid": "9218eb4b-cd69-4946-af65-4d136e4dc1cd", "comment": "Malware payload (Dridex)", "value": "e22c0471b5ca2e43f3733524dfa384dad35160fa", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869184, "uuid": "81fd7f09-f43b-402d-a125-02966511904f", "comment": "Malware payload (Dridex)", "value": "215fc919bd28ecb313861670ed4f45d9e37c51c0f351f2554b188d69650a8d3b4bb40eedf2d76a0ec4781366d9f54a7c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869184, "uuid": "2fbdd2dd-1649-4e9f-9aca-7e8d2aaf46a5", "value": "T167E3E09B7677DE9CC02E833C05DF5F763BB4AB8442E117162568F8286F235ABDA0421D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869184, "uuid": "606d7ebf-c600-4c95-8d84-0cb8a5004bd1", "value": "3072:oUJcd05FjZIQuPZ1y/7wMi63LD6z2qoaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaat:oiFNaCE967MoaaaaaaaaaaaaaaaaaaaU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869184, "uuid": "121ee031-9610-4c43-9869-e58ff293cd7e", "value": 144803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869184, "uuid": "5d048554-02c1-4c75-90f9-a37ccc48dc89", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869184, "uuid": "fbf86018-57ab-4473-90e2-4ae0eaa1fc76", "value": "Details-87317_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "229895ad-0565-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869247, "uuid": "057bbed4-2792-4485-9204-2e2ccd8130e0", "comment": "Malware payload (Dridex)", "value": "e7c74dd5746a016af75a2c3cc29aae1d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869247, "uuid": "48010295-3c96-40a9-988f-7c885c368f7b", "comment": "Malware payload (Dridex)", "value": "d762c403d9e180be5a7a5e08fffbb60ef4c52f5e13889fc77c68414d222fb53d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869247, "uuid": "eb37b482-99bd-45db-98be-dd9026603245", "comment": "Malware payload (Dridex)", "value": "461aacb9a2a1e99ac0b939c79c2cd78f2cbd48f8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869247, "uuid": "ba96e359-58ca-40ae-9f75-8c92f9583166", "comment": "Malware payload (Dridex)", "value": "363668aaff73a327965f1b01004ca353178e050ae75100c1a24a6acf107006c657a9c752c85d2fe93c7a9e7bca951b48", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869247, "uuid": "3bf3e824-b4fe-45f5-8c34-71ba6d50548e", "value": "T196B3E19A7122DA5CC12D933E05EF5FBB7BB49F8417A207125129F92C9F125E7CF40229", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869247, "uuid": "93354b8c-42da-47f6-a525-33c89d4b0b6a", "value": "3072:oUt6jGhVl5EtB7VQbDi63LD6z2qoaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa3RU:ok4Gh35ELVQbG67Moaaaaaaaaaaaaaan", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869247, "uuid": "dc586a51-a33a-429e-bded-2fc59b1e198e", "value": 113278, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869247, "uuid": "2d5527fd-b580-46a6-a51c-9e29bdcebe68", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869247, "uuid": "dd4d98a5-d7e9-4b43-bbbd-af321fb3170e", "value": "Scan-3470190403_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdf61187-0564-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869105, "uuid": "c4947afb-a5b2-46ee-a0f4-6e7bd2c70744", "comment": "Malware payload (Dridex)", "value": "b629875af272759b7a9e0ca137642b6c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869105, "uuid": "a8fa8a32-f858-403c-b3ce-90addb9dba3c", "comment": "Malware payload (Dridex)", "value": "d7c97599d1a764282b372b6ca58a7214138bab7c3192cd4633162f9803bda4eb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869105, "uuid": "6ed5a46d-5dc4-4bdd-b3c5-c582692eb047", "comment": "Malware payload (Dridex)", "value": "24e0d5ca3a2346fd9407932f968b9d52c9a3a5f5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869105, "uuid": "908fa233-e049-4a43-9dae-f7cb637480d3", "comment": "Malware payload (Dridex)", "value": "43b3ebfe2f1cabe298e23f1515d1f25f62414af73ce522b768c4d9ce383eb96f50593493c119b5b3e9c6bcfdc510400d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869105, "uuid": "c992d4fb-076b-4b3c-81dd-adb2a2a7ed3b", "value": "T1B4641219C5F7E57ACE860CFF89BC24D273D78A37D54689C6C8C671DC2E2202A4258AD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869105, "uuid": "1bf2f123-b81d-4365-81d0-b4ef27746e18", "value": "6144:oQqPamx2DNRXO/J6t/VYfASkKTzZYwPMPFde/Qxx2u+OA+NT5AF:rmgX7ifASkKTzSwkPFduQx0uD+F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869105, "uuid": "d0c89de1-13fb-41bb-a955-a828a6d9abcd", "value": 322357, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869105, "uuid": "2927c7a7-1151-47ec-a34f-067495ea0d14", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869105, "uuid": "91807a94-d0a2-4a7c-a7c1-d74900ae5fda", "value": "Invoice-640585_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97ca2544-0567-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629870302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629870302, "uuid": "37b06315-6534-4239-8c02-45eb5c9640ed", "comment": "Malware payload (AgentTesla)", "value": "50357cd942725ead07707f24eb064022", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629870302, "uuid": "2bab2d15-e958-420e-a662-3d41d41c4e3a", "comment": "Malware payload (AgentTesla)", "value": "d96d726f123bece16049bd05f5219d6ecd08be0a55505929fd3c33a4e283f994", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629870302, "uuid": "2fa54ae3-3030-4d30-9ea1-68a59ce60e02", "comment": "Malware payload (AgentTesla)", "value": "2d6e2a80950b358efe980c329ecf8ee28f04b3b0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629870302, "uuid": "4d15c814-34d6-4c10-a803-27c785ce32ae", "comment": "Malware payload (AgentTesla)", "value": "c0e14747c839d58aee2985b27cde3fdf6153f5385b0db1d42159feb375768a6ea51426ee25eab0ebf6ea7ab6887a5673", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629870302, "uuid": "58e04b72-4e15-4f75-997d-705f00871f60", "value": "T1CB83E66CC0B702A8CF824B785B3BEE95129C7A6CF78495323238577127E1E3E915697C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629870302, "uuid": "df1e1ffa-f693-4b15-8e09-f42d2d81cbc2", "value": "768:8AQl1fehFAF4EmVPzg14W7TLXBDEaHG/A:8nl1fAFAhmNgGW14A/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629870302, "uuid": "9a5d763a-ec06-44df-8efc-08f88ae3befd", "value": 83031, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629870302, "uuid": "6005439d-81ee-48f3-adf5-3fd86778a7d4", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629870302, "uuid": "211e9925-cc80-497e-8088-ce9ff65bd886", "value": "profile order.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5142d33-05ce-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1629914670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629914670, "uuid": "e8d8c1ce-7b6b-4c77-a142-168d42e5f473", "comment": "Malware payload (njrat)", "value": "53092318baa10e73b4804e64095acde2", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629914670, "uuid": "177d615c-c6ba-4f53-ae31-a72a3155033d", "comment": "Malware payload (njrat)", "value": "da92c00591a0e8c4ea128f9b32de08264a7f9b29aabc3776e41a1259085c0f48", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629914670, "uuid": "e774ef8f-e3be-4ad9-adb7-fce6186e21a6", "comment": "Malware payload (njrat)", "value": "98287c0f0852936225843b7fb6b0f89d46155ce8", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629914670, "uuid": "85c00d6f-9e30-49ac-a368-c0daa070cd56", "comment": "Malware payload (njrat)", "value": "f82815f449e50987526fda79b32aeb3bdc13ee6db6a070c61e980bd3477fcc1738053c3b3acd5bba9216e875f78ab545", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629914670, "uuid": "50cf901c-6e33-472c-b1b3-73ac21058a54", "value": "T17011680A4C148CDB9345E14100C36CDDC250A7637FC029792477794BDCAED3E1C8C88B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629914670, "uuid": "4eb2284e-773e-44ab-80ff-b45da7928095", "value": "12:tatyE7AfwVIJrwFWNcXNodnAbOJk8/fecG2bwELP/dg3Nfd+WVaiTC:0tyRfwVYwFWNcXyn55G2UE7/kNEKC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629914670, "uuid": "51956052-c606-400c-92c9-a1b33ea1cb52", "value": 897, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629914670, "uuid": "14af966b-16a4-4df6-a92b-85ddbb7b68f3", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629914670, "uuid": "50ae48fc-dec8-42c9-b103-6e585fd97a16", "value": "MasterCard.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "787615ad-05e4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629923937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629923937, "uuid": "fb98f85c-69a7-45c6-9c09-c61a378cc309", "comment": "Malware payload (RedLineStealer)", "value": "3fcce8b9e2b2659fa46aaaa5e007082d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629923937, "uuid": "ef720118-e6e8-41cd-8cfe-38ba8b377e04", "comment": "Malware payload (RedLineStealer)", "value": "da9fab8c0b241f3f2c6553cdb898a76b90d14ed694136a6319d2017e1e5f7d57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629923937, "uuid": "ed8bf787-8520-46ce-9b1a-040d61025723", "comment": "Malware payload (RedLineStealer)", "value": "15ea770a663418c0d13d256510e349818275af11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629923937, "uuid": "8fd1da2c-6973-4c49-92b8-2b816c22db5c", "comment": "Malware payload (RedLineStealer)", "value": "0a29f4ec450304d11e4db6c65ffa107061b010b68142b430fb2aa3bd9cf606fa09244f1e9dd37540fc96704ba4907cb2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629923937, "uuid": "bf55268d-3e8a-46e1-8bd3-ca46a1eb3e1c", "value": "T1F1857C9CBE4ED103EAF879F08CAAD52490FA2D6A4A07C50D29B8B17755B17C3EE054CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629923937, "uuid": "4924cfe9-593f-423f-a2b7-3e6acb6945ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629923937, "uuid": "5b7c2576-4f75-4ef1-8cd4-66f6dc6e39de", "value": "24576:p0nGasDahabSu/hqE1QG+Q/edFdka2fffaOL7A5jPWVJJ/WJkxChx4I5W:bDmWpfD45DWvJ3xChxPU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629923937, "uuid": "b21b413d-ea78-4a31-82cc-1f2943d11a3d", "value": 1760688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629923937, "uuid": "77f51301-82f5-4160-950e-4214a70f6b5b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629923937, "uuid": "a220d1d2-4496-48ab-b03c-5ab276ca0dfb", "value": "OneTapV4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9077009-05ae-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CobaltStrike)", "timestamp": 1629900933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629900933, "uuid": "1b422752-0b93-481a-aca2-e0f2474b2bb5", "comment": "Malware payload (CobaltStrike)", "value": "70a307d1dd1acf15bc53496d8f8f27b2", "object_relation": "md5", "Tag": [ { "name": "1359593325", "colour": "#0C1016", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629900933, "uuid": "e4fb4dc4-3d77-403f-ad8d-d337ea14811a", "comment": "Malware payload (CobaltStrike)", "value": "dae9e2088f4cbc5ca484aadf7d47b96ea0b4667cb909921cb7b531fd61d35554", "object_relation": "sha256", "Tag": [ { "name": "1359593325", "colour": "#0C1016", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629900933, "uuid": "5595dcc3-afbd-4a0e-ac68-495ae04f5bdc", "comment": "Malware payload (CobaltStrike)", "value": "8fa506926cdd554824fa9139d447ecb36c1ad04c", "object_relation": "sha1", "Tag": [ { "name": "1359593325", "colour": "#0C1016", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629900933, "uuid": "aaa10c54-ab48-4a6d-8320-3515a7ea8952", "comment": "Malware payload (CobaltStrike)", "value": "81e0542018849a85b13b4b0783ab5d386e27bc13b9cc8aef06cedd0c8ce9d6063da02c533acc7382de72152dd749776b", "object_relation": "sha3-384", "Tag": [ { "name": "1359593325", "colour": "#0C1016", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629900933, "uuid": "3f8a88dd-ade1-40a5-a0fa-2fcacb7c137f", "value": "T1A2740160E7EA6555F5F77731A93A07215B2E7D82A838F50C871042CE8A71AA5CDB0F33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629900933, "uuid": "be8f0f77-3f8b-43fd-90b0-b2a884739bf4", "value": "e218f655f036f569d7a87ccfa333d177", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629900933, "uuid": "6d7fcedf-4525-4d8a-aa3a-1c392e9a9fef", "value": "6144:561FoHY1j12PbimfGsE6m4FtWfAvpofL0tJ1PDi7wfaZwln/6kgUB9Z5Dr5kCvjE:fcj12PGYEgvIE9Di7orlikjOCvjbD0vS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629900933, "uuid": "fab19504-f846-4f90-9ecb-92fa342be684", "value": 364544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629900933, "uuid": "4221d5cd-cbbf-428c-afb6-3c4517c14e12", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629900933, "uuid": "16c59def-3867-40c5-9471-9de789552952", "value": "slack_update.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c745460a-0564-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869093, "uuid": "32a86675-90e7-4c2e-aaa1-079a3308dfca", "comment": "Malware payload (Dridex)", "value": "fecf0782eefd4ef0d658fdc47ca98904", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869093, "uuid": "dc86936b-d7ce-455c-83ba-905396b78b64", "comment": "Malware payload (Dridex)", "value": "db01cecbd003d5db459adaa549d3ca25786d334b0fe79c0257d537eb3eac1639", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869093, "uuid": "ccc1a717-8d39-48fa-8a74-a8ccc3fda596", "comment": "Malware payload (Dridex)", "value": "d4fea73599c37636619c5007c4a5d6232fd8195a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869093, "uuid": "f20221f2-4fcf-4023-b1ee-d8bff292c159", "comment": "Malware payload (Dridex)", "value": "0d02a2c64cd338945c57b40cdea7f7092ded89f8b199a9668ee42fe1174ee6cefe68957a2c0b1a0740567de2b2b27f5a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869093, "uuid": "12c2694a-45c9-4688-b955-82aa29b146d8", "value": "T182741268D2E1C85CC98F403FA2D70FB3D7B12A45A681671ED6B1F20D5B0793A4B6B09D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869093, "uuid": "08beb152-b4c5-4368-ae72-ebc027e02232", "value": "6144:oUwMAgXq7Um2LohOGYw6CC5jTT453mjEIbWiGVAKSLFN+YInSCRvuPsxNL:DqwlL2OGY/TTy2jEIJc6FNu3uPmNL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869093, "uuid": "8a7b25e7-eb8a-428f-b3e7-57da0062d790", "value": 357967, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869093, "uuid": "0599bbfd-0135-4ffd-b1f1-f160d5c46ecf", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869093, "uuid": "dc7ae5d8-aa48-4ff3-b8a7-08640f273b5d", "value": "EoY_TAX_Details-8498623475_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa92046f-056c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629872481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872481, "uuid": "c84be868-c8da-4263-ac5b-20f4bbfbc6a7", "comment": "Malware payload (RaccoonStealer)", "value": "3204b67e8038e9ce23dcd273a4bafc7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872481, "uuid": "524f9a7d-58ed-4c47-a8fe-44f7974f6617", "comment": "Malware payload (RaccoonStealer)", "value": "db1de4d90808e799664e79be3591dc635da273dc934337af690f32c3b3644000", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872481, "uuid": "cf56960f-9c99-4a80-8e74-a33fe4ce9693", "comment": "Malware payload (RaccoonStealer)", "value": "84678dc89601fc70c585813d9191b261b4da906d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629872481, "uuid": "5daea5e1-2c1e-40c2-9d99-9f1d1e8f9b66", "comment": "Malware payload (RaccoonStealer)", "value": "968ab9afa4c524ac99bcf366e7a4141e6ee0ff414d94b48ba4d4e7a1654475d4cee67144f9cd1a94a1a81156a20b7015", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629872481, "uuid": "4efb7389-a0ec-4691-9005-7fec43559ca3", "value": "T1B7A41290F7B0C87BC02A45325C92CBB09B7E79526DB0520377D88E9E5F667C0771A3A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629872481, "uuid": "2d2f38d9-4140-4574-9e20-c82817cb80c5", "value": "bd3c9edf948deca79ee5e78523f1a042", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629872481, "uuid": "4559c925-96d5-4ae4-8211-aa778f912463", "value": "12288:XU6rO5V0djDt2MiNqqJA6COevtP7BKTolNgCnODRvcF:X7+ejaNAJZ7ocy84S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629872481, "uuid": "48bccc8d-1a25-43d2-b1f7-85d6ed8ccfc0", "value": 467456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629872481, "uuid": "7de6fdda-a97c-40da-ad48-698728d27111", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629872481, "uuid": "5d66bf4e-ad3c-416d-bc3a-7e63c1ab3747", "value": "3204b67e8038e9ce23dcd273a4bafc7a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8730f5a2-05d6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1629917949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629917949, "uuid": "825b1a68-2b32-4bc4-82ff-448ca0d84389", "comment": "Malware payload (RemcosRAT)", "value": "27ee757d743631d49dcb3c6d7c90dfbe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629917949, "uuid": "70c1babb-8b23-4176-b34d-7061f09a72c9", "comment": "Malware payload (RemcosRAT)", "value": "dc1bb96ddee60e15d3344fc4b0413634a54974ef9e854628157800c9d695f028", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629917949, "uuid": "c0424c18-00e7-441a-99a0-ecb5798857bb", "comment": "Malware payload (RemcosRAT)", "value": "2b356d2090ea481e38fdf1e78dac05b74c4818f0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629917949, "uuid": "0200ee74-9b4a-4345-b782-3a36ae5f4ec8", "comment": "Malware payload (RemcosRAT)", "value": "07d034d2d8a7552c386ec2b4c3a64cd5ed5950ef7efef032f1462577f8883687c7cf5060c4915e76fbb8c6c2d29b1404", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629917949, "uuid": "39500e02-447d-4bb5-88d8-d53fbe947fee", "value": "T15AF49D02FB610036C9B215794C27BF78D93E6E061A729CE22EE5B8580E756673F36317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629917949, "uuid": "a61ce628-eb80-412c-b2e7-4a54ef0b3a2b", "value": "5a802a354982a97544e495df27ee8291", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629917949, "uuid": "e56ab6a7-96ac-4e61-8ac4-f093a5a2d0a7", "value": "12288:vFtHRwMpWIIyKj9X1WxQ3jC0CJVYT+R0ws8YAX2ujF5JjFWVJq2O:vFtxwR9uwvQYYds/+TJ581O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629917949, "uuid": "88d25c3c-fb0f-41c7-b84d-bcc85b91935c", "value": 760320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629917949, "uuid": "3b1fafb1-9236-4144-82c6-8b4e5c5aae94", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629917949, "uuid": "4b63cefd-18f0-4e5a-bdf2-86e5d141df1d", "value": "27ee757d743631d49dcb3c6d7c90dfbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd655011-058c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629886310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629886310, "uuid": "1f229658-2b8a-4c58-8af4-168868fd41bb", "comment": "Malware payload (RaccoonStealer)", "value": "a38e14185e6c9b429df021bb56358596", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629886310, "uuid": "86d01dad-7d28-4acf-9838-709c664b3b1d", "comment": "Malware payload (RaccoonStealer)", "value": "dc5c22ee0782235867ae0363443252f867d0bae4056cd70dff77bf936abccb5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629886310, "uuid": "89f375c5-edc7-4042-9c69-944746966bbe", "comment": "Malware payload (RaccoonStealer)", "value": "4f97e20980bb38cb50ecdfbf45fd6d164422f1e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629886310, "uuid": "1de2bcfe-820b-4c3c-86e6-3b96927fc2a9", "comment": "Malware payload (RaccoonStealer)", "value": "dc667669a3810ebdd6bb3a218ebda95b6cb16f3c3b2e848a3ed50ee22b0efa74f5d5e91817347c2faf6306c5fab4d3cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629886310, "uuid": "a0e2c187-d238-4046-8f8d-b96ee442842f", "value": "T1B984CF30A691C434E9F311F889BA83BDB93939B1AB7440CF53E51AE916346E5EC30797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629886310, "uuid": "db879118-8b25-4ffa-b97b-3c1752e8006b", "value": "b1f244737f482f7370a4248faac2bcb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629886310, "uuid": "555551a5-78ca-42ac-b37a-5804cc126ae7", "value": "6144:S7Ev42gAjjXcNK8AlQeV8ppGS2GR2q8QCk9rOCelRfbHhgtwfeH4bkQe0VO76G0:hvXgAvsNl/eV8pcSt2HQCkElRftgtwai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629886310, "uuid": "981fbda7-6578-457a-881f-0ac0dcdbff8c", "value": 384512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629886310, "uuid": "e314ce02-d2ed-40dd-bf92-b513a066907f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629886310, "uuid": "27e68991-c823-4bfa-a13e-56ec696c9e49", "value": "dc5c22ee0782235867ae0363443252f867d0bae4056cd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b2a3bd3-0599-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629891649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629891649, "uuid": "20e0d1b9-ad3e-4206-a680-43fa0493449e", "comment": "Malware payload (Loki)", "value": "e47e5f755556e2f530edd1fa5e4c4f7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629891649, "uuid": "3f89d24f-229d-4849-a122-abaea06f3f1f", "comment": "Malware payload (Loki)", "value": "dcb132a3b31030613c2c7f21e52282e49663f98e79e3212f29ec5b5df6dedb7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629891649, "uuid": "08e3e67d-02b9-4849-b62a-1667259c93fa", "comment": "Malware payload (Loki)", "value": "d49988fb829a509d471f69ab088ca5cd57d28447", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629891649, "uuid": "772af22c-459a-4cd9-9a68-e0991cee1af2", "comment": "Malware payload (Loki)", "value": "704357068df92a61993b3cc0828db47d5ca01e89af3df24d0f835656bdd2984dbf33b8c5e78e94243ab8bb56bdced582", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629891649, "uuid": "6ce6c900-6415-4676-9f46-2a03b28457cf", "value": "T165F4817E1ABDA22781B5C2B5EBE75417F0409B1F3510AC2576D203560232A7BB5F732E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629891649, "uuid": "e4d0c23d-62c2-4ce6-bf91-2609fefa69ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629891649, "uuid": "c8b149c2-7f69-429f-abb8-20cd387232b0", "value": "12288:5KWIIqidwO12cW7xaM2A37fvxZbDfmaWK+WdRRCPuubtjxn:5Kvk1NW8w37RZ/fmCJf81", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629891649, "uuid": "f7063db7-1b7d-4c45-a2ba-3235bf00e325", "value": 788480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629891649, "uuid": "e512595a-267c-4a4b-8674-d50dfbd3761a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629891649, "uuid": "1b0a779c-c710-40a8-8060-fd58a53c2c8e", "value": "d0ievCa2xRfDdWb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a32ceaa3-0564-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869033, "uuid": "8a75bfb7-6f7e-4fb2-a510-fa85e4c84d95", "comment": "Malware payload (Dridex)", "value": "85b3804f8d20900dcbc7fcfaed191898", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869033, "uuid": "9bbbf9b0-5e52-4d59-9547-b92415809bcf", "comment": "Malware payload (Dridex)", "value": "ddc1096e9f1b62f1cb113f470babdeda31253173d41234e21afe8f4fcd5ffa81", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869033, "uuid": "7902eadb-fc5b-4975-a57f-cf0a97148986", "comment": "Malware payload (Dridex)", "value": "d1d9af8e0feeaae8cf58df889258443afce050ee", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869033, "uuid": "671d4818-4994-410e-9151-b59badf7606c", "comment": "Malware payload (Dridex)", "value": "436c92c1c2d23619874ac04c254b0a62bf350116825b37fc82446cfbc05a748d7d44c27ad2ae88ba937ea148940f99e0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869033, "uuid": "6d840582-564f-45d5-9fc8-f55cff63f52b", "value": "T12D640219C4B3D87ACF861DFF8DB815D2A3A78A33C54589CB89D431DC1F6207A8295AD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869033, "uuid": "a106c51a-56df-4cd7-91ba-d559d95044db", "value": "6144:oqNWmI65V6XO/J6t/VYfASkKTzZYwPMPFde/Qxx2u+OA+NT5A/:vNRSX7ifASkKTzSwkPFduQx0uD+/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869033, "uuid": "65434960-c9e5-42a8-aab5-67f9fc9885ab", "value": 333615, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869033, "uuid": "71ba9c7f-d793-419c-a17c-8ee865eacf32", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869033, "uuid": "efd040b3-e61a-477b-afb0-5a0fbc5e1c5f", "value": "Invoice-94109_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "730c3b3f-059c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CryptBot)", "timestamp": 1629893004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629893004, "uuid": "9ef58183-4eb3-41f4-af5d-d553e4e7c918", "comment": "Malware payload (CryptBot)", "value": "1c5f0c75a0efeb01d2b5252a1409fc2d", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629893004, "uuid": "6a5dd68e-6e90-41b1-acba-d8d4b632084f", "comment": "Malware payload (CryptBot)", "value": "ddfd9ad71462f4680d2816f5022bfd385cf9ff9291e52612f39db801fa1278fb", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629893004, "uuid": "1bfd7a00-3570-4b24-8c09-9b2ef588f7b2", "comment": "Malware payload (CryptBot)", "value": "05f868e4e5c12eae4fa247c0798a721554724eed", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629893004, "uuid": "2a6c9bdb-e095-4825-acce-60282134879d", "comment": "Malware payload (CryptBot)", "value": "d22858e28f80dbf9ce18ffee6fa364878011269ab82f8a0d0da816125343f27ba875974837c355c431b97aeb17be6a29", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629893004, "uuid": "9867500e-2af8-4d3b-b9e7-e606137bf3da", "value": "T17EE53392E0F17AF2F0904837F857D5CD87118AF88A83A94E782E17D3D606E1F67614AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629893004, "uuid": "8d39a778-739c-4e10-b24b-aa073fd55a45", "value": "f8d9e6f58bdad8d3f277d01c805576b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629893004, "uuid": "9a5f6c21-9abd-4106-89f8-e4483f0ac5f2", "value": "49152:jxQ1/MYDROalz1kq0Hy9tultSlmMuRvSU37YK//H+wZQfWJzl+qy8P:u6avli7tSkkUrYK//HNBaRa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629893004, "uuid": "740fff7f-2ae7-4a96-a12e-1f8bec862a00", "value": 3120128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629893004, "uuid": "a39f0a12-eb5d-4522-80ac-1c5cc66c6765", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629893004, "uuid": "6265e440-83fa-4d8d-829f-e1f577dea198", "value": "1c5f0c75a0efeb01d2b5252a1409fc2d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5226bd84-059b-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629892519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892519, "uuid": "deca9ba7-bed8-4bcf-a0f9-19313c37fd09", "comment": "Malware payload", "value": "78436520249ecdb491ad198b2f439680", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892519, "uuid": "efd81f91-1916-4baf-b63b-f067a563276a", "comment": "Malware payload", "value": "df0cab60f6c0bfcee7ae3b76bb1930adf006a54023755bc9f5d4bdeb50090367", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892519, "uuid": "87904b4c-7d5d-43cf-993d-19206c156bb6", "comment": "Malware payload", "value": "e6a8ccbf8fd81838bd5918c300adec2246af4fb8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892519, "uuid": "dde318f1-d9d1-43f3-a00c-e7c5c7788f7a", "comment": "Malware payload", "value": "f587750b6ecc83e8c8eaf3951dbb56b06dbe7fe685fff7c0c78e85c044da037536af9b9db2114f215f5f49e81ede4994", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892519, "uuid": "3a3f8f5f-d148-464c-8b3b-17efd80865fa", "value": "T10993712A368940F3D066807AAC89436AFDB070505B7C4ADB51118BFD9FB17EC7E78B91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892519, "uuid": "ec07b52c-7189-43f2-89bb-7817315726ee", "value": "5a599716a20059309d45fc8c8d7bd2ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892519, "uuid": "ce6d391b-7d72-4dd6-a50b-f55d2bbe4a92", "value": "768:JcumHgIa/kgXfYkcy2/QdUbxgi44Ji17aQH7HV9P:JeHlIPhS4dixl44Ji17aQH7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629892519, "uuid": "6d91b791-98e7-47dd-b715-5f30f08a7d8b", "value": 96768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629892519, "uuid": "b121cadb-d0dd-464d-8268-7e75afce9d23", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892519, "uuid": "ff43b03a-60b8-4bb9-9ef6-a024e4c85c3a", "value": "df0cab60f6c0bfcee7ae3b76bb1930adf006a54023755bc9f5d4bdeb50090367", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3f51a4b-0564-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869061, "uuid": "e9652a70-35e7-448b-8a8e-e80a1f1851aa", "comment": "Malware payload (Dridex)", "value": "b6378db23ca125de2566b7e7d06f0eee", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869061, "uuid": "27f2bc6b-8e98-45dd-9f7e-d46a7bc0093d", "comment": "Malware payload (Dridex)", "value": "df9867b55f1e56af65458aead4ed15464608cd5c11dede7e15a3d0e9d8fdab95", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869061, "uuid": "4a13ded1-5dca-4390-965f-d3e3976ef29b", "comment": "Malware payload (Dridex)", "value": "81d279e1c574d8f1ad15d5ba5a78c3f0c8117366", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869061, "uuid": "886c901e-08fa-48ce-8ff4-d72cd36e370c", "comment": "Malware payload (Dridex)", "value": "4a40261a8c732b5b12ec6241b5c921b91cd6441fff38ab8cd4dbfac6820452bf123ee396b6df5496832b6fc49915413a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869061, "uuid": "f058b19f-2c6c-4f9e-8e4c-c66238c1896f", "value": "T1EBB3D0AA3221DB6DC129433C54DF5FBB37B48F9512A24707122EF51CAF239A7DB44229", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869061, "uuid": "ad708348-b1f8-45f8-9305-801768260ae7", "value": "3072:oUKsuuoCBdPnmxai63LD6z2qoaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa3RY3PB:ozsuuoC4H67Moaaaaaaaaaaaaaaaaaa7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869061, "uuid": "ca96ad26-e149-475a-83d9-2444eba5c052", "value": 115550, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869061, "uuid": "78663d15-07bc-4d43-88b3-4ca059082b01", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869061, "uuid": "f0dcdfc8-0bdb-460f-9da8-8b338f900eee", "value": "Scan-0988354561_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b4559b2-05c4-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629910117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629910117, "uuid": "708be005-b44f-476e-bba0-fb8740b59171", "comment": "Malware payload", "value": "d7221482b7c1ea132afc2afcd63c8c2d", "object_relation": "md5", "Tag": [ { "name": "Beacon", "colour": "#3CE751", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629910117, "uuid": "b22eead7-d681-4632-b879-2c8d9592c33a", "comment": "Malware payload", "value": "e1b1eac17b87d81d51842317033725c9d6e1b68a019016bff273cfa2f5e1fcfb", "object_relation": "sha256", "Tag": [ { "name": "Beacon", "colour": "#3CE751", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629910117, "uuid": "6cb154bd-caa6-4387-b160-1b7297488df2", "comment": "Malware payload", "value": "9f3dc73e192110a708e122b56889c8ab35b70a3b", "object_relation": "sha1", "Tag": [ { "name": "Beacon", "colour": "#3CE751", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629910117, "uuid": "b94bd146-8515-4655-8d9d-08b3d90e8778", "comment": "Malware payload", "value": "40a38d02f93a533dd5445ef81bb678df7c3459a401bd93a4bb8c9eb4906954bb39371a8a547614deebc433424b925653", "object_relation": "sha3-384", "Tag": [ { "name": "Beacon", "colour": "#3CE751", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629910117, "uuid": "bb08fdff-d75d-4ae4-9c2b-1228fd5497e7", "value": "T15A44DEB0C8BD4B71A95B7293B16B924232F9EFB8054B1A13DD7124F94AFFC637068941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629910117, "uuid": "ce2588af-e925-408e-8547-e7c68257d773", "value": "6144:0BC48n4jx+4S3lcu2lEdgW9XpCo6PIbKppa1QVDSdbGNDbg/ix+K3L:F4P+x36n6dgW9XpCoh0U1EDSZGtbg/mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629910117, "uuid": "ebe95e5b-00a8-4330-9d21-4c5510f6c0a2", "value": 262727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629910117, "uuid": "d1f1886d-b7e3-42a8-8e17-333b1f5289eb", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629910117, "uuid": "99e8c44c-ca34-4a18-ac2c-8faaa9c94131", "value": "x64_beacon", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b7ddd41-05c9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629912372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629912372, "uuid": "b8376fc0-cbc3-4eba-ae9d-64fa7d56b1c6", "comment": "Malware payload (AgentTesla)", "value": "d1768b2291267be09dfd0f337f083b5a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629912372, "uuid": "57043c45-3d54-40df-814b-17715db139b5", "comment": "Malware payload (AgentTesla)", "value": "e1d479403c0124c26aa292975d46cc2dd7532e8523d4105b9c68494bf6c56097", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629912372, "uuid": "f9406b5e-82d7-4f07-8de3-e248f7325918", "comment": "Malware payload (AgentTesla)", "value": "c5da2a68bc2eec237461c6b4ad0bdcc5eea2bded", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629912372, "uuid": "ae1655ee-4d36-4ca7-b9b7-9ece3776bd84", "comment": "Malware payload (AgentTesla)", "value": "00983323e2aa435a9e8f9248a69020da40c943a1dd068d27221bdd375e192d551790252b0d66fb1db3230af3f6b9ceb0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629912372, "uuid": "4e0193b5-ec0d-4435-86dd-74ac3b37e600", "value": "T11F05917E1ABDA2278175C2B5EBE74417F0409B5F3411AC297AD203664232A7BB4F732D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629912372, "uuid": "aaa31d27-45a2-4bd9-81a9-5e1f2dddf6ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629912372, "uuid": "1bdc9366-0db0-411a-90a2-c4fe40a4add7", "value": "12288:QrHxgxrSK4N/vDdExSmQ7ERo9gXuYRVFxF2hDU+vTK08Blz:QdgBx41vJ6SjEQgXRT2hD1Z8fz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629912372, "uuid": "328275c5-f540-4351-bd35-649aeb334116", "value": 832512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629912372, "uuid": "ac968ccc-8255-48f8-ae4c-44d1f3e7affd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629912372, "uuid": "fb7ca71f-3680-48e2-8a8b-d386535b3e46", "value": "Aviso de pago.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b40305c8-056e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629873356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629873356, "uuid": "3949092f-5bc8-4177-8e3f-bcebf2795d12", "comment": "Malware payload (RaccoonStealer)", "value": "fadd564a15273803562f9cc59accd090", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629873356, "uuid": "0c8a961b-3f72-4fc7-bee4-358a77b78cd6", "comment": "Malware payload (RaccoonStealer)", "value": "e2281e35d1a66eab62c14aa7dc8b1d78e3cfcefe421edba720433d20806b159e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629873356, "uuid": "9c28b786-a1e3-4030-8049-af156d5feed6", "comment": "Malware payload (RaccoonStealer)", "value": "d0ed4d6f94012f205fd5a82bdba1d82d31239a05", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629873356, "uuid": "f59a7f36-51da-428e-91a0-fe722c0fb9e4", "comment": "Malware payload (RaccoonStealer)", "value": "40590633f293da110feb36f63fc031439e7dc9141fadc60784c0e10a3f2c75ad162badd5410f5585062f3918b7beb4b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629873356, "uuid": "9b0f989b-199f-4800-90f3-3fe27afb6b28", "value": "T1D1B4D030AAA1C035F9B211F445BA83B9B93D3D716B7440CF63E56AF916386E4AC30797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629873356, "uuid": "1f38e577-f789-49ad-b647-f8d4392bffc0", "value": "ddbb3eef631957f988f10b48742f9549", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629873356, "uuid": "8ae0565f-a968-404e-a547-d1b634d1ec3d", "value": "12288:lu62iMQ60Py4gxmhbOHQwiFdEgvKCM4xWADJgWJXoG:kQ60fOArEgvPM4xxlWG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629873356, "uuid": "0b49c668-3555-4705-9e80-bbb8ebebd2b4", "value": 539648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629873356, "uuid": "89c21086-67bd-4b25-8395-7936900666ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629873356, "uuid": "7194e9fb-764f-4bc9-bf47-ff498a87c9a4", "value": "fadd564a15273803562f9cc59accd090.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63b3f3e2-057b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629878805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629878805, "uuid": "6c411324-2557-4828-a655-a411869ab6e4", "comment": "Malware payload (RaccoonStealer)", "value": "66a7beec814c68a6ad3268824d7a22b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629878805, "uuid": "936e1635-a9c9-4b40-b0db-5fed775269e7", "comment": "Malware payload (RaccoonStealer)", "value": "e40ba58eddf9ffaa37b20785b54ce2e954eccaf79fc5fb1f6bbef8182762144f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629878805, "uuid": "2de51826-47b0-4be5-89f8-dce40a468744", "comment": "Malware payload (RaccoonStealer)", "value": "359a8874dcf7c34a786c11477a94c8d24b550f73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629878805, "uuid": "e289f59e-1263-4a61-bbf5-790f6f5dff89", "comment": "Malware payload (RaccoonStealer)", "value": "5fb32f7ab520e03c841f4c99c1708188e373664384fae2a5025037f0283c96b06f8ec66b6022ca812d2180ff3f360cfd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629878805, "uuid": "7c0945ae-0c13-41c2-a0e2-860e05c39796", "value": "T10BB4E031A6A1C434E9F311F849BA83B9A53D3E716B7490CF93E51AE906386E4EC30757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629878805, "uuid": "90110652-20f2-47ca-9e66-b1dcfee0b93e", "value": "b1f244737f482f7370a4248faac2bcb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629878805, "uuid": "81629238-2f97-4a37-b345-fd552851a7b9", "value": "12288:aKRUAfYXZqORajnSFnLVLLvyS0c2uxvQ55WGshetVvl+/:vYXZFfLn2t5bV4/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629878805, "uuid": "6f7b6469-626b-416b-9f82-5521400b80a7", "value": 540672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629878805, "uuid": "0c3ccfdb-394e-423f-956b-c81c0ac9c278", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629878805, "uuid": "673d3d88-e412-4b22-a4b5-4b02d4445443", "value": "66a7beec814c68a6ad3268824d7a22b6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e178ba11-0578-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629877727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629877727, "uuid": "328eeb89-da59-4154-b368-13eb4d926652", "comment": "Malware payload", "value": "de7f48fd561e707a0f9a3c39d7057551", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629877727, "uuid": "fa005ee0-a5ed-4ec8-8af2-5db2488f0cf8", "comment": "Malware payload", "value": "e5370c83aa9414d30056fc12c2f267408e828f5a953cde165841cb782f5e4559", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629877727, "uuid": "e5cc773c-2f5c-44fa-9154-3ae3fdd090be", "comment": "Malware payload", "value": "2e9e1d2eed64cf16d12072b1113644ae6ab74379", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629877727, "uuid": "194e0013-99a6-4fb3-b103-6989d01ab251", "comment": "Malware payload", "value": "c531e17ebb0abef57f78431cc647e5e59aac35a81fe1b600861bce56aba29cc7e916198b594246b9cc8eec95263dce19", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629877727, "uuid": "f3f144e9-2fc9-4475-b422-08d2ef0e8907", "value": "T1A1B3FBACD09707A88F89ABB4771F5F46058EB12DF7649233326857316BD2C7A801797C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629877727, "uuid": "40527e00-a191-4475-bf35-fe375dded9d8", "value": "192:nBobHe4e1GS0EyTknVI9ZiXWje3c43Wf+wGcrUjSSiQSP1TOnRx:n6e1GSDdnVaZ1eM43WffSiQSJORx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629877727, "uuid": "76f055de-d284-47be-940a-43f6ab0168ad", "value": 112043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629877727, "uuid": "cce69003-0587-4523-a7cc-ac18ee426c29", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629877727, "uuid": "3ebc0e5c-52b7-44eb-b2e4-063732512199", "value": "Inv355762%uFFFD100.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9f80e7d-0564-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869098, "uuid": "0cfb8d0f-99dd-4f42-9f4f-e6c0ebc29d2f", "comment": "Malware payload (Dridex)", "value": "962f3671849d38db87cccb8c366f4387", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869098, "uuid": "67e5c348-0e96-40df-a8db-3ea20133e98e", "comment": "Malware payload (Dridex)", "value": "e564b47be16aaa8ebccc4b8169b75673558296a970b0c2c252f4323702fd1b7f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869098, "uuid": "8876a9fb-8d49-4aeb-884c-5f0ff70fc4e5", "comment": "Malware payload (Dridex)", "value": "751e04d23f7c3ed67e8436838d7e52fa134a82ca", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869098, "uuid": "f52922e8-bd75-458c-b060-f5a9daa56072", "comment": "Malware payload (Dridex)", "value": "f64d8aba87cd5f2c11b5efe9643e184a7f883c6aa78e3b00e6e73c003ddaad8ebf919aac8588e0863687f2e975f91211", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869098, "uuid": "a9c8135e-229e-49f5-8eef-d889b79e4043", "value": "T12BD3D0A97232C94DC46A977C06FE5E73ABF4CB5442A147171268E89CAF23CDBCB4421C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869098, "uuid": "5f408cb2-b13c-4d50-9ca5-2737e2db62d8", "value": "3072:oUnSWXsMt/9tuZC9zAs4Ai63LD6z2qoaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaE:o6sMtVOC9zA3J67Moaaaaaaaaaaaaaau", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869098, "uuid": "b230d249-f279-4c91-b076-764246a6f5ab", "value": 138041, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869098, "uuid": "074268b5-231a-4f3c-975c-b6cd4af8665a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869098, "uuid": "7c738591-4524-487a-bfef-5f5e1264ad05", "value": "Details-278115524_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1b7e325-056e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629873406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629873406, "uuid": "b7eb4142-e3b7-483f-aa5e-94b96540aa7b", "comment": "Malware payload (Loki)", "value": "74a49c90c489105c35cc3baf911801da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629873406, "uuid": "fc738eaf-ee5f-4fe2-9462-1b6613101809", "comment": "Malware payload (Loki)", "value": "e579c8cf281a68865d90c2dc3670a56abfbc0def8b0d540ab1d5825bbb3e9816", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629873406, "uuid": "57d741c7-c2be-45bb-acaf-f9299631a4f3", "comment": "Malware payload (Loki)", "value": "5db662b414063da2f81ed7935ce05113569219b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629873406, "uuid": "ab1ace41-8b5c-4bde-ab1b-94b54888ff4b", "comment": "Malware payload (Loki)", "value": "4743870d0d04f7e8c33ae1e527fe18d0b1773035c7293f19674a6c0414aca445d64e5da875767d96a294ea4efa077b50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629873406, "uuid": "c1820eb8-6a63-44bc-ad79-d1089f23451b", "value": "T109340275F72BE65DCFEB043C7ECF12637A1D1E2A621612CB0552BAE49075B490D3CA22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629873406, "uuid": "08ae0135-1587-4918-8d44-5cb2db676017", "value": "439ff53323e9506db8654c0d8af9cf37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629873406, "uuid": "9a403083-1791-445b-953b-e4a6d0b22077", "value": "6144:WKKVBuSc1b0q6NdnH+WO6NgwIl0EQtH2NS0DKxcBdwOsTrx:WKaBuSc1d6Ndez6Nj2C0YcLwJx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629873406, "uuid": "178b54b0-1370-47c8-9fe0-ea14f9b6e74f", "value": 231481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629873406, "uuid": "cdaaa3dc-247e-481f-b50a-7826ad18a373", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629873406, "uuid": "741a38f3-5d89-4dcf-858e-f6edde993f4c", "value": "RFQ7823720.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25816942-0565-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869252, "uuid": "fa8b3bc1-c2c1-4e4b-a7ed-c629fca20847", "comment": "Malware payload (Dridex)", "value": "ca5864075a59e0e794cf06b158fe3076", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869252, "uuid": "73fe4c61-5cba-4d56-898d-025e4446ba5c", "comment": "Malware payload (Dridex)", "value": "e6b94b21bcf4b6e11369abd719f9197f69fc47b023ddf09ca6d0b572264877d7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869252, "uuid": "cf69de47-d4fa-49ed-b525-bba5cc60e199", "comment": "Malware payload (Dridex)", "value": "65e0e5897c5b6be2569da7ace19af0c8c65d0894", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869252, "uuid": "75e063a2-be60-48ae-8151-badb1a2881cf", "comment": "Malware payload (Dridex)", "value": "d9e72b0eceea6bd85ad9c4117d38328e868086e94062edcf51064e73a23454debb706d1bfc64d41dd24b0d4cc56ee406", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869252, "uuid": "b35c4bfa-a858-4c9a-bf29-04c48346f70d", "value": "T12C74126893A1C84CD94E503F91D70FB1D7715A16A6C2BB0F81B2B30D5F07D7E8A6B0A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869252, "uuid": "12a6180f-858f-418f-8912-d0be2506ab42", "value": "6144:ojJRlNMzz2LohOGYw6CC5jTT453mjEIbWiGVAKSLFN+YInSCRvuPsxNwK:ODfL2OGY/TTy2jEIJc6FNu3uPmNwK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869252, "uuid": "cb14299a-e24d-4eb5-94a6-4cf1f954953b", "value": 357038, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869252, "uuid": "c445c403-84b6-487d-a9f3-35a1f9c42765", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869252, "uuid": "cb6eb21d-6f04-4025-8bbe-bc40981d0e9d", "value": "EoY_TAX_Export-9531_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29b24235-0565-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869259, "uuid": "8b44f730-43db-4985-b72f-c64b0b94321c", "comment": "Malware payload (Dridex)", "value": "77ed2e723a9b226fdc1be0f39481672f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869259, "uuid": "8b15e7ba-9bd4-49c0-afd4-613e1d257b97", "comment": "Malware payload (Dridex)", "value": "e852bff96cb4f89fdeadc87957142a07193e9e965019ebc5ace0190e5e6b91ed", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869259, "uuid": "d463ef0e-0089-48f2-8b88-13b2b25ce37c", "comment": "Malware payload (Dridex)", "value": "a0cdaa49fd109092d0b7d7ade18b58b372db79e3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869259, "uuid": "d810259a-95fc-4d99-9292-6d5fa24814b9", "comment": "Malware payload (Dridex)", "value": "35218257a2ca6706b6fddd50262512372c8b13ce9e86af294d0e18da22b4d794f7a0e27d2ccbc28c3e8253a95d3ad010", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869259, "uuid": "8f2258c8-78a5-45c0-affb-fd4e21016970", "value": "T1FD84126882A6CC0CC94F803F51A70F32D7A15A06E6D57B1FD1B1E6196F03D7E4B6B1A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869259, "uuid": "d98dde08-dfa6-4c62-870b-1269dedc7d81", "value": "6144:o0q7xGN9jLGWqCToUR2LohOGYw6CC5jTT453mjEIbWiGVAKSLFN+YInSCRvuPsx9:A7x0vPqlL2OGY/TTy2jEIJc6FNu3uPm9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869259, "uuid": "d9e07b2f-a553-45db-9674-1680b7241e9f", "value": 380445, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869259, "uuid": "2f628a9f-d17e-480a-b0eb-e60d37455fab", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869259, "uuid": "172ec294-4aa8-47ef-9f3e-38ba8d22c8d4", "value": "EoY_TAX_Notificaion-22971166_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29c860a8-05b9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Tofsee)", "timestamp": 1629905336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629905336, "uuid": "c8036275-4f2d-4257-9355-eeb34d2c8b4f", "comment": "Malware payload (Tofsee)", "value": "f855c178ba66fef7013303cca97a1a4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629905336, "uuid": "e5e8ecbc-7d21-4892-b36a-e6802364af37", "comment": "Malware payload (Tofsee)", "value": "e87a5c719ac7af99f1478732889d5df0a275315b42b3b9aecc8b91333bd9c0af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629905336, "uuid": "9153fbaa-1ad7-41f6-8d26-471c542054f2", "comment": "Malware payload (Tofsee)", "value": "26756ba97d394b418af1a6772a226ff2f2c18b55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629905336, "uuid": "3cc9564f-5d43-4c16-9380-2e9066460bda", "comment": "Malware payload (Tofsee)", "value": "ddd561380d98aa30e5cdea6884603f91dc02907c15dc326d5e2b4b0ce570c280bb3c1c3ac1b109cb744fc0116ecfde95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629905336, "uuid": "a7786cfa-a8ba-4e3f-98f7-f389d47cd308", "value": "T1EC447C30A691C035F4B311F859BA93BCB53A7AB1673450CB93D526EE4234AE8EC31797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629905336, "uuid": "6b51cf7f-b77c-46dd-b6ea-5e3140449f2b", "value": "35372ade599ee63db174ac99307517b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629905336, "uuid": "a5f9a82a-2fd6-4db9-acff-4713bec44dce", "value": "6144:jqs4O6bVLJnq2splH1e24EafBw0+8WloM+nCbVV:1sZL0dfJ4EaZZ+9oM+nmV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629905336, "uuid": "2a7bbce9-d9df-4083-9d64-eaba2988e69a", "value": 274944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629905336, "uuid": "94597692-081f-406f-a526-54df8f1a0637", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629905336, "uuid": "916bfd71-3192-4d90-a0b9-22027258ea57", "value": "f855c178ba66fef7013303cca97a1a4e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e073c21-0565-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869212, "uuid": "40097f05-d71e-413b-a0c6-e5ad60820428", "comment": "Malware payload (Dridex)", "value": "3397913100a0349189c38bc7657d4101", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869212, "uuid": "3850ce4f-4074-46eb-b5df-d4a999b5141f", "comment": "Malware payload (Dridex)", "value": "e87c0e6b253b3152a0ee46ccea13c051487d4d722a29e730c694270c295cec74", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869212, "uuid": "fa8be9bd-8462-4611-9983-0d67d7491ec9", "comment": "Malware payload (Dridex)", "value": "41840b521437d8f6117ef29cef00ea654622c609", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869212, "uuid": "4e46539f-eecb-476a-a724-d909605e9d5b", "comment": "Malware payload (Dridex)", "value": "6c5c5e0350cf52796d019734b6fc952ec343a73f12dc0238860e6d69c32b7838388010105686eda8a9f2106fae1d0b01", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869212, "uuid": "504a904a-0cbe-4ae7-97b6-d63463ca516e", "value": "T164C3D09B3132D66DC13E823C92DF6FBB6FB48F4452A24616216DF46C6F226E79F04118", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869212, "uuid": "c1121c6f-2c68-4ede-9c8d-81c29cbf58c1", "value": "3072:oUeKxRn6cIJP1i63LD6z2qoaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa3RY3Paas:odep6LJP067MoaaaaaaaaaaaaaaaaaaM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869212, "uuid": "37feb400-3257-4365-b2b6-17ac31d76a7e", "value": 120605, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869212, "uuid": "1bf1c24a-74e0-42b8-be21-81b363e6de99", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869212, "uuid": "0e6b43ad-799d-481f-9b2f-04f4275b9445", "value": "Scan-86533954_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d22a7817-0564-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869112, "uuid": "6feecc61-26a5-4f90-a255-a7560da3d350", "comment": "Malware payload (Dridex)", "value": "9dc15b501b36602e1b926b83b8512b1f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869112, "uuid": "3003b5e9-ee72-4e4c-bf62-6cf757015f98", "comment": "Malware payload (Dridex)", "value": "e880f31959ccaa8226bf362e61b13b8bf0503fb17a48b80180e55eb2ebb1743b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869112, "uuid": "709b1fbf-6466-490b-89bc-a439be503149", "comment": "Malware payload (Dridex)", "value": "ed8e773d0c8f868336cd4d67c5e2b52882cdbe24", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869112, "uuid": "cceef21b-647d-4ead-ba5a-b509909eab9b", "comment": "Malware payload (Dridex)", "value": "e8c1a19d8a9acdec31ea362a6c0f28eee33ec7bc8a4f913d5038b0ac094f8e221547ce026d1366b93c3e79d2df52117a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869112, "uuid": "be7593e8-9dad-408a-8021-3a50e34e3bb3", "value": "T1E28412A886A2CC5CC89F423E95DA0F72E7B10605A6C17B1F45B0E65D1B13C3E8DAF19D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869112, "uuid": "55755e40-b1ae-40eb-a767-4c7036931e6f", "value": "6144:ojqmEgVwbNad++2LohOGYw6CC5jTT453mjEIbWiGVAKSLFN+YInSCRvuPsxNm:+qpNaEL2OGY/TTy2jEIJc6FNu3uPmNm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869112, "uuid": "c3b12696-a22e-4d95-bfab-cd853ecdb88e", "value": 383461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869112, "uuid": "92c8dc5f-a160-43a8-ab3f-0976f066fd78", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869112, "uuid": "070df742-86f8-4a70-9efb-416699c1cfb6", "value": "EoY_TAX_Export-595467158_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa5fcc4b-059a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629892238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892238, "uuid": "99a5c1f9-58f8-4778-89c6-48eb03a45c9a", "comment": "Malware payload (Loki)", "value": "bcdc0ff471d2f50e5f7a1d46a500a550", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892238, "uuid": "a1208815-8449-4754-943b-763c7ba34cfa", "comment": "Malware payload (Loki)", "value": "e8818a8049c6464932aeec9f37434d02bca1a8072c8711a4a18831aab4749a5b", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892238, "uuid": "7d67f669-bd67-44ec-98cf-52ce6643e100", "comment": "Malware payload (Loki)", "value": "a67bcb39da1465e6d66afb5c7c0f3ee0d52ae09d", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892238, "uuid": "ae4a9772-80a5-4ab3-afff-ba193a01105a", "comment": "Malware payload (Loki)", "value": "8a8e8b36f74d9267838283c2463f625bfc948b787e556650df43b459490aa475a72144ccb5934b807c6b56b88e74a57d", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892238, "uuid": "316a02c5-63eb-4e8e-898c-fa6333f3e9ab", "value": "T13345121AE62E4A87D0B37074B720E6B43054AC14E5CEF8FA9A557E0BC235E9CCB71C46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892238, "uuid": "9de6f462-5f51-45bb-8b0f-ec4f998c7a2c", "value": "24576:enHTCEnYFfqG1LnZn8OABy191J8Y2XFHOWmNxFrX9ErJ:7EYPl2s1CvtKDq1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629892238, "uuid": "d808503e-9c4b-4a86-b9b7-2ab2574059b0", "value": 1246376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629892238, "uuid": "5b0e960a-9d25-47ef-a126-9b7115e64232", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892238, "uuid": "a21755e9-8cb4-4e36-9af0-fdc78c872b4e", "value": "Sales Contract_20210113.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b57ca5ec-0564-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869064, "uuid": "07e039fd-1005-437a-b2db-57ef229f35ea", "comment": "Malware payload (Dridex)", "value": "f76b416ff446c5a252b3c82e7bb3a181", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869064, "uuid": "9fc05149-4da0-479a-be2f-4a23353adfa6", "comment": "Malware payload (Dridex)", "value": "e8b85e89495f9bf9f9b1ac4cd123155375972772a0fc899c584c226525ecfb5c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869064, "uuid": "0135aa7f-df69-4ca8-a1df-6a7a1e6057a2", "comment": "Malware payload (Dridex)", "value": "75fb5fa0c5e84187ed024e90b6148557cc9dd2f2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869064, "uuid": "a4fa2f02-12cf-4c41-9767-8d76e142a6b1", "comment": "Malware payload (Dridex)", "value": "cdfca61c4e1d911c1cd531a7f5cd228120b9523310a04358afec0342a108d12d429f48c430ce7e1ac3b7fc71e3ffea45", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869064, "uuid": "03e7fa43-2c95-4949-8246-287e1804691a", "value": "T1CD74126896A1C40CC94F413F61D70FB1D7B15606A782B71F86B2B60E5F03D7E4BAB0A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869064, "uuid": "c9f54704-0ba1-47b8-9541-a05edaca0835", "value": "6144:oro8Xs602LohOGYw6CC5jTT453mjEIbWiGVAKSLFN+YInSCRvuPsxNj:co8XLrL2OGY/TTy2jEIJc6FNu3uPmNj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869064, "uuid": "9ccf23f4-8a10-471e-b554-59df86c4d981", "value": 353539, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869064, "uuid": "d36e671d-e86f-48ba-acf1-96b0c04a41e8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869064, "uuid": "4c4f4f3b-f195-4fb0-a994-87572a9f687a", "value": "EoY_TAX_Export-825564390_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3264a678-05fb-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Glupteba)", "timestamp": 1629933698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629933698, "uuid": "d7d545bc-b6cb-48c9-8a4c-5687bf0f9bf8", "comment": "Malware payload (Glupteba)", "value": "93b5e003653f38ddaa5f17ac6265e667", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629933698, "uuid": "817723bb-1f7d-467d-9d58-f69005d4fb0f", "comment": "Malware payload (Glupteba)", "value": "ea0caa6312daceeb1afafa56060d7de28ae4a91c814c79c4ddbf6f2e751d50c3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629933698, "uuid": "02dbd193-12ed-4728-a4c8-e700040c7a50", "comment": "Malware payload (Glupteba)", "value": "0d00421e970dba8ca2ba409e1861ea3b87e61459", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629933698, "uuid": "003d1b9b-bc89-4930-b2c5-3b3f4d24955f", "comment": "Malware payload (Glupteba)", "value": "50c6b45cd23e15cd01c5ef10bf68384081b20170043bd0550518cfb07abc5c982ed1cdc0d4446e6499e05d0c5f8116c3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629933698, "uuid": "6b97a7b5-804f-493e-87e7-9b250f18fc11", "value": "T1242633862AF5842BEBC21836893CDD341B1B38E316F9C5477685047ABE5B360856CBF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629933698, "uuid": "2598c292-14e1-4e50-bc3e-596752350659", "value": "c2177a2021a127fae92a922150801df7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629933698, "uuid": "f8cd6854-2e17-4e14-9df4-1f787caef59f", "value": "98304:W4k4uKmwYOjbaFBfnLleT0Rnt3S9L2/4NAzWQtEx/rh8ATEYgiHe:64uYYOKDleT0RhS9L+PWMMDQke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629933698, "uuid": "4551b30a-ad41-4266-971a-f65818314d94", "value": 4586024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629933698, "uuid": "a4b67ce7-92b0-4540-b576-6608ec2bb8ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629933698, "uuid": "da6fb555-52e2-46cc-bd0a-b247637052a7", "value": "93b5e003653f38ddaa5f17ac6265e667", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ade554d3-05ce-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629914578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629914578, "uuid": "c69a53c1-189d-44a9-92b7-42156f36d69d", "comment": "Malware payload (Formbook)", "value": "87b725430604164cddaa09a4a727d3f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629914578, "uuid": "32359373-0785-4e74-9751-c4a2e51d81b9", "comment": "Malware payload (Formbook)", "value": "ea8e3b0f4f9e0cfcc715a9d984cb406dde36f29e0fd229da070b851dc717495a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629914578, "uuid": "56e5a5c0-beef-4b95-8334-2f93959b873f", "comment": "Malware payload (Formbook)", "value": "c0bdc3a547795bcfb920f2a625b50de0fc97f93d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629914578, "uuid": "91fac0ae-1257-4712-bcf0-0fac77e7a4aa", "comment": "Malware payload (Formbook)", "value": "042a0b63ede1b0c2d0ab30d470a53e0183b8a4383c2d1290f09ac740dc8eba5a9cf6483ed4696405cb28e547eb910f1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629914578, "uuid": "af080828-382b-4a52-9050-751cf219827a", "value": "T1A7F4E0AD7254B6EEC817CC76CE682C64EA60A47A430BD207A41719EDDE4D5CBCF190F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629914578, "uuid": "6d9ab8b1-6005-466f-97ca-82aa12ee2bfc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629914578, "uuid": "849df84e-19a9-4e6b-8436-b6ff58a2e5f6", "value": "12288:oElGn7sZbQMFqCwwR2xxtL6kK/V98hLbgrTvm26/3iIMcSMv2Gg1dIeWJOaaQSy2:o8G7sVQmljYxfWkKk1grTvmP/RnSMVgM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629914578, "uuid": "b8a67656-dbca-4c35-ae45-0f5645fb675e", "value": 740352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629914578, "uuid": "1f0bfdf4-9a76-400c-993b-b526e7b2ea0a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629914578, "uuid": "ae27df19-2893-4b5a-9878-ec4ab7cefed8", "value": "Lista de \u00a2rdenes de compra.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d2c38f8-059c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629893021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629893021, "uuid": "7da85a74-683c-4b9f-9320-8c519964429b", "comment": "Malware payload (RaccoonStealer)", "value": "777f622e5439a522a9aa2b1fa9d07a7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629893021, "uuid": "1268459a-df2f-4147-baa6-c8932bfbf186", "comment": "Malware payload (RaccoonStealer)", "value": "eadb6267e5b15be254ecd7199e49b3989ebcfdb70a3627b853883cc82c8ec3f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629893021, "uuid": "9c416dd1-2999-46c9-869c-93c636be7178", "comment": "Malware payload (RaccoonStealer)", "value": "7465315b9ab3f73845dde49d7b951ec9629ebe98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629893021, "uuid": "0756aff0-c1c4-4bda-b3ae-5e2d61ad95cc", "comment": "Malware payload (RaccoonStealer)", "value": "f25fa82fd1b1f16228bfdbcbd2860186aa17d7b2759c93640b536d9cbfa094151fbc884b5127cf7b13904ee96e6589de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629893021, "uuid": "a0d05ef7-6134-49c5-b236-6e3093c7b16d", "value": "T1B9B4D031A691C039F4F312F845BA837C743E3AB26B2550CB92D626EE56346E8EC31757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629893021, "uuid": "860c8336-56fd-4af2-b868-1ab61eca2a40", "value": "35372ade599ee63db174ac99307517b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629893021, "uuid": "fe15eac4-ed43-4b7a-b9b1-d54345de2603", "value": "12288:kd9Jo53dn+HcCOGDaFIItJK++NtwI+QQ9vzurroVflSHDbsuPH:+oAOJstwsQdursVflsAu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629893021, "uuid": "e3814cd3-23f0-4926-af52-a452c5cd22a3", "value": 532992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629893021, "uuid": "ae823e05-4221-436a-951d-04c1f01f1ae8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629893021, "uuid": "49c72f1f-c35d-4bf1-956d-21e9732905ce", "value": "777f622e5439a522a9aa2b1fa9d07a7c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0050fccf-0565-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869189, "uuid": "b8ff288e-afc0-404b-aa58-a9bad5e7995c", "comment": "Malware payload (Dridex)", "value": "e09ca36873a6f19d826d45037fda793b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869189, "uuid": "9a074ec9-9544-4d44-9909-e61ef407772c", "comment": "Malware payload (Dridex)", "value": "eaf4092fa892c99b4c3f3a843324bd297db4fac6c5a1b775f9a409505b13bfa3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869189, "uuid": "d0bdb5a0-babe-4b61-874b-b7c7d5776a2d", "comment": "Malware payload (Dridex)", "value": "2f6775b6447a17aa56eabf47617f1934d524fa3a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869189, "uuid": "c16c8fe7-3a31-4440-b5ff-0cbf636d01e5", "comment": "Malware payload (Dridex)", "value": "239c9336d65190ae414b0d337790060ef6bd8d9e4bf5ab4c26f78c7e66783e0041be4ec47de67594d50226f09c1d9769", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869189, "uuid": "d2369317-69d0-48a9-b7e1-adb1e2c7ef10", "value": "T1DCB3D0AA7232DA5DC41DA33C55DF1F7A7BB84F8512B25305527EF41CAF235A78B00129", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869189, "uuid": "289f570c-6657-4706-b5c3-36cb8ef550ed", "value": "3072:oU2QJsL2Kb8+1a95oi63LD6z2qoaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa3RYx:oBQOm+1aN67Moaaaaaaaaaaaaaaaaaav", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869189, "uuid": "bf830cec-964d-4323-9137-65b74558cf8d", "value": 112254, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869189, "uuid": "4bcf5f96-31d4-4b40-b773-76db2c0341bf", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869189, "uuid": "7e6493b6-2cfb-4e11-8141-ec89b5b7eaa0", "value": "Invoice-7628008_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6be1ae3-05cf-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629914995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629914995, "uuid": "579c4f0a-8311-4dc6-9328-280b0509da7d", "comment": "Malware payload (RaccoonStealer)", "value": "1956e96d8d6948a7198f0c61347f9672", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629914995, "uuid": "e3027ab4-ef6f-44c1-b947-750ff3f0310e", "comment": "Malware payload (RaccoonStealer)", "value": "ec462241d7846789716f4992913099d6ffcac3500cc703b784ed3e031254d5ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629914995, "uuid": "3c5f9c8d-98d8-4e38-850d-62710f1be4aa", "comment": "Malware payload (RaccoonStealer)", "value": "0116616a255659f5d3d16bee0109771158d13c97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629914995, "uuid": "0716117f-670a-47f9-b5bf-92d7dc942e42", "comment": "Malware payload (RaccoonStealer)", "value": "c97550cbcc671ff5cd50e60454ca719874b53fb9d51f16e258adf4952b4369e7abdf7ca9e960fc35f688d8e686f91bdb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629914995, "uuid": "8da83366-acc5-4e3b-9248-70024915ad94", "value": "T11CB4E030AA91C035F1F612F495B683ACB93ABEB16B7450CF52D126EE46342E5EC3075B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629914995, "uuid": "341eadb4-5ef6-403e-9a9f-3e7126b33ad2", "value": "1d03ad9b9e9a9068c266e5f5e715b4b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629914995, "uuid": "edf9d690-a340-4e14-83e0-08c471cd1f86", "value": "12288:CJk/CkZEOgZxCe7mruWNGsESXgapN6NHClWiANXvFWOMBAL:nCkZEOvBA6JNqiXAmOYA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629914995, "uuid": "25ad0993-4bc8-457a-a42f-6ee38552f853", "value": 537600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629914995, "uuid": "8cfdd874-9c29-4079-a481-6edcc6b2e40f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629914995, "uuid": "0b908acd-e2f1-472b-bd1a-a9a9298ce051", "value": "1956e96d8d6948a7198f0c61347f9672.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49bdb348-0569-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629871030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629871030, "uuid": "1b9c3000-6471-4278-b54f-412af79e85bb", "comment": "Malware payload (Mirai)", "value": "21919add22aee155ccbb65a88da9adaa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629871030, "uuid": "10bb3036-4d3a-404f-a3b3-58ad37b514c6", "comment": "Malware payload (Mirai)", "value": "eca277ab40b3e4a1a721c3764d70cab2aa6b40a8ba3401506fb84be244a7372f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629871030, "uuid": "7d360a83-2583-4b1d-8396-09e43802f4a2", "comment": "Malware payload (Mirai)", "value": "a848fc8d7e68c944c55eac7db4945d24c24540d6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629871030, "uuid": "c763c155-6d43-428b-a040-e37ff0e8b5fd", "comment": "Malware payload (Mirai)", "value": "28e8a560c67118b477ec5324ec39d0335d4ce54b45d267c1c3146874d9286bec41497d91f6b4242b109924da5fa81e49", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629871030, "uuid": "7ea0d86e-a751-47ea-ae2e-97b128f7eb9c", "value": "T17764F1CAFF11AD3AE9C007757AAB074DB3B59B99C3C3F150F250C61A39A9185AF660C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629871030, "uuid": "681ebfd2-9122-4388-bba8-52f4628002b7", "value": "3072:phNlHuBafLeBtfCzpta8xlBIOdVo3/4sxLJ10xiorKqqwPa5POdOQ33Q:p3lOYoaja8xzx/0wsxzSimKqqfPqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629871030, "uuid": "fa9ba397-3b5a-41a9-8cad-d84100878f6b", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629871030, "uuid": "3b74dd4b-7f83-4c07-815c-cc041611a3c9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629871030, "uuid": "194e8058-c890-4645-bab8-9b0f9b1dc0dd", "value": "21919add22aee155ccbb65a88da9adaa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f24c25aa-0564-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869166, "uuid": "2bbde31b-ec29-4664-b305-8fb9cfb2ef1f", "comment": "Malware payload (Dridex)", "value": "55e5f248080468f6355ef7cfdad1b0cd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869166, "uuid": "25d3934e-89df-4434-bd6b-368e418ef2e5", "comment": "Malware payload (Dridex)", "value": "ecb0e8c5f0f2fa786393a86c9b55ba5575d182d078929da1e5eb4a120866a533", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869166, "uuid": "dbb230bd-29b8-4c76-a087-eea638ebbf2f", "comment": "Malware payload (Dridex)", "value": "14ef9001e6e8df069cc054edc7d065339a17e84f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869166, "uuid": "d1d857d5-097f-4999-8c19-3768c96593a8", "comment": "Malware payload (Dridex)", "value": "0913456c20cb624d9a665c854de3095d5e0e009bccc4bd1470b7433547d4258de428e4f0ced99024cdd36febb9526f13", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869166, "uuid": "5e256e6e-922c-41d5-9f34-001e47d38638", "value": "T1CF74126892B0C81CD94E403F52DB0F72D7B11A56E7C27B1FD671A20E5B0397E8B670A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869166, "uuid": "52cf2989-6452-45bd-abb3-c56f8d2ba9a7", "value": "6144:o5WObTcXmUYHWkP2LohOGYw6CC5jTT453mjEIbWiGVAKSLFN+YInSCRvuPsxNO:VqmmUY5OL2OGY/TTy2jEIJc6FNu3uPmE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869166, "uuid": "90b3307d-8184-409d-ac20-b92c8e4f328a", "value": 354099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869166, "uuid": "95a449a7-8c0b-46ec-82b4-db937d2e5738", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869166, "uuid": "3c498c17-05a7-4d44-be9b-ef401d8eeead", "value": "EoY_TAX_Details-44822_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ffab3e0-059b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1629892596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892596, "uuid": "a5c97297-d17b-45da-b4e1-f60f6242ac1f", "comment": "Malware payload (Smoke Loader)", "value": "d7ed51f991b290df327320d3b390d729", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892596, "uuid": "53a37a49-a610-4d22-a58f-f80c306faf6c", "comment": "Malware payload (Smoke Loader)", "value": "eccd8757ac5a6c34abc69c2251a582a6697d9cbb5af2d8c5f8f8787b3156c3ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892596, "uuid": "166e641f-205b-4873-8495-1fef7e2a88f2", "comment": "Malware payload (Smoke Loader)", "value": "66fd8595d0886aa3d0340f16d807454c032e2894", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892596, "uuid": "17d0a65a-81ae-413c-aad1-be4666ddd2ef", "comment": "Malware payload (Smoke Loader)", "value": "9cf6c4aab17644115a1be191f25be87ed0660fa43d48663e019969151219dcf8f2440418db7526b451b77c1b478c12b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892596, "uuid": "c81fc2e0-7afe-4076-a772-6ee5d6f35d76", "value": "T177449D30AA91C035E0B311F895BA87BCB93E79B16B3450CB93D526ED06386E5EC31797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892596, "uuid": "411c27fa-a451-4532-a51f-5bf14f4c08dd", "value": "2d1e5013dd6b871ca263ffc72a0f89a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892596, "uuid": "e473c089-7c1b-4287-a89b-3f5734d8e16e", "value": "3072:/bzPQ2D4QPHiXQ7Asa5lZd2se/867xK5wEUPV57d7zcy2lqM/XR5mDt5V8SU1sc1:/H484Q6ogt2sA8P5wvd5BaSXVzzsPsJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629892596, "uuid": "890b3d07-2ca3-427d-99b6-0de2f798b4bb", "value": 274432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629892596, "uuid": "a178c228-0508-4b46-bbb4-a47d962e284c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892596, "uuid": "cdbdb793-e176-4789-88d6-84b9cf4bbd95", "value": "d7ed51f991b290df327320d3b390d729.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ada9893c-0537-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629849723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629849723, "uuid": "f2541d77-b4d3-449f-b805-6d8936d677df", "comment": "Malware payload (Mirai)", "value": "82c32dacf19ef5112e26a9e51809c5f3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629849723, "uuid": "3b397c64-65b5-42e1-9b95-e7afc49ccb01", "comment": "Malware payload (Mirai)", "value": "eda76090846fbf70840d435d0a922f0a0b0babcf2b8e5d45e398f062c0a7f635", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629849723, "uuid": "7f9ddfa0-0e50-431e-af72-c526e168fd9f", "comment": "Malware payload (Mirai)", "value": "dadbc518687ed7c1c4bc20bc1e9de080f4742004", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629849723, "uuid": "a6547982-5d4e-4703-9544-5bf21056da30", "comment": "Malware payload (Mirai)", "value": "dcf809a3e4b65a391d3e6cc09678de1c12e4844b11987ade62420719426ca8efa106471838117da176af8d82f642359b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629849723, "uuid": "213beb8f-468d-4ce8-a32c-055114bc4f53", "value": "T11C138D628075ADE0D10646B471348EB94B33DC24A69B7EF7AA05C6699087FCCF21D3F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629849723, "uuid": "39135ee1-08f0-43a0-b1dd-e0454e158efc", "value": "768:Ftref+naevXrVg8Cb+w9oR3jG/q6CFoGue9T1CCxLto:FtrVnfjLva83i/q6FGuG1CCxLto", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629849723, "uuid": "2f0919dc-749b-4934-975c-fcff11a6f863", "value": 43784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629849723, "uuid": "68d50ad1-9689-43da-8319-7d37ce298d7b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629849723, "uuid": "87908fdf-c7f1-499f-9e35-f2af829a38d2", "value": "82c32dacf19ef5112e26a9e51809c5f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea0c8443-05af-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629901364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629901364, "uuid": "b3d3b111-4a07-4487-a1aa-197a27ae0f7a", "comment": "Malware payload (Dridex)", "value": "0fdb784f5c2dca9e625bbba1c3bdc2c9", "object_relation": "md5", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629901364, "uuid": "3ab08503-c6ef-4a88-9ac5-6a9ca784819d", "comment": "Malware payload (Dridex)", "value": "eebfb3d0367d2dad5db7477869bab47f183cbd7a58a48c0592c8e9aa5b38861f", "object_relation": "sha256", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629901364, "uuid": "2ac9ff0f-3829-4e46-bb26-3b127a02c57b", "comment": "Malware payload (Dridex)", "value": "82339263b8bbfeb1cf30b347a102872f68670bd3", "object_relation": "sha1", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629901364, "uuid": "1f74d804-caea-4582-ad57-21ac860a777b", "comment": "Malware payload (Dridex)", "value": "e098fa56aba191f2868620414b222047ea65d162835db93f5540356db4b634fee833c70fa6b153d6e142cae47246dbcc", "object_relation": "sha3-384", "Tag": [ { "name": "22201", "colour": "#DE7164", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629901364, "uuid": "79c436d3-2bee-4fbf-b89d-b6e643482a86", "value": "T1C314D082CD9F46F9C21B167139F531BE21E80605A769CC2BCADAD2FBF47D300D46261A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629901364, "uuid": "9a7fa575-d1f7-49aa-a2b6-eb372a2345ea", "value": "15d931f2533164c416970d03fa5b5c88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629901364, "uuid": "40d9ea2a-e2f9-4995-94d4-07af13d5a4e8", "value": "3072:MH0uyjZqEpAK+Gf78TBdrXkTM5vhRg9Esf0DwvtyMpVnpA+z6tX8sxKViWZ7dU:MUua/Pv7YNhRIEZDeXVpAxtMsxK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629901364, "uuid": "f9b49a91-db91-447a-8d01-e087f0e51a09", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629901364, "uuid": "92d1f52b-08f0-4652-bea2-c9920cb425a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629901364, "uuid": "f7f5d5d7-5843-4231-b3f9-b30400edcda5", "value": "2uyv6x53xzch74.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8359a70-0586-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629883644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629883644, "uuid": "6f750dcc-ce36-4b23-9978-454612a6a193", "comment": "Malware payload (AgentTesla)", "value": "ac7212e8302e3f6cae583316176d58d1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629883644, "uuid": "33459c52-9a13-4b19-8e4c-d8f8219d4b8b", "comment": "Malware payload (AgentTesla)", "value": "ef5ca99d21601414bc0749fad9b68a7896e92e65c92ea5ffb9dcb1c5a953a1b1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629883644, "uuid": "84bcb9b7-18bd-4445-9adf-c063671c6cfa", "comment": "Malware payload (AgentTesla)", "value": "ca8acd17548301e1bb475a8171a974fb9eb8c5eb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629883644, "uuid": "c3c7e5e4-bf61-47ab-b769-da477d3b6745", "comment": "Malware payload (AgentTesla)", "value": "d1a30c3df1de7df14de4a4b0888f24e662e63ba39e8d523d4093b38d6dafd2c0d485e3645f18cd00f9c45a22cd1b753a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629883644, "uuid": "2cdc8d37-3bae-4535-8e02-0eeeb509edbc", "value": "T160459E257780B7D6D8690F328822168453F2A81B2737F75FA8D836DCAD31B17873B652", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629883644, "uuid": "f013dcb2-e4be-48d9-a62d-a6a12d6dac6b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629883644, "uuid": "e7494a21-2ebe-4cf7-a1c6-1e328d4b96c4", "value": "12288:Y8AwkLiDqrU/BfH8oQsLhBN9aTom5OuHnel++mOVIx0z0TGWlP/feQU7:VABIvhf9aTXEuHv+fex0z0isHeZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629883644, "uuid": "a3da165a-3411-4e0e-b89f-238a801a3001", "value": 1203200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629883644, "uuid": "b0e2f63e-c5b4-4329-903c-4b72e88c4c62", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629883644, "uuid": "0e13fada-b52d-4532-9c6f-bd2aab3290d3", "value": "Urgent request ORDER#-ASLF21T33.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88e2dcd9-05b2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CobaltStrike)", "timestamp": 1629902490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629902490, "uuid": "6dd6bd3e-1f2c-45f9-9069-1766c2f59c97", "comment": "Malware payload (CobaltStrike)", "value": "03bd9d1615e155c57f9a0dedad00df20", "object_relation": "md5", "Tag": [ { "name": "1359593325", "colour": "#0C1016", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629902490, "uuid": "6082db94-7324-4c3b-8992-5fc44a4e1a69", "comment": "Malware payload (CobaltStrike)", "value": "ef6544f318b62ad4c219ca2ebe185772c69c3991bdb82e5a508adcebf12675cb", "object_relation": "sha256", "Tag": [ { "name": "1359593325", "colour": "#0C1016", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629902490, "uuid": "8a71eee2-a864-4ae5-9550-2d718ca17868", "comment": "Malware payload (CobaltStrike)", "value": "1de2eba7e87da57fe5e1c9c4e042c13018d6aa2b", "object_relation": "sha1", "Tag": [ { "name": "1359593325", "colour": "#0C1016", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629902490, "uuid": "7ce2bd65-91ad-47cb-a620-bdb3525ab84b", "comment": "Malware payload (CobaltStrike)", "value": "b27fe826f3d050674b10e9c0b4a0b8c1bb4f1f024fc072a0a0f3e46f9cd3517945fcbc03fc7eab73d6830671ed3e41d4", "object_relation": "sha3-384", "Tag": [ { "name": "1359593325", "colour": "#0C1016", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629902490, "uuid": "b852a0a0-9856-40c2-934b-0e435ff8db1c", "value": "T15A04F17B5A21E49CE63C0CBE76FB1AF003043E75CC12BED8056A7594265B6F789882F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629902490, "uuid": "8610a644-65ba-4905-bdc7-3944170baa7b", "value": "3072:oUcIhO3Sfwua25bk2wFaBRXAC/kfpdcvz+OVQaw4+rJDEU/H7DcYtEeG/X:oghmS9RdkRaXl/kxdcvzQFHr5/bDc8G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629902490, "uuid": "19ca3d86-e92c-46a9-a7cb-c068d184bdb8", "value": 175950, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629902490, "uuid": "6850fee7-0a16-4fd3-a319-953f1a484310", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629902490, "uuid": "cc0a8627-057f-4b4d-adb1-baff20d66534", "value": "Invoice_Due-IN-8663362718_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26c765e3-0565-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869254, "uuid": "03fe94b3-07bd-4725-9eff-ed236248e9a9", "comment": "Malware payload (Dridex)", "value": "f2e0730d139f1678ea684c64e19bcb4b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869254, "uuid": "77ecf75b-a20f-4e96-ad6a-39a868608109", "comment": "Malware payload (Dridex)", "value": "efb42b3b350b84fc4f0818710d613fdaecddf6b000420543e172f42fa40d9003", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869254, "uuid": "4f2ce918-b068-43d0-ac8a-47200c38df5d", "comment": "Malware payload (Dridex)", "value": "536424c97f9dabe59260da33a56c36b733235e93", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869254, "uuid": "8aaf1428-30e6-449e-8a8a-1b6b5dee500d", "comment": "Malware payload (Dridex)", "value": "8fd48c0115156ed505819dafb6679dd9ce8777833a2eb561d5387485cef28bfb32b6c61d2efc016136aac1d221cf96f3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869254, "uuid": "a41c330a-b186-481b-a729-dc13a3f0cf0f", "value": "T115D3E19FB93BCD8CC02E537C42FF5AB67BB48B1052B24667226CE4286F124E7DB55108", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869254, "uuid": "93df80e4-0fb8-4dee-a71c-edebd41951e3", "value": "3072:oUu3OLKZBOgX6oooxvji42GNi63LD6z2qoaaaaaaaaaaaaaaaaaaaaaaaaaaaaak:od36KZl3ooxvj12Gc67Moaaaaaaaaaaz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869254, "uuid": "ea3fce99-af20-41c0-b78a-19e371df888a", "value": 141697, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869254, "uuid": "d305a266-bfe4-45eb-a6fc-1748edef0c30", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869254, "uuid": "feccfb90-862a-4029-99da-56f27fb3e170", "value": "Scan-22289_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a0e6c33-059c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1629893016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629893016, "uuid": "3b461a76-bbfe-4c5d-82ac-8f822bec3c52", "comment": "Malware payload (Smoke Loader)", "value": "9899f3157aa005a66c2b78711f1c9690", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629893016, "uuid": "d5d0de62-9410-45c3-a5cb-0a5d68d0f873", "comment": "Malware payload (Smoke Loader)", "value": "f01497406f265a9cee12fb853badb8b691862364f0993bcd82235fc085db0ce5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629893016, "uuid": "dfc4513e-78ef-4049-b7b9-abe19425b3f6", "comment": "Malware payload (Smoke Loader)", "value": "532dba9b3a30f6d37c331163775afc2bfe2386b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629893016, "uuid": "c1cf45bf-02f6-45be-9aba-14bda0ce0068", "comment": "Malware payload (Smoke Loader)", "value": "39fc2bba51c4a3a0de01c5c8be0e602fb6a2e9903f5030c0325b87794bdb676c2a8666f665859a1f598c22cb976cf39c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629893016, "uuid": "bf9a98d1-5305-458d-8e76-d5d6bfa83e59", "value": "T1AC448D30AA91C035E5B312F845BA83BCB93A7AB16B3450CF93D526ED42386E5EC31757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629893016, "uuid": "31e12b05-f8e4-4504-8169-df9a9402419f", "value": "35372ade599ee63db174ac99307517b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629893016, "uuid": "8c4c6e10-4c4f-49a2-acae-26ddae058667", "value": "6144:Ei84U6dV5ucXnHkjA0KfxxGI+hX6veVigmCFrKJrMH2:eq75hXEjA0KJxf+F6Gcm8J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629893016, "uuid": "59e5487a-dc43-4cbc-b028-18070378ce81", "value": 275456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629893016, "uuid": "4687881b-69b2-4b2c-8417-0b367b1bf6f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629893016, "uuid": "44b2d170-7049-4dff-acdb-807680d98633", "value": "9899f3157aa005a66c2b78711f1c9690.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10d6cb31-0565-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869217, "uuid": "b0e4eb64-ee10-408f-85cf-89229abe3fc9", "comment": "Malware payload (Dridex)", "value": "e683f8ac796076ba2b6c8960ce298c98", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869217, "uuid": "1835ea72-8be4-4505-800c-47b939be8e4b", "comment": "Malware payload (Dridex)", "value": "f1332a3c5e93b14d9e9917409220794fb35e7828a2cc18f46ba30d0be2dff993", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869217, "uuid": "9878d42f-0219-4d21-b770-8161d2e13e95", "comment": "Malware payload (Dridex)", "value": "f3aaa27073e6920c565d2b5e8093924ea4f88a10", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869217, "uuid": "3804c708-e05b-45c7-9f04-5c19d8091622", "comment": "Malware payload (Dridex)", "value": "f0fcfd9b22f2577e6087b012218a87bfd60aa0963f5f6ddc5df9baa00a35fabda703056b4eebf332c45d9bd13df5a556", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869217, "uuid": "7ab9fe7f-e9f5-4a6e-96e3-e85018de8fa6", "value": "T171D3D0EA3576CE58C02D533C45AE2E3367B88B8157E1065322ACF8387F624E7DB2521D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869217, "uuid": "f3ce3ddd-23f6-4c50-be4a-3db4d34f541f", "value": "3072:oU/5OsRBVvsj1Cbi63LD6z2qoaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa3RY3PK:oDKL61Cu67MoaaaaaaaaaaaaaaaaaaaX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869217, "uuid": "49fc9377-a6a1-4dff-ae06-47f0da159d5d", "value": 137772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869217, "uuid": "26ec4d61-3966-4b0e-b77a-8a8012df21e5", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869217, "uuid": "431b3902-91fb-42db-88ce-1da1ca059a3c", "value": "Scan-2426564_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "118a08fa-05a6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (QuasarRAT)", "timestamp": 1629897135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629897135, "uuid": "71f7b516-ef9e-4009-95be-428ab09d4773", "comment": "Malware payload (QuasarRAT)", "value": "483289c26f2b9e864a886572aea47f0c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629897135, "uuid": "e2ad1ba4-0c0c-4a80-9fa0-0104b9942074", "comment": "Malware payload (QuasarRAT)", "value": "f288c38cea61918418840da7fd904cfde008849a4692daba6f8a2221d97bb7cc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629897135, "uuid": "8fa34d1a-9816-4e96-ab82-78cfef5ea153", "comment": "Malware payload (QuasarRAT)", "value": "1b5b258b18625720021c9cd8508d6e1757184828", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629897135, "uuid": "5fd9b8e2-9d5a-4fec-bfe1-8ee6427c3b84", "comment": "Malware payload (QuasarRAT)", "value": "fb2717fd86691899a9131da9bfae53a52aa1c2921111bd9659b438296c25a60c86d85cef6cb2b6d2a786eec8f1dbf5f9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629897135, "uuid": "419de15c-0824-489c-a2a9-da68a50bee2d", "value": "T16CB46B4023F8862BE5BE1779E871052057F9E807B27BFB9F4541B1E92C667069E40BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629897135, "uuid": "3bd1d89c-3be2-4eaf-b71d-47bbacb3fcc1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629897135, "uuid": "4df22cad-19a9-41b7-be2e-205878643312", "value": "6144:oTEgdc0YuX7IxUpGREWjtvz3znmQQqg8tXwcEAOb8F97TFZzd6cTR3O:oTEgdfYfxUS9/5wQpp16cdO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629897135, "uuid": "6fbad67d-1361-40e7-816b-b6150829ed46", "value": 514048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629897135, "uuid": "c64f32dc-3d94-4da2-bb88-ed8edcb3de52", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629897135, "uuid": "3005a3b7-103b-4686-8405-19cbf3acfb00", "value": "483289c26f2b9e864a886572aea47f0c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b83e3a22-0564-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869068, "uuid": "66de6c21-c682-4679-bf44-4a434a45b95c", "comment": "Malware payload (Dridex)", "value": "e96dbde934e068285ea1959a4793663a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869068, "uuid": "7f2ef9e7-58bf-45db-9337-ab5bfbcfae37", "comment": "Malware payload (Dridex)", "value": "f357668862a1af4f388eeca8868bd3c502d2a51ac80a9c8c4f92d4c61247769b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869068, "uuid": "394776ff-b43b-496c-90af-8df314aab4a1", "comment": "Malware payload (Dridex)", "value": "f2bfa5c9982691f9e46553899f27e9dd7ff6d2d1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869068, "uuid": "0b3231e2-8ce8-4e3f-841d-9c64c99407b2", "comment": "Malware payload (Dridex)", "value": "ace8da3bb4f08a7e42520c26219cdd4221a5f5776022d1a8128e0734e2db1827f1fdf2427ce85a6c01cb12d1fbfdde92", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869068, "uuid": "03b7dcea-69ee-4ace-8605-2ee531539967", "value": "T1C384126886B1C84CC88F813E52EB0F71D7B12A1596D06B1F81B0E5086F56D7E8B6F4ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869068, "uuid": "beb8bb11-49e4-4d33-a431-64fde64895c9", "value": "6144:o6enNkfdjqKveug2LohOGYw6CC5jTT453mjEIbWiGVAKSLFN+YInSCRvuPsxNTA:XeNgWKGuHL2OGY/TTy2jEIJc6FNu3uPL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869068, "uuid": "3d1e525b-7cc9-45e4-bb9d-8d5fcb36bd81", "value": 381991, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869068, "uuid": "8d5f9d43-5099-4be8-9c8f-54cc51b0ad08", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869068, "uuid": "03ec3b05-3caf-4453-b5db-d4fa48ebfae8", "value": "EoY_TAX_Document-424861_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e67b380-0597-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CoinMiner)", "timestamp": 1629890795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629890795, "uuid": "ea7f7288-9e4c-4dd1-9014-f52620f6011b", "comment": "Malware payload (CoinMiner)", "value": "1a7ea27b8eb6ac33cb9f1e5c3b4adffa", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629890795, "uuid": "63fbc614-bd99-445d-a560-3178683c4aa1", "comment": "Malware payload (CoinMiner)", "value": "f399f4852c2b6d13cc6424cd73d55ae56c4b6be7161f06e0383a18c024f2db55", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629890795, "uuid": "6a36e3c0-7762-4b5e-9362-5bf507e593b9", "comment": "Malware payload (CoinMiner)", "value": "3b28864fa969b44cae0905f5a5f1b069f61fa89e", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629890795, "uuid": "cda63138-83a3-4f5a-a122-47f24a8ce66e", "comment": "Malware payload (CoinMiner)", "value": "b1defb69ffeb10a99a383e29de8546fd7e2766ec9026c1b413c7e9f4e72729e8d3eecb8db1c98802ac11ca4333e920f2", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629890795, "uuid": "59cae92a-8fca-4003-b3fa-13e94d20d5a9", "value": "T1DDA533D23B3641B9E4558CB6D542A38EA13FFF9BA02099FE59C874A76C2524C1F336D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629890795, "uuid": "8a1ea5a7-3dd4-4a86-8620-9b84c660d092", "value": "49152:VYLO/uAcEZ9FHUjXfRZtcTYlppoTAKfRf5aCZrJc3/RGXINIWX:VY6/uAfps5ZtcclppYdfRBZraiqI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629890795, "uuid": "01b6ec75-3889-4949-a9a7-ed53189868ed", "value": 2131968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629890795, "uuid": "e851607a-4f82-4d05-a573-a2f781345114", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629890795, "uuid": "c58a8a04-07c7-49ae-b944-cc978159cfd2", "value": "1a7ea27b8eb6ac33cb9f1e5c3b4adffa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2af6bb3b-0565-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869261, "uuid": "7303f449-0c07-42e9-879c-cbb4f7e83fdc", "comment": "Malware payload (Dridex)", "value": "812da75243c46282b2c7ed01ff6da780", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869261, "uuid": "ea5ade68-c293-49df-aab1-19d08b0c4148", "comment": "Malware payload (Dridex)", "value": "f4b05b9f1b487e874fcf8b85fab7ebf5cabf9cad2b327ad4956a0e5c483eb611", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869261, "uuid": "39a303eb-ab55-49de-bbf8-61bca2467c2f", "comment": "Malware payload (Dridex)", "value": "51a8001081cffd6b413b35cd086caea7f981ef4d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869261, "uuid": "1f7b4c8b-12dd-4cd6-9f06-3af30f23e6a8", "comment": "Malware payload (Dridex)", "value": "45a5c20ba5fd008be581dbc773c04d8f28a2407381c022e781617da893c837a37d4df806df118ca983dcb14610ec33c8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869261, "uuid": "5dc5a259-2206-436e-8da1-1fb318103300", "value": "T117B3E0A67632EA9DC03D137C45DE5FB76F748B85029247172139E86CBF320A7EB40229", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869261, "uuid": "1fd8fa9f-34c8-4ed2-b322-aebc9a811dbd", "value": "3072:oUh/98+ClYicY1i63LD6z2qoaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa3RY3Pa5:oY/9nClMY067Moaaaaaaaaaaaaaaaaa/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869261, "uuid": "1669d4c2-db4a-4702-9ad8-d6640e93bbcf", "value": 111104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869261, "uuid": "9d5973f4-4972-4dd8-96fc-89ec29bca0bb", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869261, "uuid": "308b755e-5b29-4b68-ba44-59703eb07658", "value": "Invoice-0532765_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc1c923b-0589-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629884966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629884966, "uuid": "b3f98dfe-b9e0-40fb-a682-0fd30cae5946", "comment": "Malware payload (RedLineStealer)", "value": "953d93e24956822e11d1ff9e433731d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629884966, "uuid": "1dcd77ed-9ccc-446e-be82-e5080001c88e", "comment": "Malware payload (RedLineStealer)", "value": "f4eb31de9302b29f94e951cd77159b29ad6f36dc48dff1df573d13be632a0c16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629884966, "uuid": "63980be2-5199-4b3f-b38e-878964a6e4ec", "comment": "Malware payload (RedLineStealer)", "value": "3f45bcca182046fa8957821089d804200227985d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629884966, "uuid": "bb72aa7f-ad6a-49f8-bb68-4d2d46ac25b2", "comment": "Malware payload (RedLineStealer)", "value": "ccf2534cdafba837492c81518ddebb8c47629d855ae034c805f251b4be5ccaa9029a22954a50ebdf493bce4d736d4012", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629884966, "uuid": "5af7360a-c0d4-4c53-8c7f-008a037e6f6b", "value": "T19D64E00135A0C873C5DA41B188E6CAA0E62B7D615EB189073BD6AF5F7E341E1B71E387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629884966, "uuid": "3fd525a6-8aa1-41a2-98c3-8ce20947e722", "value": "3bdc58d7d3add14fdfc74404aa032a2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629884966, "uuid": "d0b7404f-18bf-48a9-91ac-ab16cec5c9a1", "value": "6144:OO4fR5dzAqA5UKLOCIbZy8ECbi/Q8bEcxb:OFfv+FExbU8/i/LEcF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629884966, "uuid": "3591e9bf-2c38-4956-acf4-232c9f623e3b", "value": 307712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629884966, "uuid": "7e9d67de-5295-49f8-baa1-4508571137a8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629884966, "uuid": "e88434a0-cebd-4c27-bda8-86e907863287", "value": "Wed07af0d181c04dd5bd.exe1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0d53b82-0564-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869136, "uuid": "232205fc-c8fd-44e5-89df-04f733d5407a", "comment": "Malware payload (Dridex)", "value": "b0098664ec14d1368dcb7a06e9860f4e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869136, "uuid": "2435c2ac-8431-408e-a1b1-24eca525e438", "comment": "Malware payload (Dridex)", "value": "f4ee286a74576b7ab63eaaf3524bd2c1743cb9ae29a2deebff2ab28ec8ee486d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869136, "uuid": "fe73fa8d-de3a-4d1f-9261-873b22e5d454", "comment": "Malware payload (Dridex)", "value": "d309fecb07e56d3affa03796e43d4c3b4b09055c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869136, "uuid": "fe32fb7d-e78e-4f7d-b752-79e39d6cee1d", "comment": "Malware payload (Dridex)", "value": "270da6ed4810098e96591856032a7162af958da899902813379995646fa9759466918f27a794710c7f0cb89bab4202bb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869136, "uuid": "e3ea4d12-5fb0-4b9a-beb4-5b26788efbb5", "value": "T1B2B3CF9D7263DA68C02D933D64EF1FBB6BB08B5812525B06122DF86C9F334E7DB50129", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869136, "uuid": "ef890acb-445b-47a9-b4e0-33fccd61d0fb", "value": "3072:oUW8tX8pJePmxD++bWSi63LD6z2qoaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa3E:oitX87ePm1+8K67Moaaaaaaaaaaaaaap", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869136, "uuid": "75af3f4b-13e7-4499-9c34-f9ef881ccc56", "value": 115762, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869136, "uuid": "fe0e2e53-dca4-4d15-b885-c3932feed897", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869136, "uuid": "bd68e320-9b05-4e8c-b28d-586b84ca5605", "value": "Scan-49180_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3e25d93-0564-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869168, "uuid": "51f416c8-e1d7-4b1b-93fb-bf3a68409479", "comment": "Malware payload (Dridex)", "value": "db19b58388e9c977326d7ace50b667dd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869168, "uuid": "4eed2fe5-0517-4792-932d-b6c49ea7d7af", "comment": "Malware payload (Dridex)", "value": "f55ad933ae92867b23e21b49ff6a02b97213c748b400458d3b995a82ccb39810", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869168, "uuid": "d15f819c-d24e-4802-8680-54227cb536ef", "comment": "Malware payload (Dridex)", "value": "ae9ab714c107561a1f6fd70e04b505af8753aae1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869168, "uuid": "4515123e-5d60-4398-8381-9fe30fd5a108", "comment": "Malware payload (Dridex)", "value": "cbfee544b2e5113b2f0361c560796f8569e50eb3df07683d572c2b4583c995c1d877e774d1ef631b9ff5e7eebd9fe082", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869168, "uuid": "3905afcb-a259-49ce-9020-25d550c5cdf7", "value": "T1E474127C93A1C81CDD4E803F91DB4FB1DB7129069680671F96B2F70D6F02E798B9A099", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869168, "uuid": "293d4cf0-8b69-4316-a7de-314e6400237d", "value": "6144:oChj57c7gDT2LohOGYw6CC5jTT453mjEIbWiGVAKSLFN+YInSCRvuPsxNE:tjFc82L2OGY/TTy2jEIJc6FNu3uPmNE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869168, "uuid": "5c83c451-09df-46f3-bee1-7695c1167710", "value": 357918, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869168, "uuid": "815572ec-58ef-4323-9516-1a7d0cbbd78d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869168, "uuid": "7ad320e5-5d39-418c-af9d-65768852f3fb", "value": "EoY_TAX_Export-39314995_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebf2ee20-05ba-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629906092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629906092, "uuid": "05b11b10-cc44-4b99-8b86-e9be908e11c9", "comment": "Malware payload (Dridex)", "value": "e5ff936a89b3b2b5f2bc5fb937190bbd", "object_relation": "md5", "Tag": [ { "name": "22202", "colour": "#655FAE", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629906092, "uuid": "fc7a111f-adc0-4173-8a35-71e609c31dd1", "comment": "Malware payload (Dridex)", "value": "f5c001c8dfa76b9ce2acca2b45dcb2cf845a6e39545fc883ae0a02bf53104b27", "object_relation": "sha256", "Tag": [ { "name": "22202", "colour": "#655FAE", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629906092, "uuid": "5a377fee-b389-45fa-8a67-fe5caf927484", "comment": "Malware payload (Dridex)", "value": "042dd28c88e511bdc78614d5ec8510a3b31a0cfe", "object_relation": "sha1", "Tag": [ { "name": "22202", "colour": "#655FAE", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629906092, "uuid": "0d84ab7b-b3ac-47e8-bf95-cd9e5502f82e", "comment": "Malware payload (Dridex)", "value": "a75c02ec6f1766c8544f34946e7e6a0781be0be54473e1e97f1c5af044c7f212a265c4292f84b9e6c9ccd952a697a6ea", "object_relation": "sha3-384", "Tag": [ { "name": "22202", "colour": "#655FAE", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629906092, "uuid": "75f8c871-f93a-4edc-bdce-d9d79aaa4c1d", "value": "T1CA14CE1E885B10E6F80740B8315EB637B938D627078AD67BA6F1C71EFEE9569487C304", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629906092, "uuid": "868c4cbd-4846-42b8-b31d-7aec1b85d101", "value": "3c44b2fa7c0a62c1734565e013af2722", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629906092, "uuid": "2a3d57b8-65bb-4903-8e83-d4b1b5e95d80", "value": "3072:GxuvIIXlkwIyGUFYkjSgWbUgZU0uzW4SLoRaYDOOK9dCYQ1TEn:GxuHMyjjeBiWbYFmg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629906092, "uuid": "04029430-3026-44ee-8d25-cc1a25bed5c6", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629906092, "uuid": "10390742-0f83-47fc-b239-015f71f3c172", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629906092, "uuid": "becc57a0-1ff1-440c-923b-a6469229aed9", "value": "networkmap.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed12705a-0564-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869157, "uuid": "3bbb5f55-bbf5-4656-b252-4d2286a17ae8", "comment": "Malware payload (Dridex)", "value": "64263cd55fc9b5a6790c5c366958bca4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869157, "uuid": "8ddf17eb-a72f-4f14-aa02-6eeba0955a7a", "comment": "Malware payload (Dridex)", "value": "f625c31ce34fd7c1480292622ead7f22ad0694fe988f2bd81cb5479ac69622e7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869157, "uuid": "90940326-b0f6-44e0-a903-5a7469e7c056", "comment": "Malware payload (Dridex)", "value": "c927f2e8db6a54bf5088770f52695c10723acb13", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869157, "uuid": "ea75553f-9f90-4e79-b387-fb6fa04b2b27", "comment": "Malware payload (Dridex)", "value": "64910e5b6e7d1ff4c08941db60731efcd605473cc88e93678e19a123548acd40eae1327d16caba3cb005cd23b3605754", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869157, "uuid": "3d289c1a-76bb-44bf-bea1-c8d7eaafc602", "value": "T175B3D06A7673EA9CC02D023C51EF4FBB2FB44B8117D2560A12ADF86CAF225D7DB44119", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869157, "uuid": "35f1a97b-56fc-4efd-ab5d-b1e38e0cf474", "value": "3072:oUE5IkYqBrIqU5e8eF4xfi63LD6z2qoaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa7:oBIkNzUje2xK67MoaaaaaaaaaaaaaaaK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869157, "uuid": "f1299c8a-e777-4d99-90cc-d40769bbd5ba", "value": 112775, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869157, "uuid": "bdd27bdd-a50b-4e61-b05d-768bf20222b1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869157, "uuid": "31d95ec2-f68c-4254-ac61-e8a087e07800", "value": "Scan-3119_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0c40712-059b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Stop)", "timestamp": 1629892785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892785, "uuid": "34621072-f8f6-4de2-bbe4-b067cbf6342e", "comment": "Malware payload (Stop)", "value": "3f501f228053a667928acf687e055c27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892785, "uuid": "d50c88a8-85bd-48be-b5a3-b53c40d84177", "comment": "Malware payload (Stop)", "value": "f64101c39b8344473763277c715167216eba418e86f4f2cf22ee7724182b930a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892785, "uuid": "ef4913d7-471a-470d-9a77-1852dcfe3190", "comment": "Malware payload (Stop)", "value": "7f94e6347f15300fd2dfce001b9a8d2401186a14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892785, "uuid": "108809dd-3e5f-46b1-8b8e-5efde26547bb", "comment": "Malware payload (Stop)", "value": "0810fae4e6b520c7b1e2eb11f57919ad6b5acb5d7d2b6127951e6731888dd3c874fb4eab4b13c0631dff4da9bb674553", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892785, "uuid": "02f92030-ee4e-4859-a1fc-805d527a775f", "value": "T198F423A077F0C8F2CE5E8071D497C6B8E72A7E166AA454C723E8475E8F757803D2528E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892785, "uuid": "4e5f1702-315a-420e-9090-62056653af0d", "value": "bd3c9edf948deca79ee5e78523f1a042", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892785, "uuid": "8b7cf69d-eb18-4b0a-9d96-02ed582b4996", "value": "12288:8nKv7C5OL23/Cq84IWh96NRs1x6txJ6vTXZoN7lpSEa1LAvcF:8nQip3/V7h96f/3J6vTXKjda1MS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629892785, "uuid": "92670c67-53fe-40a2-938c-4e3a90619720", "value": 739840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629892785, "uuid": "e8b9a2d3-4f22-48c1-92b3-6c702b9e51e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892785, "uuid": "dc885fc4-0c89-41f7-9a18-c21bd78be8cb", "value": "3f501f228053a667928acf687e055c27.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30b70284-0554-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629861969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629861969, "uuid": "826644eb-da22-4cd7-92ce-c961ad6157fb", "comment": "Malware payload (RedLineStealer)", "value": "ca15de24c3fa60e90b343b7376808d1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629861969, "uuid": "1be73dc0-54bc-4eb5-89bd-f71c36d00b7f", "comment": "Malware payload (RedLineStealer)", "value": "f7a805b251505433e34517da69eccb73955a424bb9d9061309091cf52c07a349", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629861969, "uuid": "401cb0f9-4300-494d-8e85-1d48db5b9f2f", "comment": "Malware payload (RedLineStealer)", "value": "e8004170f53ff94665f2ff97a97fb7a78d3a0a74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629861969, "uuid": "aaf93b2d-f8b6-43cc-8715-e722e1b5620a", "comment": "Malware payload (RedLineStealer)", "value": "0241ed2a2d425cba64e66c42745246dbbb4a722e400f04b69eb8bb1585855c7602b9da044ad1b811fc593b56c801f92b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629861969, "uuid": "4f601f93-574e-49f2-87d9-ebd93ad7dfbf", "value": "T12F263321998138FEED276EF08C17BB9E48B1449408F5A8167B9437B1113779B9F3A387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629861969, "uuid": "2fcd5cf8-d4aa-425a-b884-4fd826c72369", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629861969, "uuid": "afd3d0c6-0f38-4984-a9f6-ff3fcfee69ca", "value": "98304:yIfOSOUrxz7b98tUs3nKN/r/i3AF6mwQApnC1VUc21ZBNcPflHM:yIfPOCxzHqB3t5NToVULBNc3a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629861969, "uuid": "bc635ead-b944-4a97-9c50-c1d2810bae6b", "value": 4448994, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629861969, "uuid": "9aa301a7-9430-4cb1-ae79-1856f9667d44", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629861969, "uuid": "12637b07-2866-4124-8db3-524df92e214a", "value": "CA15DE24C3FA60E90B343B7376808D1C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57a6c9f5-05b9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629905413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629905413, "uuid": "704f084e-b06a-4870-88fc-258487625c2d", "comment": "Malware payload (RaccoonStealer)", "value": "aca2a26466dd75b8c76c120ddbef91b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629905413, "uuid": "65082b3b-8bb4-40f5-b23f-ec9c54936a23", "comment": "Malware payload (RaccoonStealer)", "value": "f7a9627ab70e8be38b6525ebb99ec120e210a33ca583a1468bca1f82b30a9fd9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629905413, "uuid": "277afb63-dab7-47e0-8e94-8dc0dafb4e27", "comment": "Malware payload (RaccoonStealer)", "value": "d9912235bef0ce987259789412209b60f0228687", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629905413, "uuid": "7c65abc3-d361-47cc-8f81-00d9dbf86059", "comment": "Malware payload (RaccoonStealer)", "value": "fdbbce861226e2fe0d7a0b6a2106b53c2e30c2a4233e5a57a9f53ce22f4a4f9d10bf651b77b74d0a6f9568b8ad60e6ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629905413, "uuid": "9f1dc4d6-e431-4272-935c-027793a1c7b6", "value": "T110B4E0316A91C034F4F311F845BA83BCB53A7AB1673461CB93E62AED42346E5AC3175B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629905413, "uuid": "3492e2d2-f426-4b5c-88fa-6110ffaa33b2", "value": "35372ade599ee63db174ac99307517b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629905413, "uuid": "65cfa2ed-a65c-4549-9b13-fd31593b81ba", "value": "12288:8P8y2AgBoYsok+zqvcw+OVpqDMPn7QKZx4OjjpzgoKkdZ0lPXZp:u2AgV+N+ObqDMPnUcCkdgoKOyRZp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629905413, "uuid": "92c07040-cc7d-47cd-bfef-edc0b6e591db", "value": 532480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629905413, "uuid": "e50350b7-e2ac-449c-b93f-1448bc2d50af", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629905413, "uuid": "249f1fdf-d736-4a6b-8626-93dfd1c004f4", "value": "aca2a26466dd75b8c76c120ddbef91b5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0c277ba-05af-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629901268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629901268, "uuid": "980bedbd-36b0-4456-9e03-d4c4c6b5a66b", "comment": "Malware payload", "value": "048973fb1d79a1263ed70c42819520fc", "object_relation": "md5", "Tag": [ { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629901268, "uuid": "562200d6-9dfa-4bfc-a9c5-6d4dc08342d7", "comment": "Malware payload", "value": "f8273617fe63d7b1e783427b76f0b250b428648e7cb47a45bcf98fa72bc708f3", "object_relation": "sha256", "Tag": [ { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629901268, "uuid": "78f0e879-c563-4ab7-812f-4b8f27d24bdd", "comment": "Malware payload", "value": "a0dd70a2efc0449ea432bc165ce7710332473432", "object_relation": "sha1", "Tag": [ { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629901268, "uuid": "882d8caa-62ff-458a-a93e-a85d6e89a74a", "comment": "Malware payload", "value": "ce9265f27c8142f08ca3bb583b349d28267c59448ae9d59e698539e2cd7a7ebf7e0fdb09267e47d5d61d94965ac1af5c", "object_relation": "sha3-384", "Tag": [ { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629901268, "uuid": "3fd5733c-ac31-4db0-b5ec-ed554dfd959a", "value": "T1DA453366870F12DC507FDE754613AF45A2AC9813D86E0880E09F1F6BA473E0E752F9B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629901268, "uuid": "edc844c4-b14e-4906-9536-e90091fbce59", "value": "24576:fPbIEVaKH1GtqCnHlp8XlSE0YqkKQLpuEvESPDNpa+bKbKRFgrt7:vVDAlp8IntXEpulSPDNpa+Gu4Z7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629901268, "uuid": "f437098e-1b9a-4092-8e14-f7ea5c4cbffe", "value": 1274582, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629901268, "uuid": "8d38e1d4-dba5-4513-86c9-dd08350d24f4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629901268, "uuid": "7e70311a-ec1a-4993-b7ba-c467234d23fb", "value": "KNRyOLnGcT_UKWN.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a91e340-0573-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1629875461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629875461, "uuid": "dea1133e-5397-4cf5-a401-d0ba147ed60b", "comment": "Malware payload (RemcosRAT)", "value": "d33d2cc2bb1c1021b6342d926cf11116", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629875461, "uuid": "972ffc0e-403d-4986-a7d9-eed64cc5478a", "comment": "Malware payload (RemcosRAT)", "value": "f82ddb5a7484a583727029b8474105a7fa4af2f61f2bd0a71c4794e5aad39453", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629875461, "uuid": "87bd0992-91ac-4796-ba2b-1d13cc463bb2", "comment": "Malware payload (RemcosRAT)", "value": "0e7d157df42bfce3629a890255f4863f49fa1d6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629875461, "uuid": "133d177d-7ca5-454b-bdfd-2b38e766f5da", "comment": "Malware payload (RemcosRAT)", "value": "4c85a9fc511948e62ef3b1f7409cd52fa52c039ae885d8ed9d6816f0a658d67cebedab832ed90f8c9dcf2db866accc88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629875461, "uuid": "8a8d4c62-c648-4999-a526-a9a1563dc0bd", "value": "T18675AF25778077DAE8A50F728823268883F295472731F76F1CC567E89D31B1B872B663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629875461, "uuid": "61b48501-8622-4100-b260-6629dc12f48d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629875461, "uuid": "52f122ed-72c7-475c-bbd9-fbc133a1543f", "value": "12288:kHF+2LKKTVqtzt+8RQsLhBN9aTom5OuayIimUYgKTPmC+4T3DJrtxi7AIEph88oL:k4EK+whf9aTXEualgQPy4T3trtpDWXx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629875461, "uuid": "9c635e1c-7e13-4d9f-b404-923e929d1a6e", "value": 1634304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629875461, "uuid": "aed7e58d-386e-4710-b234-4b08ff163d5e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629875461, "uuid": "40f8d1cd-69fd-4de6-8f57-e101fa92b4c5", "value": "NEW INQUIRY 20210825.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24e6c2ea-05d0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CoinMiner)", "timestamp": 1629915207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629915207, "uuid": "10d3b247-ec16-4d41-88be-dead632ce9a2", "comment": "Malware payload (CoinMiner)", "value": "657855a3c401277ebdb5a7185d1c2eb1", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629915207, "uuid": "0f6dd899-6196-4a7f-93ee-5f9bd48681ad", "comment": "Malware payload (CoinMiner)", "value": "f84c1b53daf8279593ae9a9f6d8590ceb488318ce70a09bf25bfbf494398a83c", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629915207, "uuid": "1ca501c0-ac1e-4559-94ae-ee9ca38c1e48", "comment": "Malware payload (CoinMiner)", "value": "eaaf20b6f990a93713ad60e8acc6673961b8f5a4", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629915207, "uuid": "b3157914-2526-462c-a81d-0f7c7804c438", "comment": "Malware payload (CoinMiner)", "value": "3794ad7130017fcef6b2adc47a3f60a480e893321cdb75f55629b5dad49ce4fb016f5338a69fae223a03fc3e9eec1061", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629915207, "uuid": "89c4dab3-9317-4e8d-9c58-5932b7eb688b", "value": "T1E8349DDD2AFFC998F8945D7BFDF2369B2836B2931A0D112C5809805D0C663E8C949B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629915207, "uuid": "659fb712-d593-4666-b983-2632f5ba4a43", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629915207, "uuid": "8ffd5ec9-7709-4d3b-b6e8-4c954e9aa1eb", "value": "3072:eF2c91ncDyX3/araLgRAKDdFCBo46LtnrDseBRAOizpRaD+S6dOl/d0jWLDyk:+2mcDs/au0RVM2hrhi9R6+ST/d0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629915207, "uuid": "f64b9a40-ea42-4e4f-99e2-721b29392688", "value": 240128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629915207, "uuid": "346f2b15-0a28-476a-8709-b715b251dd26", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629915207, "uuid": "010207b2-4a53-430a-912e-ccaf0027d226", "value": "657855a3c401277ebdb5a7185d1c2eb1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17bfcb43-0565-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869228, "uuid": "c583955c-a978-4f33-a400-6d397b25af9c", "comment": "Malware payload (Dridex)", "value": "9d6686dcbab3d2491e654fa321784abb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869228, "uuid": "7059c52f-9dcf-412d-b683-e19bbade94f0", "comment": "Malware payload (Dridex)", "value": "f9dda2ea6683f7e5ba19b9570b3ed82ab15ba67ef45a730b7b614dfdc3a590f5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869228, "uuid": "1dda8643-d915-4c0f-b6e2-f235817a0e63", "comment": "Malware payload (Dridex)", "value": "ea29be8d59ffeb4a139b915b3051cf304703d439", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869228, "uuid": "e828b7c9-38bf-45be-b3fc-517d6e08ae0d", "comment": "Malware payload (Dridex)", "value": "c8d0d7fdbfe05b89e087684669345518089a7811ef18bb76f8dc52a2054050af1ed4276835e683612c3b3d23b0d9847f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869228, "uuid": "888e2f3a-8423-461c-8366-4db807c97994", "value": "T12CD3D1E9B273CA5CC52AA37C49EE1F773BB48B9505B256171168F83C6F22997CB4810C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869228, "uuid": "ace60dd3-5f5c-4ef5-bd1f-cf78624c5b6a", "value": "3072:oUYZrDU04Og+2Qm6br4Oti63LD6z2qoaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa3:oz204z+2laF867Moaaaaaaaaaaaaaaam", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869228, "uuid": "12b23d8f-4876-473a-a0ea-318486c976d8", "value": 139188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869228, "uuid": "60b99e45-9dd9-4548-a6de-130ea7a2795d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869228, "uuid": "0392bb15-655e-4027-95d4-58b71d9f301c", "value": "Invoice-18106320_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da026fba-0566-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CryptBot)", "timestamp": 1629869984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869984, "uuid": "bba10957-cd04-4dfd-b64d-f469cab8724c", "comment": "Malware payload (CryptBot)", "value": "03903dd6bc470a44ed1cb27e4e965854", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869984, "uuid": "b4e51424-5463-480a-8ed0-6273af1fe3c6", "comment": "Malware payload (CryptBot)", "value": "fb6e522546a83e50fb8759d02881ded745926b7746f06f64694a13aedadd2d6e", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869984, "uuid": "83a7b3d9-3ef7-445e-b65a-23bcbed8fb5a", "comment": "Malware payload (CryptBot)", "value": "657a978dfd2918d3adfb94001c16c94890b3499d", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869984, "uuid": "3b4c8587-eb1a-48f2-98ad-d9bd51fa7796", "comment": "Malware payload (CryptBot)", "value": "2ebfc613ef84edae5e5a522288935caa853543729065a74cf0f2731373ac6756581b370e918ecccd578c494c9198ef42", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869984, "uuid": "2dd3cd6b-6f62-4a44-898f-982b1d0d5e09", "value": "T175C412003664C637C0A695B144D687A0E778B9925F668A4337D8EE1F6F343F0BB2B365", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869984, "uuid": "606c3f42-036b-4aad-87e6-c030c396a2e6", "value": "3bdc58d7d3add14fdfc74404aa032a2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869984, "uuid": "ceb78cf2-06a6-489b-9099-2aa46988610b", "value": "12288:0sdaynF/iUKXvE0nmG8Um2HmD06lSxYwR8m4QgnpNnJwrEcF:0s5JifTmV2GgsSSwR8dRC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869984, "uuid": "6bba63cf-4bc2-4b42-8f4a-0a517b0c7252", "value": 591360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869984, "uuid": "971b20bc-aab7-43dd-acfa-ec6d56164659", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869984, "uuid": "3002be83-8a1c-4cdd-b1c2-abc80ebb63d3", "value": "03903dd6bc470a44ed1cb27e4e965854.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e14c25ac-059a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Vjw0rm)", "timestamp": 1629892330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892330, "uuid": "72b6ed7b-f130-4670-9a9e-c897a9caee4c", "comment": "Malware payload (Vjw0rm)", "value": "63a88c19299c8fd2e3bf299798a6a322", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892330, "uuid": "f13c04a4-f0c8-4e63-a910-310dd6cb5b7d", "comment": "Malware payload (Vjw0rm)", "value": "fc5631bd6d785c3b3c634e71ca51fe274c72018110d5dd66e37595653f8ab0dc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892330, "uuid": "913cdb0e-d24f-4069-8727-02090f2b5041", "comment": "Malware payload (Vjw0rm)", "value": "7545d8fb37a2626b7bf4bd28ab3365e82068e0c8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892330, "uuid": "bac7de9b-dd62-420e-8865-fd96efd6c8b2", "comment": "Malware payload (Vjw0rm)", "value": "9b49a681ed6abbc3f4256976d693c21ac9b4416a19be83f963d3945fbc784f22b721aa8e9897d17162cb7be308f30e77", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892330, "uuid": "1bb4756a-be2c-4608-9626-70395e956e19", "value": "T17B14BD08DF8365C6866983037C3A167D63E1C14ADCA6BF9B791FB95E0FF6300C55A0A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892330, "uuid": "ba23e306-71f5-4433-8b65-f9737e775944", "value": "3072:9uhE0m9+ACB9epP1nu+CcFztpcUodQ4kq98YJDkBPrspGQidJHlkg:loAm9ezu+Ci5pcUoNkpkkJeo/Fkg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629892330, "uuid": "45fb69cc-7f70-430b-a717-6e985c99eb75", "value": 205153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629892330, "uuid": "df98f811-dc56-4b08-b7d3-2e90b7cb1ed4", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892330, "uuid": "85f2ad76-89ad-4b12-8c63-f07c3ceefa53", "value": "Request For Quotation.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddcfc9f8-059a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629892324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892324, "uuid": "8ab0949b-2935-4aa2-8f70-8a089b92b00a", "comment": "Malware payload (AgentTesla)", "value": "479ef6fdd48a05b4a68b4a4cc8059cb1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892324, "uuid": "ad2e0d76-3b9b-44a9-af0f-725037ae3ed5", "comment": "Malware payload (AgentTesla)", "value": "fcc7b40e69173818e71812e460cc9c87a60bc2e5aa3260118d78f722ac13a167", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892324, "uuid": "4e811525-e883-4e0b-9c47-4414451cb9f5", "comment": "Malware payload (AgentTesla)", "value": "ce1568b2dc62c4e52c6d57443c1799a819ba3ef0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892324, "uuid": "b13255bc-9b4c-4081-bbe2-99d37153544e", "comment": "Malware payload (AgentTesla)", "value": "b04b38ddb630f7bb17649c0735cf7d612bda6f1971229f5bbfe11b8a957a863a00b7e6409a425f8bfd1e16d182186cb0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892324, "uuid": "357044d3-8d2d-4b05-b8d1-337baeeaafe5", "value": "T11C5523B6C8F20344C28DB1319D06D1AD8DE66DED898CC1C4327BF5DEFA7B2794562268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892324, "uuid": "a3c5384d-a466-449f-9bd3-e05dc105be78", "value": "24576:I+cTzK5EFKpU8u7r9Za5d1wqcXtq2Czi8miuDDF6lpE6fWHOT85+bQaaPUm:cTzjFKu86Pa5vw1Y+1DxDHOT85+bQaaj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629892324, "uuid": "e8439e8d-99c1-4aa0-afcd-e1087d4c2742", "value": 1324544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629892324, "uuid": "d6282a1b-8100-4902-b19b-061bdc776099", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892324, "uuid": "6b1aa479-2874-453e-8246-18cbddb2dbb3", "value": "New order.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eee3887b-05d5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629917693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629917693, "uuid": "b6ab2bf0-6eda-4682-afef-b2d4d35b8d98", "comment": "Malware payload (AgentTesla)", "value": "c86b8e00faa85da85b45ded6c73955a1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629917693, "uuid": "274c6fd0-f878-4b2c-85f0-e3f9cdc07303", "comment": "Malware payload (AgentTesla)", "value": "fcde05ba60386f9d12cd058523b752eccb81c280d1d1ee235cdb20d1ca705477", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629917693, "uuid": "5b47e507-de64-4855-b204-665860a7a3b7", "comment": "Malware payload (AgentTesla)", "value": "048be042b3663312d1b218100e16b533058da907", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629917693, "uuid": "b3a570da-6dff-4af2-a638-ca13a19e3850", "comment": "Malware payload (AgentTesla)", "value": "2dcbb78a7bc8ed0cd05e1e32320b8f4ed812b18b45d63716c9d6ee2e6668ab3d9a10f1030ff5757c5c839f97dff583c5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629917693, "uuid": "d3be3ab3-dbd6-4f3d-b042-45be4b1bc2d4", "value": "T1EBF45CA07B95AB6AF421C1778603813346535DFBD18FC185D801FA2A6E3D27269CE9CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629917693, "uuid": "8a9077fa-1d0f-469f-8ff8-a6c4288fed81", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629917693, "uuid": "4809b060-1a31-4ee8-83a9-77c6a749ed70", "value": "12288:WzPEUGkFdvV2L+EZkHZgnrXKfCIfMrDQSiV24/3yd2OluON4fA9uwkCp:SnGJLjeHGrECIIQSiV24/3yd2OluON4y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629917693, "uuid": "c9c697a5-1689-41c5-b4c4-2acca67b2f18", "value": 724992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629917693, "uuid": "fc741a7a-8df5-4d9a-af68-77398c8e6d1e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629917693, "uuid": "4575d5b6-195f-4ca8-9143-f533cb2755b8", "value": "TT Payment Recepit.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27392d56-059c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1629892877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892877, "uuid": "8bc014a1-ecb6-4199-9040-cf2c664ec69e", "comment": "Malware payload (Smoke Loader)", "value": "2fc81aa8455def455e77a0109540400c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892877, "uuid": "22ca49f8-3911-4bf2-8c4c-328d040272e7", "comment": "Malware payload (Smoke Loader)", "value": "fcf9157232e57a1d1f8bfa47da34f9e223eca28d0ffa114eff7c00c4f1b84f29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892877, "uuid": "d262ba8c-c233-4430-97a7-9f57b52a119e", "comment": "Malware payload (Smoke Loader)", "value": "61e700e84d9763a084d297dec6d4c2e040ece430", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629892877, "uuid": "784ad009-c4b3-4353-8843-1a1dfa5fec48", "comment": "Malware payload (Smoke Loader)", "value": "214ad6fe4790b410c0afd74f782ae367a96311e0ded45f6d49eab16dab9b1beecd6ed7d0665ee94fbc32e60cab543314", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892877, "uuid": "3699ab44-5677-408c-8174-5cfcac602cc8", "value": "T1B3548D30AAA1C034F9F611F855BA83B9A53E3AB16B3450CF53E526ED46346E4EC30797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892877, "uuid": "8d96dd59-55ec-478a-a682-ed9e5c22571b", "value": "ddbb3eef631957f988f10b48742f9549", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892877, "uuid": "4fd056d0-9c1d-4fed-bf4e-45ba94632a81", "value": "6144:R/Vz4Z7isjHly3prBCTZzF3JUb2Yk0BYV6un+UD:bzM7iIFy5YTZzF36b51g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629892877, "uuid": "66c99de1-7db3-4555-b16d-a1162766202b", "value": 282112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629892877, "uuid": "eb4b68be-d6eb-4708-beb4-2b9df514aec6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629892877, "uuid": "47b0a169-92e1-42b3-9c97-3154060128ff", "value": "2fc81aa8455def455e77a0109540400c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2701ee7f-0560-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629867107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629867107, "uuid": "0f6695cf-0fa5-4b08-9019-ccc4f31c1c1a", "comment": "Malware payload (Loki)", "value": "ce85f6ed7367b0ff5b3a2a7c0f03d688", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629867107, "uuid": "4f6350c1-b6e4-41e0-8e9c-cec5b153ddcf", "comment": "Malware payload (Loki)", "value": "fdba896912c1dde493e9f989e50defb1a8fed992bb11677f4e5b4bb84e797aea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629867107, "uuid": "120284b0-50a5-449e-a488-1bfb700eb44a", "comment": "Malware payload (Loki)", "value": "13235ccbd9e702ea0fa6f435345bf3a93b47b0cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629867107, "uuid": "c04fc614-f466-4c12-8902-9b0488b87494", "comment": "Malware payload (Loki)", "value": "8cd1a791ce549ee60b45e50ff012065e72e69ce4d99430ec66a33479af54d202847492309c2ae919f802b4fb2c6c21c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629867107, "uuid": "dc5c36f2-184b-4515-8912-81d3472f9b01", "value": "T1F1F4817E1ABDA2278175C2B5EBE75417F0009B5F3511AC257AC203664232A7BB4F732E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629867107, "uuid": "9ae62863-3699-4287-a232-f501ed32a1f5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629867107, "uuid": "a28e302d-407f-44c3-b691-7794be5d17b8", "value": "12288:5x4FeeJr7uapz/aoSyLGdubJVp5GbjPjF5SN:5x4FhJreoS2pgnPjH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629867107, "uuid": "f573d417-1c0e-463b-8dd5-ee57a6ba7a27", "value": 792064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629867107, "uuid": "36b75020-66de-4471-9097-755b317c1678", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629867107, "uuid": "136debe5-4328-48ff-9285-53f78c2f5c01", "value": "INV#202170607#SGNBM4809600#BL_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5173721c-0569-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629871043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629871043, "uuid": "7167160e-b3e9-440e-b90b-e059c9cb1011", "comment": "Malware payload (Mirai)", "value": "2d9cfebe4efca547cb524c452ebe286c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629871043, "uuid": "1e48d55b-03a1-4495-92e4-00f0e1ca6945", "comment": "Malware payload (Mirai)", "value": "fdc944a690a11f5f341376268869a58db9a2aef19969ec2762a2317bc11e4dbc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629871043, "uuid": "7eab8348-6e98-4696-a2de-2ebdbc3bf676", "comment": "Malware payload (Mirai)", "value": "57d37e96f8e2e016e2981acdb1ad6cff4dab49b4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629871043, "uuid": "7935af77-4b70-4508-939d-4bae1adebd9a", "comment": "Malware payload (Mirai)", "value": "82e1ca8b8309f69723338c02c4d0c9aff9627e680c27ccb964c5d9a5c50fe095a7b36b7e7e2d08a58e0a5f9b57013088", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629871043, "uuid": "330cbc22-a32f-4170-b44c-8a7c246e3234", "value": "T1302302384A524680FCFDEA3095920E720EE87F37AA40DE0E495AFA4959CB4FC71165DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629871043, "uuid": "5a2b6be4-f92c-4502-a551-a687635dc075", "value": "768:fvdCbvsA9feQoKHba97ujk8oDX3EFIpjbsKVXVykWlhlIR3Kq8StZn4LOwNUJgGn:fv8bvsIv5nruokG/IR3Kqff4FNMVJus", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629871043, "uuid": "207b2b08-52b1-4efd-a1a1-1de06aa2b996", "value": 48980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629871043, "uuid": "b1c48d8c-a94c-44e7-b9c5-44c6b3fb3da3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629871043, "uuid": "54adebed-299e-4b09-b6f9-c1f7612103da", "value": "2d9cfebe4efca547cb524c452ebe286c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1013d1e1-05b8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629904864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629904864, "uuid": "b60f631a-4cc8-4152-af95-89c8be35725c", "comment": "Malware payload (AgentTesla)", "value": "b2a06b4fb1811354110a6ff29195744f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629904864, "uuid": "8c971c06-3f00-4c46-9a4f-3f130534d68a", "comment": "Malware payload (AgentTesla)", "value": "fe4126564a824b6606937b8fe4a39478da1857e5a38ab9b232c52a9e922b467f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629904864, "uuid": "79007430-5e87-49f8-bb8b-67f1a09916db", "comment": "Malware payload (AgentTesla)", "value": "0a2c01b785d9bcaec305922f8f99b8ae7721e7eb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629904864, "uuid": "2ea2d273-6731-4ed5-9529-a357acd95fd8", "comment": "Malware payload (AgentTesla)", "value": "5ab3a5463ffb34cc3cec19300aff2220de26f5b4fdb8b9a89b595e1e9f0a2a8ac2f7bca5998febc38e6931c61e2691af", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629904864, "uuid": "ef274829-7713-4ca2-8cf3-daeb1eb93e9c", "value": "T16C15068DAC9C51CCE02D97D01B7286D4639ED6FF28463536B06DF2722D5BA29DFA3804", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629904864, "uuid": "960f6b0f-4ab4-4174-96bc-f87ade338e21", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629904864, "uuid": "304f6aba-f8b3-4032-9c8c-280d22bdf06b", "value": "6144:tZeZc8QKJoNrYNIun8E7NXjm4K2XgskvTGWU54M1TdJCiLKD/eIJJJvzV7DssOyx:tZYRR6FM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629904864, "uuid": "1b9f9ed5-9e34-47c3-b553-f4434488edc1", "value": 954880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629904864, "uuid": "856b0883-2733-4ef8-a15d-8f32e49dd51f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629904864, "uuid": "12053230-9dc7-4489-acc9-985a40432b0d", "value": "razi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "732d66e0-0576-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629876683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629876683, "uuid": "fdb989a3-ea5c-4018-8d66-9fb1bef61237", "comment": "Malware payload (RaccoonStealer)", "value": "41fc44fd7b8e5b0b4598b465f6dd8324", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629876683, "uuid": "bc2d614f-dbea-454d-b7db-117713295d4d", "comment": "Malware payload (RaccoonStealer)", "value": "fe74fdada2cc433e9912a1639d11c11bef71a7562b769ebd4e0221fb39e3e566", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629876683, "uuid": "619972b8-fe3d-45bc-9f76-396b05a547d9", "comment": "Malware payload (RaccoonStealer)", "value": "3cc63d17667fed2fc87a002b4c23b6e8e562681b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629876683, "uuid": "de1aff7e-1e42-44a2-b1cd-fac011af516c", "comment": "Malware payload (RaccoonStealer)", "value": "b4821249349a147daf9fbf661aec3479f6520a2d92c4e157a283779ab0df6b4f7a0541639dea0c9dce433f5d6e9fddd1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629876683, "uuid": "571831fc-3b7e-49c9-953b-cff8af7b5f7c", "value": "T17DB4E030AAA1C035F4B311F855BA83BDB93A3AB16B3540CFA2E516E916346E5EC30757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629876683, "uuid": "3e046bcf-27ac-48f9-8fb4-15f35256b538", "value": "b1f244737f482f7370a4248faac2bcb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629876683, "uuid": "6a7e06db-31a9-4703-97d2-e9dbe849f99e", "value": "12288:a38cAifIPIOPO0CS2Rux41zSgimJyCquT//l/CKL:OfIPDGucXyCZ/BC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629876683, "uuid": "0d3e7ee0-a530-40d6-be50-8ddd7eff689f", "value": 540672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629876683, "uuid": "7dae9756-8ab7-47f3-966c-c26f80fe07c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629876683, "uuid": "7e91aa45-0ef6-4c95-bcc2-703cb47d7727", "value": "41fc44fd7b8e5b0b4598b465f6dd8324.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b984f342-0564-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629869070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869070, "uuid": "0efecda0-c64f-4d8b-98cf-39358ea7cbb3", "comment": "Malware payload (Dridex)", "value": "debc139cf96bf3c38f8b665b1a130957", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869070, "uuid": "eae58526-9a47-4208-93ef-041e2b2e9b6f", "comment": "Malware payload (Dridex)", "value": "ffcd1662b626cebcd906d25a32418e2f60016d9c32860501d5aa00b70843e5e5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869070, "uuid": "9c4af4b4-7837-4da9-8284-e63955b0b722", "comment": "Malware payload (Dridex)", "value": "59b91c02041f391793f1099d6e72cdfcf257d2c2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629869070, "uuid": "3d4efcb7-7029-4904-be73-70e3c88236dd", "comment": "Malware payload (Dridex)", "value": "8129a1e22cfc1a60d1de09b7e732a2db55b90422ddef701d7c2a71bf8e0387c50275e92226859983649f269f6d323906", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869070, "uuid": "d2430138-94ff-410a-b81a-5d4417f16e8e", "value": "T14AB3D09A7232CA6CC43D923C95DF6FB76FB88F8516919309536DF41C6F229A3CB05218", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869070, "uuid": "bd7ac67b-2840-40bf-a28c-78e6b40c4d78", "value": "3072:oUs3l8NtdVledpwZli63LD6z2qoaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa3RYG:oXAsUZk67MoaaaaaaaaaaaaaaaaaaaaS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629869070, "uuid": "65329649-63a2-4e69-a29a-3725ffb551dd", "value": 114644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629869070, "uuid": "37b911d8-b488-4211-9490-41a079e976d1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629869070, "uuid": "636e5a7a-8348-4907-8ec7-89d92183bd16", "value": "Invoice-80743_20210823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }